IOActive

In 2008, Dan Kaminsky, Director of Penetration Testing at IOActive, discovered a domain name system vulnerability that allowed attackers to send users to malicious sites and hijack email. This exploit would allow an attacker to impersonate any legitimate website, steal data, and download malware onto a victim’s system. As a result of this discovery, Kaminsky helped to create a resolution focused on making it harder for malicious users to perform this server hack. Therefore, while the hack itself was not eliminated, the instantaneous hack was completely eliminated[12][13].

In 2010, Barnaby Jack, Director of Security Research at IOActive, demonstrated his ability to remotely reprogram an ATM over a network to allow him to access cash in the machine. He was also able to access cash from a Triton ATM by using a key to open the machine’s front panel, as it was discovered that the ATM uses a uniform lock on all of its systems[14].

In 2017, Mike Davis, Director of Embedded Systems Security at IOActive, and Josh Hammond, a Senior Security Consultant at IOActive, demonstrated their ability to hack one of Diebold Nixdorf's popular Opteva ATMs into completely spewing out its entire stash of cash in seconds during IOActive’s “Breaking Embedded Devices” panel at Black Hat 2017. The security flaw near the ATM's speakers in the upper section provided an opening for potential hackers to loosen and expose a USB port[15].

In 2015, Charlie Miller, a researcher at Twitter and Chris Valasek, Director of Vehicle Security Research at IOActive, constructed a demo with Wired reporter Andy Greenberg in which Greenberg was instructed to drive a Jeep Cherokee on a highway as Valasek and Miller hacked the car from approximately 10 miles away. The two were able to control car functions such as air conditioning, radio, windshield wipers, and even the brakes or engine from a remote computer[16]. This discovery urged automakers to consider automotive security as a legitimate concern as the industry began a shift of turning cars into high-functioning computers and competing to install new Internet-connected cellular services for entertainment, navigation, and safety[17].

In 2014, Ruben Santamarta, Principal Security Consultant at IOActive, discovered major vulnerabilities in satellite communication (SATCOM) equipment that could be abused to hijack and disrupt communications links to airplanes, ships, military operations, and industrial facilities. These design flaws would allow attackers to run their own code, install malicious firmware, cut off communications, or even spoof messages to the vessel. Santamarta also found that certain weaknesses made it possible to locate cargo ships and military bases that were intended to remain hidden.[18] The discovery exposed vulnerabilities in the equipment from six major companies.[19]

Insecure protocol could compromise the entire terminal communications suite, in which an attacker could control devices by data spoofing or disrupting communications through the installation of malicious firmware. The Ship Security Alert System (SSAS), which is used to dispatch law or military enforcement during an act of terrorism or piracy, could also be remotely disabled in an attack.[20]