Barnaby Jack

Barnaby Michael Douglas Jack was a computer security researcher born on 22 November 1977 in Auckland, New Zealand. Over roughly a decade in the security industry he held research positions at firms including Foundstone, eEye Digital Security, Juniper Networks, and McAfee, building a reputation for hardware- and embedded-systems-focused vulnerability research before joining IOActive, where he served as Director of Embedded Device Security from around October 2012 until his death.

ATM Jackpotting

Jack became widely known in the security community after his presentation at Black Hat USA on 28 July 2010, where he demonstrated live on stage how two automated teller machines could be manipulated into dispensing cash on demand, a technique he dubbed 'jackpotting.' He showed that ATMs could be compromised either through physical access, using malware loaded from removable media, or remotely, by exploiting default administrative passwords and network vulnerabilities in the machines. He gave related demonstrations at other conferences in subsequent years, including a widely reported hack of a currency-dispensing machine in Abu Dhabi.

Medical Device Security Research

Jack subsequently shifted his research focus to implantable and wearable medical devices. In October 2011, at McAfee's FOCUS 11 conference, he demonstrated that certain wireless insulin pumps could be controlled by an attacker using a high-gain antenna without needing to know the target device's serial number; he extended this work in February 2012 at the RSA Conference, showing the attack could be carried out from roughly 90 meters away. In 2012, at the BreakPoint security conference in Melbourne, he presented research on wirelessly hacking pacemakers. His testimony and research on wireless medical device vulnerabilities were cited as a contributing factor when the U.S. Food and Drug Administration moved to tighten scrutiny of wireless medical device security around 2012.

Death

Jack was found dead at his home in San Francisco on 25 July 2013, at age 35, days before he was scheduled to deliver a Black Hat USA talk on hacking implantable medical devices, including pacemakers. His employer, IOActive, and his family confirmed his death, which drew immediate public and media speculation given the timing relative to his planned pacemaker research disclosure. The San Francisco Medical Examiner's Office, in findings made public around 3 January 2014, ruled the death accidental, attributing it to combined drug intoxication involving heroin, cocaine, diphenhydramine, and alprazolam. The autopsy reportedly found no evidence of trauma on the body.

Legacy

Jack is credited with helping bring embedded-device and medical-device security into mainstream security discourse, influencing subsequent research and regulatory attention on the safety of wireless-enabled ATMs and implantable medical devices. His ATM jackpotting demonstration remains one of the most cited live hacking demonstrations in the history of the Black Hat conference.

Timeline

• 1977-11-22Born in Auckland, New Zealand.
• 2010-07-28Demonstrated 'ATM jackpotting' live on stage at Black Hat USA, making two ATMs dispense cash.
• 2011-10Demonstrated wireless hacking of an insulin pump at McAfee's FOCUS 11 conference.
• 2012-02Repeated the wireless insulin pump hack from roughly 90 meters at the RSA Conference.
• 2012Presented research on hacking wireless pacemakers at the BreakPoint security conference in Melbourne.
• 2012-10Became Director of Embedded Device Security at IOActive.
• 2013-07-25Found dead at his home in San Francisco, days before a scheduled Black Hat talk on implantable medical device hacking.
• 2014-01-03San Francisco Medical Examiner's Office released findings ruling the death an accidental overdose.