Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Jackpotting’ Attacks Hit U.S. ATMs

krebsonsecurity.com

Post reply on HN
Print view View original

111–120 of 174 posts

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#111

Post by _asummers »

ojosilva wrote: post #42

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few president…

If you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#112

Post by skc »

I worked for Diebold on their ATM's for a while.

I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons.

Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the device, so it could spit out whatever denominations you liked without talking to the banks mainframe.

We used to have fun printing out ATM receipts showing our fake balances of millions of dollars etc.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#113

Post by 0xcde4c3db »

toomanybeersies wrote: post #95
glaberficken wrote: post #41

>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack." I had no idea ATMs ran Windows!

If you really want a blast from the past, a lot of them (used to?) run OS/2.

OS/2 derivatives are still being developed and marketed [1] [2].

[1] http://www.ecomstation.com/

[2] https://www.arcanoae.com/arcaos/

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#114

Post by DrJokepu »

_asummers wrote: post #111
ojosilva wrote: post #42

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few president…

If you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.

FinCEN is part of the Department of the Treasury, not the Secret Service (which has been a part of the Department of Homeland Security since 2003).

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#115

Post by imglorp »

bardworx wrote: post #100
sitkack wrote: post #77

Earlier quoted context omitted.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

Your comment is coming from a good place but it’s rooted in ignorance. Most ATM machines are made by NCR and not financial institutions. Majority are also quite old (runnning windows XP old). NCR is focused on profits not security, even though they sell POS (point of sale), ATM machines, and airport kiosks. From my personal dealings with NCR, I can confirm that they care very little for security, regardless of what t…

On a less concrete note, my bank switched from Diebold to NCR and the difference is very apparent to the ATM user. The design is overall clean and bright, and it's much faster. The Diebold has long UI pauses for no apparent reason where the NCR seems not.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#116

Post by coding123 »

ojosilva wrote: post #42

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few president…

I totally hope this plot line is going in the next "Has Fallen" movie....

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#117

Post by dboreham »

vultour wrote: post #56
glaberficken wrote: post #41

>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack." I had no idea ATMs ran Windows!

You'd be surprised how many things are running Windows. I always wonder if the manufacturer just hires cheap contractors that haven't seen anything apart from Windows in their entire life, or if there is an actual reason it can't run on linux.

One reason would be that the vendors require support. Of course there are supported embedded versions of Linux that they could use..

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#118

Post by xg15 »

da_chicken wrote: post #104
xg15 wrote: post #83

Earlier quoted context omitted.

But only for "programs that cannot be reasonably demonstrated to have any use other than in a gaming device". Makes one imagine what kind of political trench wars probably went on behind the scenes about this regulation. Edit: On second thought, this seems awfully easy to circumvent. What stops me from making a rigged PRNG and then refusing to make the source code available on the grounds that there are lots of non-g…

The gaming commission also regulates how much each machine must pay out over a given period with a given take. Any machine not in compliance is removed, and the casino can be fined. Continued non-compliance can result in the termination of the casino gaming license. This was true even before electronic slot machines.

Sounds better but still defeatable. I could track individual players throughout the casino (which is already common practice, I think) and decide on payout depending on how much money I already made through them.

E.g., if someone already dumped a lot of money into other games, I can give them above-average odds of winning and be sure I still make a profit (and they make a loss), otherwise I'll give them below-average odds.

If I tune this right, the average outcome over all players will still look "fair".

Or I simply give the above-average play sessions to strawmen.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#119

Post by belorn »

Joeri wrote: post #78
belorn wrote: post #62

Earlier quoted context omitted.

The way that Sweden did it was in small steps, some which other nations has already done. Encourage companies to only pay employees through banks by making it practically impossible to pay through cash. Expand money laundering laws so that banks are liable if they give out or take in physical cash, with short and hard limits to ATM's. Make it acceptable to have police confiscate money if a person carry more than a fe…

And of course, the entire purpose of this is to get rid of tax evasion and undetectable criminal money flows.

Yes and no.

Banks want it because credit card transactions are significant (almost infinitive) more profitable than distributing physical money around and having bank offices open for customers. Especially in Sweden where the population/km2 can take a very sharp dive and the distance between banks and ATM's can be far.

Many large companies also wants it. Mass transit want that people get a subscription so that the only one buying tickets is tourists that then can pay tourism prices. Supermarkets want that people user the membership card that is linked to a credit card.

If the purpose was only to do crime prevention then the solution would look very different. Instead what we have is the mixing of multiple interests of strong parties against the interest of everyone else.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#120

Post by celticninja »

ojosilva wrote: post #42

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few president…

I found it interesting that this was not widely known. I am from the UK and was fully aware that this was their other role but it seems many in the US are unfamiliar with this information. I am pretty sure that I have just picked up that information from US film/TV which is why it is surprising to me.
Post reply on HN