Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

wired.com

Post reply on HN
Print view View original

41–50 of 82 posts

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#41

Post by eximius »

erikpukinskis wrote: post #28
andrewwharton wrote: post #27

Earlier quoted context omitted.

> Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws. If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity. As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enoug…

It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.

> There should be enough physical security to ensure an attack will take longer to perform than the response time of the authorities.

Replace 'physical' with 'cryptographic' and 'authority response time' with 'reasonable amount of time'. It's literally the same thing.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#42

Post by Natsu »

erikpukinskis wrote: post #28
andrewwharton wrote: post #27

Earlier quoted context omitted.

> Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws. If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity. As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enoug…

It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.

Your secrets need to be small, easily changed things (keys, passwords). Not large, difficult to change things like protocols.

That's the point behind rejecting 'security by obscurity', so I can't see any dichotomy between the two.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#43

Post by ams6110 »

mjevans wrote: post #6
kefka wrote: post #2

I'm not terribly shocked. Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN. And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those. If they wanted something that was secure,…

I could see a more effective solution being embedded chassis intrusion meshes. Disrupt the meshes in any way (EG drilling) would result in three actions. 1) Electronic erase MOST programmable memory in the machine. (Brick it) 2) Engage something akin to an EMO (Emergency Machine Off) 3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.

Easier than fitting a mesh would be an internal vibration sensor/microphone tuned to detect drilling/sawing.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#44

Post by ams6110 »

Declanomous wrote: post #38
Someone wrote: post #17

Earlier quoted context omitted.

"I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism" I would use a hole saw ( https://en.wikipedia.org/wiki/Hole_saw ), and would think it fairly hard to protect a large enclosure against that. Locally strengthening the enclosure might be enough, but chances are thieves would start drilling around it to remove a larger patch or start employing…

I know what a hole saw is. The thing is you aren't going to be cutting through hardened steel with a normal hole saw, assuming the cash box is metal. They could probably have made the enclosure for the cash 8 inches taller and put the computer inside of that, and routed the cables for the modem, the pin pad and the screen through Making a hole in hardened steel is not easy. If you use a hole saw, it will either need…

It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine, if that is indeed the case.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#45

Post by ams6110 »

jessriedel wrote: post #9
anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

Hard to tell what's actually inside them, but these sorts of ATMs don't look very intimidating: http://www.edmontonatm.com/images/rl1600.jpg

That type of ATM is normally found in a hotel lobby or convenience store. Not the sort of place where you could expect to drill into it unnoticed.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#46

Post by _80oq »

nodesocket wrote: post #34

How much cash is in a fully stocked ATM? 10k, 25k, 50k, 100K?

From a 2013 reddit AMA: "Each ATM is different. We do 12,500, but have ones with metal cases that reach 26k."

From a 2010 time article: "The average size machine can hold as much as $200,000, though few do. In off hours, most machines contain less than $10,000."

In the article they cite a Philadelphia theft case where a single stolen machine held $96,000.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#48

Post by ilikeATMs »

anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

Where the are drilling, next to the keypad is usually some kind of thin sheet metal or plastic or combination. The 'top' part of the ATM (which houses the PC running it, the cables and a bunch of other electronics) is usually extremely insecure (wafer locks you can pick, flimsy construction).

The hardened part of the ATM is only the safe (which, by design, actually has several large holes in it as well). You won't be casually drilling through the safe with a hole-saw or other portable equipment without spending a considerable amount of time.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#49

Post by ilikeATMs »

knieveltech wrote: post #10
anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

I think you may underestimate the capabilities of a portable drill. https://www.youtube.com/watch?v=Xyq7xBUhsAo Hell, depending on the gauge you could probably carve out a 3" hole with a dremel tool and a diamond bit in a reasonable amount of time.

Enthusiast safe tech here.

You cannot casually drill a safe. Not talking about your hardware store variety of safe, or a 'fireproof safe'. But a legit safe like you'd find in an ATM has a number of countermeasures to ensure that its not possible to drill the safe in a short amount of time.

Mixed into the steel is usually a number of drill-bit-breaking things like hardened ceramic/steel ball bearings, odd shaped chunks of metal, plastics which all react differently to different attacks in order to ensure that one attack does not compromise the door and that its near-impossible to do quickly. Bigger safes employ the use of fancy mixtures of concrete and metal to resist even more aggressive attacks like thermal lancing etc by turning the whole door/wall into a giant heat-sink.

Safes are really cool.

Post reply on HN