Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

wired.com

Post reply on HN
Print view View original

51–60 of 82 posts

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#51

Post by flukus »

wnevets wrote: post #13
Declanomous wrote: post #4

>Computer security experts have long warned that no computer should be considered secure if an attacker takes physical control of it. I think the lack of physical security is more surprising than the lack of electronic security. A three-inch hole is pretty big, all things considered. I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism. Why isn't…

>Why isn't the computer protected to similar degree? It was cheaper not to.

I'm guessing there may be some cooling issues to solve as well.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#52

Post by DonHopkins »

contingencies wrote: post #19

I am currently designing food machines, which have security concerns equal to financial machines in some senses (you don't want people to get poisoned through environmental contaminants, malicious reprogramming, etc.). The article claims there is essentially no authentication between disparate modules, only simple XOR encryption. That seems a clear fail. In my experience, ATM control boards (I was literally at a fact…

Where do you draw the line between poisoning people, and vending them unhealthy fatty sugary junk food?

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#53

Post by mjevans »

ams6110 wrote: post #43
mjevans wrote: post #6

Earlier quoted context omitted.

I could see a more effective solution being embedded chassis intrusion meshes. Disrupt the meshes in any way (EG drilling) would result in three actions. 1) Electronic erase MOST programmable memory in the machine. (Brick it) 2) Engage something akin to an EMO (Emergency Machine Off) 3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.

Easier than fitting a mesh would be an internal vibration sensor/microphone tuned to detect drilling/sawing.

That's way easier to trigger a false positive on... Not that my mesh idea doesn't need fine tuning as well.

The drilling idea I could see someone just walking by with a very loud powertools song... watch the ATM brick in the face of their first amendment freedom of expression.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#54

Post by DonHopkins »

jessriedel wrote: post #9
anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

Hard to tell what's actually inside them, but these sorts of ATMs don't look very intimidating: http://www.edmontonatm.com/images/rl1600.jpg

I guess you never watched Breaking Bad. Those things can kill you!

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#55

Post by nandemo »

nodesocket wrote: post #34

How much cash is in a fully stocked ATM? 10k, 25k, 50k, 100K?

As others replied, it varies.

In Japan, an ATM inside a bank might hold up to 40 million yen (≅ USD 350k) while an external one might have up to 30 million (≅ USD 270k).

Japan's a fairly safe country but there have been many cases of ATMs getting stolen too. Power shovel seems to be the method of choice.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#56

Post by PhantomGremlin »

ilikeATMs wrote: post #49
knieveltech wrote: post #10

Earlier quoted context omitted.

I think you may underestimate the capabilities of a portable drill. https://www.youtube.com/watch?v=Xyq7xBUhsAo Hell, depending on the gauge you could probably carve out a 3" hole with a dremel tool and a diamond bit in a reasonable amount of time.

Enthusiast safe tech here. You cannot casually drill a safe. Not talking about your hardware store variety of safe, or a 'fireproof safe'. But a legit safe like you'd find in an ATM has a number of countermeasures to ensure that its not possible to drill the safe in a short amount of time. Mixed into the steel is usually a number of drill-bit-breaking things like hardened ceramic/steel ball bearings, odd shaped chunk…

I can understand how it's possible to design quite strong small safes. But what about big bank safes? Are the same design techniques used?

If not, why bother going through the front door? Isn't that door mostly for show? Aren't the other five sides mostly concrete and rebar? Isn't that easier to go through? Or do big safes really have thick steel on all six sides?

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#57

Post by mod »

jessriedel wrote: post #9
anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

Hard to tell what's actually inside them, but these sorts of ATMs don't look very intimidating: http://www.edmontonatm.com/images/rl1600.jpg

I own one of these. It's inside a building that would be closed when no staff were around, and it doesn't ever contain enough money to be worth it to most people.

I wouldn't leave that thing at an outside location with enough money in it to hurt me, unless the robberies were insured or so seldom as to be considered a cost of doing business.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#58

Post by jlgaddis »

kefka wrote: post #14
lordvon wrote: post #7

Earlier quoted context omitted.

Where do you live?

Bloomington, IN.

Heh, after your second paragraph I thought, "that sounds like here", then got down to this comment and realized it is (also in Bloomington).

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#59

Post by giancarlostoro »

devy wrote: post #16

> They found that the machine’s only encryption was a weak XOR cipher they were able to easily break, and that there was no real authentication between the machine’s modules. This reminds me of many many years ago some guy in a bimmer forum figured out BMW's iDriver music file formats (BR3/BR4/BR5) were simply DRM'd via XOR.[1] I was able to verify it via a simple script. Kudos to the reverse engineering masters! [1]…

I found it curious that the very person who mentioned it being XOR had only one single post in that forum.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#60

Post by throwaway91111 »

Rapzid wrote: post #40
throwaway91111 wrote: post #35

Earlier quoted context omitted.

Well, they're provably secure for some (mind-bogingly massive) search space. Security by obscurity tends to refer to measures which can be broken once, and thereafter opened trivially. It sounds like the article is about one of these trivial openings. Everything can be broken; the goal is to move it or arrest them before they can get in, physically or virtually. It just so happens that, virtually, the time required t…

Obtaining most keys doesn't require mind-bogglingly massive searches.

Well, it might not. Can you clue me in to the specific scenario you're thinking about?

Input rate limiting + known key size should provide a concrete search space.

Post reply on HN