Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Jackpotting’ Attacks Hit U.S. ATMs

krebsonsecurity.com

Post reply on HN
Print view View original

121–130 of 174 posts

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#121

Post by cal5k »

ad_hominem wrote: post #101
cal5k wrote: post #87

Earlier quoted context omitted.

I actually think this is fundamentally an attack on the right to transact anonymously. Trends towards the confiscation of large sums of cash, increasing restrictions on moving money relating to KYC/AML, and the further emphasis on digital forms of payment give governments and, more worryingly, banks the ability to exert incredible influence over the day-to-day lives of individuals. Here's a good Canadian example - ba…

> banks now refuse accounts to "high risk" businesses We have/had that in the US too: https://en.wikipedia.org/wiki/Operation_Choke_Point In this case the federal gov't (FDIC and DOJ) pressured the banks. They even attacked a Constitutionally-protected activity (firearms)

It's simply not possible to carry on business without a bank account.

For that reason I'd like to see legislation which makes it illegal to refuse customers on the basis of their business model, so long as it is legal.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#123

Post by heywire »

glaberficken wrote: post #41

>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack." I had no idea ATMs ran Windows!

The same with most point-of-sale machines. I worked for a point-of-sale vendor for a while that had both Windows and Linux versions of our software. All but one retailer chose the Windows version because they felt it was much easier to manage 10,000 Windows machines than 10,000 Linux machines.

BTW, that one retailer that used the Linux version? They replaced it with the Windows version on their next hardware refresh.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#124

Post by namibj »

colejohnson66 wrote: post #49
polishninja wrote: post #5

Earlier quoted context omitted.

It doesn't help that almost all the fascia locks on each vendor's machines are a standard key. With that standard key, you have full access to the computer or embedded device drive. Nowadays the communication link to the dispenser is encrypted, making swapping the hard drive useless. The real problem is the machines aren't replaced very often so there are quite a few old models out in the field that are susceptible t…

> It doesn't help that almost all the fascia locks on each vendor's machines are a standard key. Interesting. Is there a source for this?

There is a defcon talk about jackpotting ATMs.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#125

Post by ak47-1984 »

bardworx wrote: post #100
sitkack wrote: post #77

Earlier quoted context omitted.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

Your comment is coming from a good place but it’s rooted in ignorance. Most ATM machines are made by NCR and not financial institutions. Majority are also quite old (runnning windows XP old). NCR is focused on profits not security, even though they sell POS (point of sale), ATM machines, and airport kiosks. From my personal dealings with NCR, I can confirm that they care very little for security, regardless of what t…

As one of the engineers initially responsible for achieving PCI compliance on these ATMs, this isn’t strictly true - of course it needs to know your account info, but it’s sent to your bank - it’s not stored on the machine at all - certain digits of your card number are written to a paper log but it’s never written in full - can’t speak for POS machines, but would imagine it’s the same

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#126

Post by lawl »

sitkack wrote: post #77
jutaz wrote: post #63

Earlier quoted context omitted.

They do, if they detect tampering to the currency safe. However I'm not sure if they are really equipped to detect tampering to electronics.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

They should probably hire some people from microsoft's xbox department, or sony's playstation department.

A lot of money has gone into locking this hardware down, and I think for the xbox 360, which was released in 2005(!) there is still only one hack they couldn't solve with a software update, and that's soldering to the CPU and glitching it on a specific compare instruction.

I would bet, this "sophisticated malware" is a lot more trivial than glitching the CPU on one specific intruction and having to take a soldering iron to the ATM, then fiddling trying to get the timing exactly right.

Building a chain of trust and authenticate commands to the cash dispenser really shouldn't be an issue.

Really, just put a fucking xbox in these ATMs. Lots of people attacking those while being able to do whatever they want to the hardware with limited to no success. (I don't think anyone has managed to open up the xbox one?)

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#127

Post by ad_hominem »

cal5k wrote: post #121
ad_hominem wrote: post #101

Earlier quoted context omitted.

> banks now refuse accounts to "high risk" businesses We have/had that in the US too: https://en.wikipedia.org/wiki/Operation_Choke_Point In this case the federal gov't (FDIC and DOJ) pressured the banks. They even attacked a Constitutionally-protected activity (firearms)

It's simply not possible to carry on business without a bank account. For that reason I'd like to see legislation which makes it illegal to refuse customers on the basis of their business model, so long as it is legal.

Yeah I'd also like to see that, especially with the number of banks continually shrinking (e.g. less than half as many exist as did in 1980), giving consumers fewer and fewer options to shop around.

Then the other half of my brain is like "you're expecting the gov't that gave you Operation Chokepoint to do a 180 and suddenly be benevolent?" and "the reason banking is congealing into an oligopoly in the first place is because of the staggering amount of banking regulations churned out by the gov't every year, significantly raising barriers to entry" ¯\_(ツ)_/¯

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#128

Post by cal5k »

ad_hominem wrote: post #127
cal5k wrote: post #121

Earlier quoted context omitted.

It's simply not possible to carry on business without a bank account. For that reason I'd like to see legislation which makes it illegal to refuse customers on the basis of their business model, so long as it is legal.

Yeah I'd also like to see that, especially with the number of banks continually shrinking (e.g. less than half as many exist as did in 1980), giving consumers fewer and fewer options to shop around. Then the other half of my brain is like "you're expecting the gov't that gave you Operation Chokepoint to do a 180 and suddenly be benevolent?" and "the reason banking is congealing into an oligopoly in the first place is…

Yeah, I hear you. At least it's more robust there than it is in Canada... our Schedule I banks (there are 5 major ones) are protected by law from foreign competition. I don't see a move towards the type of deregulation that might lead to real competition, so the only plausible solution I see is more legislation. Hah. It makes my inner libertarian cry.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#129

Post by prklmn »

bardworx wrote: post #100
sitkack wrote: post #77

Earlier quoted context omitted.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

Your comment is coming from a good place but it’s rooted in ignorance. Most ATM machines are made by NCR and not financial institutions. Majority are also quite old (runnning windows XP old). NCR is focused on profits not security, even though they sell POS (point of sale), ATM machines, and airport kiosks. From my personal dealings with NCR, I can confirm that they care very little for security, regardless of what t…

Their losses are just write offs...until they aren't, and something major happens. Maybe it will take a company completely going out of business due to poor security standards for others to wake up.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#130

Post by kabdib »

lawl wrote: post #126
sitkack wrote: post #77

Earlier quoted context omitted.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

They should probably hire some people from microsoft's xbox department, or sony's playstation department. A lot of money has gone into locking this hardware down, and I think for the xbox 360, which was released in 2005(!) there is still only one hack they couldn't solve with a software update, and that's soldering to the CPU and glitching it on a specific compare instruction. I would bet , this "sophisticated malwar…

Microsoft and Apple have put a lot of thought into the security architectures of their consumer hardware. I've made this exact argument before -- just put the ATM app into a console title. It's the most secure hunk of readily available computing hardware, right off the shelf at Target.

But breaches happen, and lead to lawsuits, and I can just imagine trying to impress a jury about the security of your ATM while the other side cracks jokes about gold coins in Super Mario and speculates about your low Halo ranking.

Post reply on HN