Barnaby Jack

Barnaby Jack
Born Barnaby Michael Douglas Jack
(1977-11-22)22 November 1977
Auckland, New Zealand
Died 25 July 2013(2013-07-25) (aged 35)
San Francisco, California, United States
Nationality New Zealand
Occupation hacker, computer security professional and programmer
Known for ATM jackpot hit at Black Hat

Barnaby Michael Douglas Jack (22 November 1977 – 25 July 2013) was a New Zealand hacker, programmer and computer security expert.[1] He was known for his presentation at the Black Hat computer security conference in 2010, during which he exploited two ATMs and made them dispense fake paper currency on the stage.[2] Among his other most notable works were the exploitation of various medical devices, including pacemakers and insulin pumps.[3]

Jack was renowned among industry experts for his influence in the medical and financial security fields.[4] In 2012 his testimony led the United States Food And Drug Administration to change regulations regarding wireless medical devices.[4] At the time of his death, Jack was the Director of Embedded Device Security at IOActive, a computer security firm with headquarters in Seattle and London.[5][6]

"Jackpotting" ATMs

At a Black Hat conference in 2010, Jack gave a presentation on "jackpotting", or exploiting automated teller machines to make them dispense cash without withdrawing it from a bank account using a bank card.[7][8] Jack gave demonstrations of different kinds of attacks involving both physical access to the machines and completely automated remote attacks. In both cases, malware was injected into the operating system of the machines, causing them to dispense currency fraudulently on the attacker's command. During the physical attack on an automated teller machine (ATM) as demonstrated by Jack, the attacker takes advantage of their physical access to the target machine and uses a flash drive loaded with malware to gain unauthorised access to the machines allowing control over their currency dispensing mechanism.[9] During the remote attack, malware is installed onto the target system via exploited vulnerabilities in the remote management system, most notably the use of default passwords and remote management TCP ports. The attacker then executes the malware, causing the target ATM to dispense a given amount of currency.

Insulin pumps

At the McAfee FOCUS 11 conference in October 2011 in Las Vegas, while working for McAfee Security, Jack first demonstrated the wireless hacking of insulin pumps, one worn by a diabetic friend and another of the same model on a bench set up for demonstration. Interfacing with the pumps with a high-gain antenna, he obtained complete control of the pumps without any prior knowledge of their serial numbers, up to being able to cause the demonstration pump to repeatedly deliver its maximum dose of 25 units until its entire reservoir of 300 units was depleted, amounting to many times a lethal dose if delivered to a typical patient.[10]

At the RSA Security Conference in San Francisco in February 2012, using a transparent mannequin he demonstrated that he could wirelessly hack the insulin pump from a distance of up to 90 metres using the high-gain antenna.[11]

Pacemakers

In 2012 Jack demonstrated the ability to assassinate a victim by hacking their pacemaker, a scenario first explored in fiction, and meeting with some disbelief, on the TV series Homeland. In his blog post "Broken Hearts", Jack wrote that the hack was even easier than portrayed: "TV is so ridiculous! You don't need a serial number!"[12] Jack demonstrated delivering such a deadly electric shock live at the 2012 BreakPoint security conference in Melbourne.[4]

In the game Watch_Dogs, a similar hack is shown by black hat Aiden Pearce in killing one of the main antagonists.

Heart implants

Jack died a week before he was to give a presentation on hacking heart implants at the Black Hat 2013 conference scheduled to be held in Las Vegas. In a June 2013 interview with Vice, Jack outlined his presentation:[3]

Barnaby Jack, the director of embedded device security for computer security firm IOActive, developed software that allowed him to remotely send an electric shock to anyone wearing a pacemaker within a 50-foot radius. He also came up with a system that scans for any insulin pumps that communicate wirelessly within 300 feet, allows you to hack into them without needing to know the identification numbers and then sets them to dish out more or less insulin than necessary, sending patients into hypoglycemic shock or ketoacidosis.[3]

In his presentation, Jack was set to outline vulnerabilities in various medical devices, as well as give safe demonstrations of attacks with which there is "certainly a potential health risk".[3]

Death

Jack was found dead in a San Francisco apartment on 25 July 2013 by his girlfriend. According to the coroner's report,Jack died of an accidental overdose of heroin, cocaine, Benadryl and Xanax. He was 35.[13][14][15] At the time of his death, he was due to attend a Black Hat Briefings hacking conference in Las Vegas.[16][17] Black Hat general manager Trey Ford, said "Everyone would agree that the life and work of Barnaby Jack are legendary and irreplaceable", and announced his spot would not be replaced at the conference.[14]

In popular culture

Barnaby Jack's "Jackpotting" technique of an ATM and multiple ATMs being hacked and forced to spit out any amount of cash triggered by a number of events all described in Jack's 2010 Black Hat presentation, was used as the plot line in the 20th of December 2015 episode of series 2 of the CBS crime drama CSI: Cyber. Apart from showing the hack in use and explaining how it works, the episode also included other nods to Barnaby Jack and his work including naming the hacked bank "Barnaby Bank". The CSI spinoff focuses on a team of FBI agents and ex-blackhat hackers working to stop various cyber threats across the US.

References

  1. ↑ "Barnaby Jack". The Daily Telegraph. 28 July 2013. Retrieved 29 July 2013.
  2. ↑ McMillan, Robert (28 July 2010). "Barnaby Jack hits ATM jackpot at Black Hat". Computerworld. Retrieved 7 August 2013.
  3. 1 2 3 4 William, Alexander (July 2013). "Barnaby Jack Could Hack Your Pacemaker and Make Your Heart Explode". Vice. Retrieved 7 August 2013.
  4. 1 2 3 Zadrozny, Brandy (26 July 2013). "The Good Hacker: Barnaby Jack Dies". The Daily Beast. Retrieved 7 August 2013.
  5. ↑ "IOActive Appoints Industry Expert Barnaby Jack as Director of Embedded Device Security". IOActive. 8 October 2012. Retrieved 7 August 2013.
  6. ↑ "About IOActive". IOActive. Retrieved 7 August 2013.
  7. ↑ Goodin, Dan (28 July 2010). "Armed with exploits, ATM hacker hits the jackpot". The Register. Retrieved 7 August 2013.
  8. ↑ Franzen, Carl (29 July 2010). "Barnaby Jack Ingeniously Hacks ATMs at Black Hat [VIDEO]". Aol News. Retrieved 7 August 2013.
  9. ↑ Schwarz, Henry. "Black Hatted".
  10. ↑ Stilgherrian (21 October 2011). "Lethal medical device hack taken to next level". CSO Online (Australia). Retrieved 2 August 2013.
  11. ↑ Parmar, Arundhati (1 March 2012). "Hacker shows off vulnerabilities of wireless insulin pumps". MedCity News. Retrieved 7 August 2013.
  12. ↑ Jack, Barnaby (25 February 2013). ""Broken Hearts": How plausible was the Homeland pacemaker hack?". IOActive Labs Research. Retrieved 7 August 2013.
  13. ↑ Finkle, Jim (26 July 2013). "Famed hacker Barnaby Jack dies a week before hacking convention". Reuters. Retrieved 7 August 2013.
  14. 1 2 Holpuch, Amanda. "Hacker Barnaby Jack dies in San Francisco aged 35". The Guardian. Retrieved 7 August 2013.
  15. ↑ Robertson, Jordan (26 July 2013). "Barnaby Jack, Computer Hacker, Dead at 36". Bloomberg. Retrieved 7 August 2013.
  16. ↑ "NZ hacker found dead". Radio New Zealand. 27 July 2013. Retrieved 7 August 2013.
  17. ↑ Hillen, Brittany (26 July 2013). "Barnaby Jack, renown hacker, dies at 35". SlashGear. Retrieved 7 August 2013.
This article is issued from Wikipedia - version of the Sunday, April 10, 2016. The text is available under the Creative Commons Attribution/Share Alike but additional terms may apply for the media files.