Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
1–10 of 82 posts
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#2I'm not terribly shocked.
Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN.
And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those.
If they wanted something that was secure, they could do that glass mesh thing the ORWL does, and have some sort of black dyepack on the money that explodes everywhere. Go for "we ruin so you cant have". But then again, I could see criminals pissed off and taking a hammer primarily to ruin their money, and cause customer consternation.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#3To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#4>Computer security experts have long warned that no computer should be considered secure if an attacker takes physical control of it.
I think the lack of physical security is more surprising than the lack of electronic security. A three-inch hole is pretty big, all things considered. I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism. Why isn't the computer protected to similar degree?
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#5To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
Maybe some of them are. Ive also found some that are crap.
I have a tendency to pull on things like ATM covers, credit card slots, and the like. And that's because we have lots of skimmers that are found at local gas stations and places around here (big college presence).
So far, I've found an opened gasoline pump door. I called attendant and went to a different pump (attendands didnt have keys for that....) .
Ive also found an ATM that was partially locked and came opened when I gave it a tug. I called our bank's security after that one.
I also found a skimmer on a gas pump as well. It had a fishy look to it and gave it a tug. Pop. Was just a simple card reader and cam module in 1. I harvested the parts and put the microsd card through a good format.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#6I'm not terribly shocked. Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN. And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those. If they wanted something that was secure,…
I could see a more effective solution being embedded chassis intrusion meshes.
Disrupt the meshes in any way (EG drilling) would result in three actions.
1) Electronic erase MOST programmable memory in the machine. (Brick it)
2) Engage something akin to an EMO (Emergency Machine Off)
3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#7To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
Maybe some of them are. Ive also found some that are crap. I have a tendency to pull on things like ATM covers, credit card slots, and the like. And that's because we have lots of skimmers that are found at local gas stations and places around here (big college presence). So far, I've found an opened gasoline pump door. I called attendant and went to a different pump (attendands didnt have keys for that....) . Ive al…
Where do you live?
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#8To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
Maybe some of them are. Ive also found some that are crap. I have a tendency to pull on things like ATM covers, credit card slots, and the like. And that's because we have lots of skimmers that are found at local gas stations and places around here (big college presence). So far, I've found an opened gasoline pump door. I called attendant and went to a different pump (attendands didnt have keys for that....) . Ive al…
This worries me, especially given some locations take your card and swipe it for you. I'm going to be checking these types of things more closely from now on... It is kind of sad, how difficult it is to educate the public on scams such as these.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#9To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
Hard to tell what's actually inside them, but these sorts of ATMs don't look very intimidating:
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#10To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.
I think you may underestimate the capabilities of a portable drill.
https://www.youtube.com/watch?v=Xyq7xBUhsAo
Hell, depending on the gauge you could probably carve out a 3" hole with a dremel tool and a diamond bit in a reasonable amount of time.