Interesting topic. if only it was as easy as Barnaby describes, wouldn't all the different banks use different hardware/software configurations? also consider CCTV recording, dye technology, etc.

In Australia, physical ATM attacks are preferred apparently

http://www.smh.com.au/national/move-to-thwart-atm-gas-bomb-a...

http://news.ninemsn.com.au/national/701017/explosions-at-two...

http://www.abc.net.au/news/stories/2009/08/13/2654709.htm

as I was searching for those old articles I also came across:

http://www.crimes-of-persuasion.com/Crimes/InPerson/atm_scam... - ATM Cash-point Scams using "Lebanese Loop" Plastic Sleeves / Skimming Devices (which I initially thought was a joke) and

http://www.schneier.com/blog/archives/2006/09/programming_at... - from Schneier which is a good read.

He didn't say it was easy. It took him about 8 months of work, and he actually had access to the machines in question.

And note, he is talking about stand-alone ATM machines (the kind you see here in the US in out of the way stores).

one more url i found interesting: http://www.bankers.asn.au/Default.aspx?ArticleID=610

"Even self-service banking is expensive to provide. An ATM costs cost on average $40,000 and it then has to be installed, maintained and stocked with cash."

a little OT I guess, meh :P

Whilst in Barcelona, I saw more than one ATM with a blue screen or an Windows NT logon screen. That freaked me out way more than this video.

Did not Mr. Jack expose himself to a possible threat of being kidnapped and forced by certain people to um... "commoditize" the technology?

Why bother with publicity if you can just develop it yourself?

The people that want this technology don't want it that badly. If you develop chemical weapons, you've got to start worrying.

Awesome. Can you just order an ATM up, and then start hacking on it?

Sure, usually people that sell things like vending machines will sell the types of ATMs you see at convenience stores. They aren't quite the same as the ones the banks use, but they still hold cash.

They appear to have them for sale on ebay...

Yeah pretty much.

I don't know about buying one from a vendor, but I bet if you knew the right ahem ring of people you could get a... used... one for whatever the blackmarket rate is

Is it legal? :)

I guess not :p

I don't know about the US in particular, but most countries have laws against intrusion into computer systems, referred as "automatized data processing" or the like. For example in France, you'd risk up to 3 years in prison and a 300,000€ fine for that kind of actions.

Don't mess with France. They gave Jérôme Kerviel a 4,900,000,000€ fine.

He did a bit more then emptying an ATM though, didnt he!