You don't have to be a seasoned hacker to break into an ATM, nor do you need to play with explosives or take other extreme measures. In some cases, thwarting an ATM's security is as easy as reading the flipping manual. That's what a pair of 9th grade students in Canada did. Matthew Hewlett and Caleb Turon, both 14 years old, 'hacked' an ATM by looking up the unit's user manual online.
The ATM in question belongs to the Bank of Montreal. Instructions provided in the online manual showed how to access that model's operator mode, which the teens did. They then took a shot at randomly guessing the ATM's six-digit password and got it right on the first guess.
"We thought it would be fun to try, but we were not expecting it to work," Hewlett told Winnipeg Sun. "When it did, it asked for a password."
The boys then went to one of BMO's branches and notified them how easy it was to infiltrate the ATM. The person they spoke with shrugged them off at first, saying they'd never be able to get anything out of it. Faced with the challenge, the boys went back to the machine, fired up the operating mode, and printed off documentation showing how much money was in the machine, information regarding withdrawals, and more. They also found a setting to change the surcharge amount, so they changed it to a penny. Finally, the boys changed the greeting from "Welcome to the BMO ATM" to "Go away. This ATM has been hacked."
After all this time, the boys were late for school. BMO wrote them a letter on official letterhead that read, "Please excuse Mr. Caleb Turon and Matthew Hewlett for being late during lunch hour due to assisting BMO with security."
What this all boils down to is having an incredibly weak password. One could also argue that ATM operator manuals shouldn't be so easy to access online.