‘Jackpotting’ Attacks Hit U.S. ATMs • Hacker News Board

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#151

Post by skc » Sun, Jan 28, 2018, 7:08 PM UTC

Someone1234 wrote: post #149

skc wrote: post #112

I worked for Diebold on their ATM's for a while. I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons. Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the de…

A full version of Windows or Windows Embedded ("Windows IoT")?

Full version of Windows.

And want to know something else? The UI layer was html + javascript and some funky css that ran on a custom modified version of ie6.

Beneath that, to handle fetching of data, comms, navigation, window management and other business logic etc, we used good old .Net and C#.

It was a bizarre setup from a dev perspective but once you got used to it you could crank out new features incredibly quickly as you had a heavily regimented workflow (Usability trumps _everything_ with these machines).

If you open up an ATM you will find your standard run of the mill beige PC inside it and in fact in many of the older machines they _literally_ stuff an _entire_ PC case in there simply laid on it's side.

There is also an extra monitor back there with a little keyboard attached.

The only impressive aspect of ATM's is the engineering that goes into all of the supporting hardware and peripherals such as the stackers, the cash acceptors, the cheque validators, the printers, the recycling cash canisters, the electronic pin pads, the various fraud detection features etc. I found that stuff much more interesting than the dev work I did day to day.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#152

Post by xg15 » Sun, Jan 28, 2018, 7:23 PM UTC

jacquesm wrote: post #136

xg15 wrote: post #118

Earlier quoted context omitted.

Sounds better but still defeatable. I could track individual players throughout the casino (which is already common practice, I think) and decide on payout depending on how much money I already made through them. E.g., if someone already dumped a lot of money into other games, I can give them above-average odds of winning and be sure I still make a profit (and they make a loss), otherwise I'll give them below-average…

Except that that is not allowed. It's individual machines tested in isolation that should perform exactly as legally mandated. The only kind of remote interaction there is is logging to make sure they can prove that the machine performed as advertised and to know when to empty the coin box.

But that's the point. If the provision lets me withhold part of the source code from inspection, there is no way to actually verify that I don't do that.

I could hide the above manipulations in some component I don't have to expose and have the machine play nice under testing conditions. (See certain automakers for examples)

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#153

Post by bardworx » Sun, Jan 28, 2018, 7:38 PM UTC

ak47-1984 wrote: post #125

bardworx wrote: post #100

Earlier quoted context omitted.

Your comment is coming from a good place but it’s rooted in ignorance. Most ATM machines are made by NCR and not financial institutions. Majority are also quite old (runnning windows XP old). NCR is focused on profits not security, even though they sell POS (point of sale), ATM machines, and airport kiosks. From my personal dealings with NCR, I can confirm that they care very little for security, regardless of what t…

As one of the engineers initially responsible for achieving PCI compliance on these ATMs, this isn’t strictly true - of course it needs to know your account info, but it’s sent to your bank - it’s not stored on the machine at all - certain digits of your card number are written to a paper log but it’s never written in full - can’t speak for POS machines, but would imagine it’s the same

Unfortunately, POS is not the same. I’ve worked with NCR (Aloha) POS for 5 years. Can’t speak for ATM machines.

Plain text ... and before two years ago, they also had regional master passwords. As in one password for all systems sold by a particular reseller.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#154

Post by matt_the_bass » Sun, Jan 28, 2018, 7:56 PM UTC

da_chicken wrote: post #105

matt_the_bass wrote: post #99

Earlier quoted context omitted.

What’s a PRNG?

Pseudo random number generator.

Oh. Thanks. That seems obvious to me now. :)

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#155

Post by DINKDINK » Sun, Jan 28, 2018, 8:25 PM UTC

_asummers wrote: post #111

ojosilva wrote: post #42

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few president…

If you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.

>per the PATRIOT Act

You're mistaken. That's the "Bank Secrecy Act" https://en.wikipedia.org/wiki/Bank_Secrecy_Act

FTL: "Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, and file reports of cash purchases of these negotiable instruments of more than $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities."

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#156

Post by mark-r » Sun, Jan 28, 2018, 10:32 PM UTC

cal5k wrote: post #144

ams6110 wrote: post #135

Earlier quoted context omitted.

I'm familiar with a few local restaurants that take cash only. All Chinese food places for whatever reason. If your car ever gets towed away on a private-property parking violation, good luck getting it back paying in anything but cash. My barber takes cash only. It's not as uncommon as you might think.

Are they stuffing that money into a mattress? Buying stuff with it? Or do they deposit it somewhere?

That's the whole point of cash, you'll never know.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#157

Post by ilikeATMs » Sun, Jan 28, 2018, 10:37 PM UTC

mcny wrote: post #71

xg15 wrote: post #47

Earlier quoted context omitted.

Somehow I'm not surprised that hardening is a higher priority for slot machines than for ATMs...

I've read (though have no first hand experience) that slot machines have better security and better vetting than electronic voting machines do so I'm not surprised either.

The actual slot machines themselves are unexpectedly secure. But the back-end environment is usually a total mess. The aim of the admins is to make sure no-one gets to the back-end environment and that's achieved through heavy use of CCTV and port-security on switches.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#158

Post by ilikeATMs » Sun, Jan 28, 2018, 10:41 PM UTC

xg15 wrote: post #83

EvanAnderson wrote: post #76

Earlier quoted context omitted.

In Nevada the source code for gaming devices is required to be provided to the state gaming commission. (c) In the case of a gaming device, a copy of all executable software, including data and graphic information, and a copy of all source code for programs that cannot be reasonably demonstrated to have any use other than in a gaming device, submitted on electronically readable, unalterable media; http://gaming.nv.go…

But only for "programs that cannot be reasonably demonstrated to have any use other than in a gaming device". Makes one imagine what kind of political trench wars probably went on behind the scenes about this regulation. Edit: On second thought, this seems awfully easy to circumvent. What stops me from making a rigged PRNG and then refusing to make the source code available on the grounds that there are lots of non-g…

You could make a rigged PRNG but the front-end software of the system (different applications) have to display extremely detailed statistics on every function and variable (payouts, money in, number of wins, probabilities etc) and that code will have to be open source. The only upside to interfering with the PRNG would be being able to predict the winning moves based on whats on-screen (assuming whats on-screen is derived from the PRNG).

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#159

Post by ilikeATMs » Sun, Jan 28, 2018, 11:03 PM UTC

lawl wrote: post #126

sitkack wrote: post #77

Earlier quoted context omitted.

There are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits b…

They should probably hire some people from microsoft's xbox department, or sony's playstation department. A lot of money has gone into locking this hardware down, and I think for the xbox 360, which was released in 2005(!) there is still only one hack they couldn't solve with a software update, and that's soldering to the CPU and glitching it on a specific compare instruction. I would bet , this "sophisticated malwar…

The problem with hardware lockdown is that at the end of the day x-boxes and PlayStations are only interacting with a screen to display media.

ATMs on the other hand are designed to interact with physical hardware that sucks money up and spits it out. Locking down the operating system is easy, but if the hardware is controlled by serial interfaces then you've got a weak point there unless the serial interfaces are encrypted (spoiler, they are not!). To encrypt them you'd need to put something at the OS side and something at the hardware (pneumatics/motors) side and ensure they aren't accessible (ie, located inside the safe part of the ATM). Its not impossible to do, but I somehow doubt they'll do it anyway.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#160

Post by lawl » Sun, Jan 28, 2018, 11:15 PM UTC

ilikeATMs wrote: post #159

lawl wrote: post #126

Earlier quoted context omitted.

They should probably hire some people from microsoft's xbox department, or sony's playstation department. A lot of money has gone into locking this hardware down, and I think for the xbox 360, which was released in 2005(!) there is still only one hack they couldn't solve with a software update, and that's soldering to the CPU and glitching it on a specific compare instruction. I would bet , this "sophisticated malwar…

The problem with hardware lockdown is that at the end of the day x-boxes and PlayStations are only interacting with a screen to display media. ATMs on the other hand are designed to interact with physical hardware that sucks money up and spits it out. Locking down the operating system is easy, but if the hardware is controlled by serial interfaces then you've got a weak point there unless the serial interfaces are en…

> Locking down the operating system is easy

No, it's not. Look at pretty much every console ever made except for the xbox 360/one.

> unless the serial interfaces are encrypted (spoiler, they are not!)

Yeah and that's obviously a problem. Nitpick though, the interface doesn't need to be encrypted, messages just need to be authenticated. Confidentiality of these messages isn't really important since you'll see the cash comming out, and you actually probably need some kind of challenge/response protocol to avoid replay attacks.

But you want them authenticated by a key that is very difficult to get out of the thing controlling the cash dispenser/serial/whatever. Which is why I said put a gaming console inthere, millions of dollars have already been spent, and are still being spent making sure nobody is getting secret keys out of them, even with full access to the hardware.

> To encrypt them you'd need to put something at the OS side and something at the hardware (pneumatics/motors) side and ensure they aren't accessible (ie, located inside the safe part of the ATM). Its not impossible to do, but I somehow doubt they'll do it anyway.

Well no, that's the point. You only need to make sure the pneumatics/motors only take authenticated commands, and that nobody can mess with those. For the OS side you piggy back off console security.