Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

‘Jackpotting’ Attacks Hit U.S. ATMs

krebsonsecurity.com

Post reply on HN
Print view View original

161–170 of 174 posts

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#161

Post by ethbro »

luma wrote: post #109
Hendrikto wrote: post #69

Earlier quoted context omitted.

OpenBSD would be perfect for the job, wouldn‘t it?

An OpenBSD machine still running unpatched from the XP era would be every bit as vulnerable.

I'd challenge that. Given that there are serious security architecture differences between Windows XP and OpenBSD systems.

For starters, Windows XP has always optimized for "plug random hardware in and it Just Works" while OpenBSD aims more at "what is the minimal number of services we can have running in the base image."

Sure, OpenSSL vulnerabilities found in the intervening time will still affect both, but we're still talking orders of magnitude difference in RCE vulnerabilities.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#162

Post by ethbro »

0xcde4c3db wrote: post #113
toomanybeersies wrote: post #95

Earlier quoted context omitted.

If you really want a blast from the past, a lot of them (used to?) run OS/2.

OS/2 derivatives are still being developed and marketed [1] [2]. [1] http://www.ecomstation.com/ [2] https://www.arcanoae.com/arcaos/

If you're targeting known hardware, and the OS provides all the functionality you need, there's no reason to overengineer things.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#163

Post by HeyLaughingBoy »

ZenoArrow wrote: post #51
amenghra wrote: post #15

Earlier quoted context omitted.

There have been several cases of stolen construction equipment (fork lifts, wheel loader, etc.) being used to steal ATMs. For example: https://www.youtube.com/watch?v=K05LT-WpN5I Achieving 100% physical security is going to be hard.

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the…

Not too many walls will stand up to being rammed by a Bobcat or other small skid loader, and those can be easily transported by a pickup truck and a trailer.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#164

Post by HeyLaughingBoy »

isostatic wrote: post #80
mseebach wrote: post #75

Earlier quoted context omitted.

Moving the cash from even a free-standing ATM to the till seems unlikely to be a net improvement in security.

The till probably has under £500 in, probably less. The ATM probably 20 times that. By offering cash back you're reducing the amount of cash kept in store, reducing the chance of being robbed (less worthwhile). By putting an ATM in store you're increasing the cash on premises, and in your tills (as people use the ATM rather than cash back) Cash back is a win-win for stores.

The store usually has nothing to lose. In most cases, the ATM in small stores isn't owned by the store: the ATM owner pays them a fee for having it there.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#165

Post by mrguyorama »

the_watcher wrote: post #139
celticninja wrote: post #120

Earlier quoted context omitted.

I found it interesting that this was not widely known. I am from the UK and was fully aware that this was their other role but it seems many in the US are unfamiliar with this information. I am pretty sure that I have just picked up that information from US film/TV which is why it is surprising to me.

Really? When reminded, I know that I learned this at some point, but US film/TV is definitely responsible for the perception that the Secret Service is entirely around to protect the President.

I knew that they existed at least partially to protect the currency, but I had thought their mission had expanded the other way. I thought their original goal was VIP protection and they somehow got roped into currency protection

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#166

Post by ZenoArrow »

HeyLaughingBoy wrote: post #163
ZenoArrow wrote: post #51

Earlier quoted context omitted.

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the…

Not too many walls will stand up to being rammed by a Bobcat or other small skid loader, and those can be easily transported by a pickup truck and a trailer.

The ATMs built into walls tend to be larger / heavier than the standalone ones. You gonna fit a crane / forklift truck on that pickup truck / trailer too?

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#167

Post by londons_explore »

_cerv wrote: post #108

One of the first unethical “hacker” things I did was to attempt to change the bill output to larger bill. I got so incredibly nervous when I went into the debug screen that I power walked out of the corner store when the clerk noticed I had been at the machine for several minutes and had not inserted a card. You find a lot of these ATMs that are even more insecure than the larger WinXP machines. Those little kiosks a…

Hah - the old "swap the tray configs around" trick...

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#168

Post by Massacr3 »

skc wrote: post #112

I worked for Diebold on their ATM's for a while. I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons. Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the de…

I read that the software for the diebold model being targeted is built by Kal. Is this true?

http://www.kal.com/en/video/multi-vendor

This article states that other manufacturers using Kal's software can be targeted as well with some alteration to the code. How possible could that be?

https://arstechnica.com/information-technology/2018/01/in-a-...

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#169

Post by perl4ever »

the-dude wrote: post #19
perl4ever wrote: post #17

Earlier quoted context omitted.

At least they aren't running OS/2 Warp.

Actually, OS/2 has been used for ATMs ( I've seen them in the EU, long time ago ).

That was the joke - I believe it is or was used in the US too.

Also Windows CE.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#170

Post by perl4ever »

xen2xen1 wrote: post #92
the-dude wrote: post #19

Earlier quoted context omitted.

Actually, OS/2 has been used for ATMs ( I've seen them in the EU, long time ago ).

Yup, you'd probably be surprised how much of that is still out there. At this point I'd rather have that than XP which has lots of well known exploits.

It appears that NCR and Diebold made the decision to migrate from OS/2 to Win XP a while ago.
Post reply on HN