A couple of 14 year olds in Winnipeg got into trouble at lunchtime on a school day. Why is this news? They did it by hacking a BoM branded ATM on Grant Avenue!
They did this with a service manual they found online for the ATM. They learned the method to put the device into “operator mode” from the manual and were surprised it worked. It did ask for a password at this point though. Luckily the first 6 character password the boys guessed WORKED! Gotta be 000000 doesn’t it? Maybe 123456. or maybe 001234.
The boys promptly reported the security weakness to a nearby Bank of Montreal branch. The branch manager dismissed them and told them to come back with proof. So they returned to the machine and:
- did some cash balance printouts
- changed the service fee charged to ATM users!
- changed the welcome banner to include a “GO AWAY” message.
Were they worried that they may have violated Criminal Code of Canada Section 342? Or maybe that they were constituting mischief in relation to property or data? Nope, they were more worried about returning to school late after lunch and got bank staff to write them a note explaining their tardiness. Wow, they must really fear their principal (or not have a clue what could happen to them in Canada’s “justice” system).
Turning yourself in wont always help you either – just ask the Canadian Revenue Agency or Stephen Arthuro Solis-Reyes, 19, of London, Ontario (one count of mischief in relation to data).
Some points to consider:
- Anyone over the age of 12 can be charged with Criminal Code of Canada violations.
- The crown prosecutor can argue that an offender over the age of 14 can receive an adult sentence. (although jail time will be served at a youth custody facility).