I see these kind of stories floating around from time to time, I wonder how much money is lifted each year from banks this way. It seems to not be significant enough for banks to be proactive about the issue.
Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
71–80 of 82 posts
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#72Earlier quoted context omitted.
> Why we can find whole ATMs at junkyards is beyond me: there are many easy to spot flaws. If there are many easy to spot flaws, I don't think finding them in a junkyard is the root of the problem here. This is good old security by obscurity. As Bruce Schneier says (at least about safes), you should be able to publish the blueprints and source code for the machines, then maybe they'll be secure. There should be enoug…
It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.
I think you're misusing the word "obscure" here. Private keys are not obscure, they're private. You can steal them but you can hardly reverse-engineer them. Finding how a specific model of ATM works is an obscure piece of information but it's not private: people who sell,buy,repair, maintain,design this ATM have this piece of information. Giving enough will and effort one can reverse engineer this information from the ATM itself.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#73> They found that the machine’s only encryption was a weak XOR cipher they were able to easily break, and that there was no real authentication between the machine’s modules. This reminds me of many many years ago some guy in a bimmer forum figured out BMW's iDriver music file formats (BR3/BR4/BR5) were simply DRM'd via XOR.[1] I was able to verify it via a simple script. Kudos to the reverse engineering masters! [1]…
In the world of chip cards, it's not uncommon to think xor is a secure encryption scheme for some reason, historical maybe or more probably cost related, I don't know.
Though I remember even worse when a chip card encryption was found not cost effective enough to be enable and security on this card was limited encoding[1], too bad it was a government issued healthcare card which lead a minister to argue that using ASCII and binary was efficient in securing the data. While the GIE (Economic Interest Group) in charge of the chip tricked the whistleblower to demonstrate the vulnerability and sued him for having done so. Fun Times !
[1]: http://bigbrotherawards.eu.org/Jerome-Cretaux-et-Patrick-Gue...
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#74Earlier quoted context omitted.
Obtaining most keys doesn't require mind-bogglingly massive searches.
Well, it might not. Can you clue me in to the specific scenario you're thinking about? Input rate limiting + known key size should provide a concrete search space.
Physically obtaining them through malware, viruses, bugs, backdoors, social engineering, coercion(physical threats, blackmail, application of force), tapping, physical spying, etc.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#75Earlier quoted context omitted.
It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine, if that is indeed the case.
> It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine Well humans have to interact with the machine somehow. You can't exactly prevent physical access to the keypad, and from the nature of this attack, thieves could just hack out the pin pad to connect to the internal bus. It would be noticed much more quickly, but they'd still be away with the cash.
Well that's part of the point. The wire carrying that particular bus should be entirely inside the box.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#76Earlier quoted context omitted.
"I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism" I would use a hole saw ( https://en.wikipedia.org/wiki/Hole_saw ), and would think it fairly hard to protect a large enclosure against that. Locally strengthening the enclosure might be enough, but chances are thieves would start drilling around it to remove a larger patch or start employing…
I know what a hole saw is. The thing is you aren't going to be cutting through hardened steel with a normal hole saw, assuming the cash box is metal. They could probably have made the enclosure for the cash 8 inches taller and put the computer inside of that, and routed the cables for the modem, the pin pad and the screen through Making a hole in hardened steel is not easy. If you use a hole saw, it will either need…
"Plus, carbide and diamond tools are super expensive."
I don't know what those tools cost, but I do know that, in the Netherlands, "open my bike lock as a service" is a thing, and they will do that, using a battery-operated grinder, in 30 seconds or so, for €15 (http://www.fietssleutelkwijt.nl/bike-lock-cutting-service.ht...), including traveling to wherever your bike is.
=> Education welcome, but I doubt tooling will be prohibitively expensive for this task, which brings in thousands of dollars.
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#77Earlier quoted context omitted.
I think you may underestimate the capabilities of a portable drill. https://www.youtube.com/watch?v=Xyq7xBUhsAo Hell, depending on the gauge you could probably carve out a 3" hole with a dremel tool and a diamond bit in a reasonable amount of time.
there's no comparing brick with composite/hard plate steel
Sure there is. It's simple. If there are abrasives and cutting tools hard enough to drill rock, they will also carve through whatever steel alloy you care to bring to the party. Admittedly brick isn't the optimal choice for demonstrating my point but I can't find my favorite video of this guy drilling a sink drain out of a solid granite boulder so... Also, we are talking about ATM housings, not the internal cash box. You really think they're constructed out of unobtanium?
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#78Earlier quoted context omitted.
It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.
> It's a false dichotomy. What part of the parent are you responding to here? > Your private keys are just "obscure" information that requires some effort to find too. I think this is highly misleading. There is nothing "just" or "some" about it. Your private keys are "obscured" information that requires a (mostly) specific and quantifiably very large amount of effort to find, and which if it were to become exposed,…
How do you quantify the probability someone will gain unauthorized access to your office?
How do you quantify the probability they have a rootkit for your machine?
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#79Earlier quoted context omitted.
It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.
I agree. At a certain level, all security relies on obscurity.
[deleted]
Re: Hackers Are Emptying ATMs with a Single Drilled Hole and $15 Worth of Gear
#80Earlier quoted context omitted.
It's a false dichotomy. Your private keys are just "obscure" information that requires some effort to find too. And security protocols can be designed so the keys aren't enough. At the end of the day it's an arms race, and you're just trying to slow attackers down.
There is a fundamental difference between obscure and secret. Private keys are secret.
Don't you think there's a fundamental equivalence too?