‘Jackpotting’ Attacks Hit U.S. ATMs • Hacker News Board

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#71

Post by mcny » Sun, Jan 28, 2018, 11:58 AM UTC

xg15 wrote: post #47

ilikeATMs wrote: post #14

If you ever open up an ATM you'll realise that the majority of things are controlled by serial interfaces (upto 6 of them) for all the motors and pneumatic hardware. If the operating system becomes hardened enough, you'll eventually have people interface with the serial ports directly to manipulate the cash-drawers directly. I'm not sure why this hasn't really been done in practice but it shouldn't be to difficult to…

Somehow I'm not surprised that hardening is a higher priority for slot machines than for ATMs...

I've read (though have no first hand experience) that slot machines have better security and better vetting than electronic voting machines do so I'm not surprised either.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#72

Post by kalleboo » Sun, Jan 28, 2018, 11:58 AM UTC

glaberficken wrote: post #41

>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack." I had no idea ATMs ran Windows!

I've seen an ATM stuck on the Windows XP boot screen, and one frozen with a Windows 9x "out of virtual memory" dialog box.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#73

Post by speleding » Sun, Jan 28, 2018, 12:03 PM UTC

gkgicccj wrote: post #70

Hendrikto wrote: post #68

> The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack. I would argue that Windows isn‘t at all the right OS for this.

What is? And do you have an OS that you are comfortable calling "secure"? Remember security through obscurity as enjoyed by Mac and Linux doesn't apply here because there is actual money and hence incentive to find vulnerability at stake.

It should be much easier to secure a small OS targeted at the job at hand rather than a general purpose OS that supports everything from mouse drivers to webcams which gives it a huge attack surface.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#74

Post by lwhi » Sun, Jan 28, 2018, 12:04 PM UTC

ZenoArrow wrote: post #40

p1mrx wrote: post #12

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA

That was possible in the 1990s: https://www.theregister.co.uk/2005/10/21/phantoms_and_rogues... I also remember seeing a report that was aired on UK TV by Channel 4 back in the 1990s that showed how easy ATM fraud was. I can't seem to find the clip, but if anyone has better luck than me I'd be interested to see it again. The only other clue I can think of was that I believe the report was presented by Krishnan Guru-M…

I remember the programme .. was on Janet Street Porters 'yoof' entertainment show Network 7, and involved puttjng VHS tape on the back of a debit card.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#75

Post by mseebach » Sun, Jan 28, 2018, 12:05 PM UTC

ZenoArrow wrote: post #51

amenghra wrote: post #15

Earlier quoted context omitted.

There have been several cases of stolen construction equipment (fork lifts, wheel loader, etc.) being used to steal ATMs. For example: https://www.youtube.com/watch?v=K05LT-WpN5I Achieving 100% physical security is going to be hard.

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the…

Moving the cash from even a free-standing ATM to the till seems unlikely to be a net improvement in security.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#76

Post by EvanAnderson » Sun, Jan 28, 2018, 12:07 PM UTC

mcny wrote: post #71

xg15 wrote: post #47

Earlier quoted context omitted.

Somehow I'm not surprised that hardening is a higher priority for slot machines than for ATMs...

I've read (though have no first hand experience) that slot machines have better security and better vetting than electronic voting machines do so I'm not surprised either.

In Nevada the source code for gaming devices is required to be provided to the state gaming commission.

(c) In the case of a gaming device, a copy of all executable software, including data and graphic information, and a copy of all source code for programs that cannot be reasonably demonstrated to have any use other than in a gaming device, submitted on electronically readable, unalterable media;

http://gaming.nv.gov/modules/showdocument.aspx?documentid=29...

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#77

Post by sitkack » Sun, Jan 28, 2018, 12:07 PM UTC

jutaz wrote: post #63

colejohnson66 wrote: post #46

Earlier quoted context omitted.

Don’t some ATMs spray ink on the bills if they detect tampering?

They do, if they detect tampering to the currency safe. However I'm not sure if they are really equipped to detect tampering to electronics.

There are easily multiple locks that could be put in place internally.

Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic.

Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits be session based, again signaled by main host process. Would require a full login/logout cycle for k bills.

Most likely, the systems are left wide open internally to ease development and mask bugs.

My ending blanket statement is that finance people know how to be cheap, they can optimize along one axis, replacing a 5$ with a 2$ part, but the really good ones optimize the whole system over a long time horizon.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#78

Post by Joeri » Sun, Jan 28, 2018, 12:13 PM UTC

belorn wrote: post #62

StudentStuff wrote: post #30

Earlier quoted context omitted.

Good luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.

The way that Sweden did it was in small steps, some which other nations has already done. Encourage companies to only pay employees through banks by making it practically impossible to pay through cash. Expand money laundering laws so that banks are liable if they give out or take in physical cash, with short and hard limits to ATM's. Make it acceptable to have police confiscate money if a person carry more than a fe…

And of course, the entire purpose of this is to get rid of tax evasion and undetectable criminal money flows.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#79

Post by JohnStrangeII » Sun, Jan 28, 2018, 12:16 PM UTC

gkgicccj wrote: post #70

Hendrikto wrote: post #68

> The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack. I would argue that Windows isn‘t at all the right OS for this.

What is? And do you have an OS that you are comfortable calling "secure"? Remember security through obscurity as enjoyed by Mac and Linux doesn't apply here because there is actual money and hence incentive to find vulnerability at stake.

VMS or Symbolics GENERA. Security by obscurity works.

Re: ‘Jackpotting’ Attacks Hit U.S. ATMs

#80

Post by isostatic » Sun, Jan 28, 2018, 12:17 PM UTC

mseebach wrote: post #75

ZenoArrow wrote: post #51

Earlier quoted context omitted.

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the…

Moving the cash from even a free-standing ATM to the till seems unlikely to be a net improvement in security.

The till probably has under £500 in, probably less. The ATM probably 20 times that.

By offering cash back you're reducing the amount of cash kept in store, reducing the chance of being robbed (less worthwhile). By putting an ATM in store you're increasing the cash on premises, and in your tills (as people use the ATM rather than cash back)

Cash back is a win-win for stores.