Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

wired.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#21

Post by stevenwoo »

lordvon wrote: post #7
kefka wrote: post #5

Earlier quoted context omitted.

Maybe some of them are. Ive also found some that are crap. I have a tendency to pull on things like ATM covers, credit card slots, and the like. And that's because we have lots of skimmers that are found at local gas stations and places around here (big college presence). So far, I've found an opened gasoline pump door. I called attendant and went to a different pump (attendands didnt have keys for that....) . Ive al…

Where do you live?

Location surprisingly has less to do with the possiblity of it happening than one might think. There was a huge scam in Silicon Valley with card readers stuck inside of gas pumps so they were undetectable, that started five years ago. http://sanfrancisco.cbslocal.com/2014/02/21/six-arrested-for...

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#22

Post by monocasa »

mjevans wrote: post #6
kefka wrote: post #2

I'm not terribly shocked. Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN. And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those. If they wanted something that was secure,…

I could see a more effective solution being embedded chassis intrusion meshes. Disrupt the meshes in any way (EG drilling) would result in three actions. 1) Electronic erase MOST programmable memory in the machine. (Brick it) 2) Engage something akin to an EMO (Emergency Machine Off) 3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.

I mean, there's chips that have that in their top metal layers, and there's still crazy people out there with electron microscopes and tiny pins that subvert them.

https://web-beta.archive.org/web/20111124050620/http://www.f...

I wouldn't be surprised if increased physical security on ATMS isn't worth the practical difference in losses.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#23

Post by jessaustin »

hackcasual wrote: post #20
knieveltech wrote: post #10

Earlier quoted context omitted.

I think you may underestimate the capabilities of a portable drill. https://www.youtube.com/watch?v=Xyq7xBUhsAo Hell, depending on the gauge you could probably carve out a 3" hole with a dremel tool and a diamond bit in a reasonable amount of time.

there's no comparing brick with composite/hard plate steel

Drilling through the generic zinc pot metal that everything that can't be made of plastic seems to be made of nowadays could leave one with a wildly inaccurate idea of how difficult it is to drill in hardened steel.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#24

Post by fnordfnordfnord »

anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

It's not misleading at all. My portable power drills can injure you if you aren't careful. They are very powerful. Fiberglass is like butter to a hole saw. A carbide tipped hole saw can cut high grade steel, including stainless. It might not make many holes, but you only need it to make one.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#25

Post by mjevans »

monocasa wrote: post #22
mjevans wrote: post #6

Earlier quoted context omitted.

I could see a more effective solution being embedded chassis intrusion meshes. Disrupt the meshes in any way (EG drilling) would result in three actions. 1) Electronic erase MOST programmable memory in the machine. (Brick it) 2) Engage something akin to an EMO (Emergency Machine Off) 3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.

I mean, there's chips that have that in their top metal layers, and there's still crazy people out there with electron microscopes and tiny pins that subvert them. https://web-beta.archive.org/web/20111124050620/http://www.f... I wouldn't be surprised if increased physical security on ATMS isn't worth the practical difference in losses.

Sure, someone COULD do that, but how long and how fiddly is that process? How big of a risk is there to disrupting internal components.

What if you sandwich the sensitive layer as a thin mesh encased in weak resin between two metal plates?

The point of security isn't absolute, but to ruin the risk + effort vs reward balance.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#27

Post by andrewwharton »

scardine wrote: post #15

My first job was being a field technician for a bank automation supplier. We had a "test" card that could be insert on the eprom socket. This small card was almost the same size of the original chip but had a few buttons that allowed us to make the mechanism deliver notes in order to fine tune it. In a particular ATM design used by major banks in Brazil, this location were accessible by removing a front panel, althou…

> Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws.

If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity.

As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enough physical security to ensure an attack will take longer to perform than the response time of the authorities. Any components which are vulnerable to physical attack need the same level of physical protection as the cash that's being protected.

Until this happens, 'hackers' (thieves) are going to keep finding flaws and exploiting them.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#28

Post by erikpukinskis »

andrewwharton wrote: post #27
scardine wrote: post #15

My first job was being a field technician for a bank automation supplier. We had a "test" card that could be insert on the eprom socket. This small card was almost the same size of the original chip but had a few buttons that allowed us to make the mechanism deliver notes in order to fine tune it. In a particular ATM design used by major banks in Brazil, this location were accessible by removing a front panel, althou…

> Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws. If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity. As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enoug…

It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough.

At the end of the day it's an arms race, and you're just trying to slow attackers down.

Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear

#30

Post by timthelion »

fnordfnordfnord wrote: post #24
anthonybsd wrote: post #3

To be fair, drilling a 3 inch hole in a modern ATM is no easy task. We are talking about high-grade steel, a layer of fiberglass, etc. Hence "portable power drill" is a bit misleading.

It's not misleading at all. My portable power drills can injure you if you aren't careful. They are very powerful. Fiberglass is like butter to a hole saw. A carbide tipped hole saw can cut high grade steel, including stainless. It might not make many holes, but you only need it to make one.

But it cannot cut an old, dirty, high carbon cast pipe ;) an agle grinder with a universal cutting wheel can, but those are so loud that it would be better than an alarm, though personally, I'd just fill up the ATM with a little propane and let the sparks do the rest, as an anti-theft measure...
Post reply on HN