Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!


Forgot your password?
Crime The Almighty Buck United Kingdom Technology

USB Sticks Used In Robbery of ATMs 252

First time accepted submitter JeffOwl writes "BBC is reporting that thieves are infecting ATMs with malware using USB sticks. The malware creates a backdoor that can be accessed at the front panel. The thieves are damaging the ATM to access a USB port then patching it back up to avoid notice. This indicates that the crew is highly familiar with the ATMs in question. Once the ATM is infected, the thieves use a 12 digit code to bring up the alternate interface. The thieves, not wanting their crew to go rogue, have built a challenge-response access control into their software and must call another member who can generate the response for them."
This discussion has been archived. No new comments can be posted.

USB Sticks Used In Robbery of ATMs

Comments Filter:
  • by fisted ( 2295862 ) on Monday December 30, 2013 @02:23PM (#45820187)
    That's what you get from running Windows on ATMs, lol.
    • by Anonymous Coward on Monday December 30, 2013 @02:28PM (#45820225)

      Mod parent up! Linux machines are impenetrable, even if an expert has physical access. This is why Torvalds gets so aggressive: he keeps locking himself out of his testing machines and has to buy new ones.

      • by fisted ( 2295862 ) on Monday December 30, 2013 @02:30PM (#45820265)
        I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun.
        Furthermore, you presumably wouldn't get administrative access.
        • by DaHat ( 247651 )

          Yes, because it's impossible to configure Linux to auto-mount all new devices, check for the presence of a specifically named file and execute commands within.

          • by fisted ( 2295862 )
            Sure, but then, you wouldn't do that on an ATM. Much like you apparently wouldn't bother to disable autoplay for Windows based ATMs...
        • Same autorun that is now disabled by default and was always trivially disabled?

          • by robmv ( 855035 )

            It is probably a fake keyboard and mouse device, many of those ATMs run their applications with administrator privileges, so anything can be run with that kind of device

            • You know how I know you didn't read the article?

              Hint: It runs a file called "hack.bat"

              • by robmv ( 855035 )

                so? an executable name tells you it was an autorun? it could have been a USB subsystem buffer overflow or any other vulnerability, or a USB HID device that injected Win_Key+R and typed d:\hack.bat. Many options

        • by cusco ( 717999 ) <brian...bixby@@@gmail...com> on Monday December 30, 2013 @02:53PM (#45820503)

          I'd be very surprised if the "alternative interface" isn't installed by rebooting the machine off the USB stick. The Diebold voting machines were configured to preferably boot off a USB, and Diebold is still the largest manufacturer of ATMs in the US.

          • by TWX ( 665546 ) on Monday December 30, 2013 @03:06PM (#45820677)
            You mean, the trick I use on the computers I support, by password-protecting the BIOSes and restricting boot to the fixed disk only, a trick that I've used for about twenty years, was ignored on commercial-grade equipment that's responsible for the basic security of our form of government and of our financial system?

            Say it ain't so...
            • by cusco ( 717999 ) <brian...bixby@@@gmail...com> on Monday December 30, 2013 @03:20PM (#45820875)

              You should read up on what a security nightmare the voting machines are, it's appalling. Doesn't help that there are a dozen or more manufacturers, all of them being sold on the basis of friendly back slaps with local politicians rather than actual analysis of the hardware and software (which is always closed source). Testing procedures are a joke, by design, and even systems that fail testing get sold on the promise of an update in future firmware versions. Don't overlook punch card counters either, they put out by far the largest deviations from exit polls of any of the machines.

              • by TWX ( 665546 )
                I have read on them, actually. I figured the "Say it ain't so" would have conveyed the sarcasm of the previous paragraph.

                I like optical scan, where the voter draws a line between arrowheads next to the name of the candidate or their position on the question. I like it because it can be machine-counted for speed, and can be human-counted when there's a dispute or an automatic-recount based on the closeness of an election. It is, by default, its own paper trail.
                • by cusco ( 717999 )

                  Of course when you can't access the actual ballots except with a court order, and you can't get a court order without some proof that wrongdoing has occurred, the paper trail is kind of moot.

        • by Nkwe ( 604125 ) on Monday December 30, 2013 @02:54PM (#45820515)

          I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun. Furthermore, you presumably wouldn't get administrative access.

          It doesn't require autorun. A usb device that emulates a keyboard or other input device would do the trick. Send the keystrokes necessary to break in. Think Linux is immune? How about the keystrokes necessary to reboot the machine and start up in single user mode? Even if single user mode has been protected, the usb device could provide both keyboard emulation and cdrom emulation -- during reboot the hack could boot to alternate media. The real fail is a design that allows access to the hardware (physical access is full access) and not the choice of operating system.

          • by Penguinisto ( 415985 ) on Monday December 30, 2013 @03:28PM (#45820947) Journal

            Err, not really. If we're building a *nix ATM, then you can fix it in one go: If the USB port requires elevated privs just to mount/use anything plugged into it (say, a long numbered sequence entered from the ATM keypad, unique to that machine, that would translate to a variation of "sudo /bin/mount"), the whole USB stick trick falls flat.

            Not sure if there would even be a feasible analog for that in embedded XP/CE/WE

            • by cusco ( 717999 )

              Running *nix on ATMs would go against the banks' standard practice of 'low bid always gets the job.' Keep in mind that these are the same organizations who allowed access to any account configured for online banking simply by changing the account number in the address bar of the browser (and then left it that way for years). Had an instructor who did pen tests for financial institutions, the stories he told were depressing.

        • by AK Marc ( 707885 )
          So it's impossible to set up a Linux system to mount a USB stick and run a specific file, if present? Sounds like a lame OS.

          Based on the limited information, it looks like it was setup as a recovery/maintenance feature that required physical security, and physical security was compromised. Sure, for "security" you could program all ATMs to self destruct on any OS halt, but I'm not sure that would be in the best financial interests of the owning company.
        • I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick.

          My Acer netbook reflashes the BIOS if it is turned on with a USB stick containing a file of a certain name in place. If you control the BIOS, you control the computer.

          This feature truly is a good thing, since turning the netbook off improperly while running some linux versions bricks it.

    • by Spy Handler ( 822350 ) on Monday December 30, 2013 @02:32PM (#45820291) Homepage Journal

      no, this is what you get when you put a USB port on a frigging ATM. Whose bright idea was that anyways?

      • by wvmarle ( 1070040 ) on Monday December 30, 2013 @02:39PM (#45820357)

        Making it easy to install upgrades? Or to connect say, a proper keyboard, to do maintenance?

        USB stick is better than over network as physical access is needed. And in this case, they indeed had to physically break the ATM to gain access to this USB port.

        • Color me puzzled, but if you already have already physically broken into the ATM to gain access to the USB port, why not just grab the cash instead?
          • by BosstonesOwn ( 794949 ) on Monday December 30, 2013 @02:55PM (#45820529)

            Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.

            • by jeffmeden ( 135043 ) on Monday December 30, 2013 @03:05PM (#45820665) Homepage Journal

              Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.

              All of the flames about windows vs linux are a red herring. This is the real design flaw. Any design that assumes the USB interface to the software is not just as important to protect as the cash itself completely ignores why they would ever put the USB port on there in the first place (to make material changes to the ATM software).

            • Which really begs the question which idiot designed the machine with a USB port for updates and NOT protecting it properly!

          • That'd mean a lot more destruction to the ATM, and as a result instant detection of the crime. Instead of days or weeks later when the number of notes in the machine was compared with the ledger (no idea how frequently that's done).

          • Color me puzzled, but if you already have already physically broken into the ATM to gain access to the USB port, why not just grab the cash instead?

            Because that would be easily detected and would be a one-shot win. By grabbing account data from every person who uses the machine you can clean out accounts -- which would be a lot more than the cash in the machine.

      • Well the touch screen, printer and maybe even the link to the cash system may be USB.

        Even new SLOT MACHINES use USB and the Incredible Technologies games are ALL USB and load code from USB drives.

      • by asmkm22 ( 1902712 ) on Monday December 30, 2013 @02:45PM (#45820405)

        The USB port is pretty well hidden and secure, which is why the article points out the fact that the thieves appear to be familiar with the machines enough to know where and how to best break that part open. Even the best of security measures won't hold up against an inside job.

        • Also, since some of the peripherals are USB, you might be able to hijack a connection there.

          Crack open the keypad area, cut the wires and connect them to your device (also defeats anything that tries to use a non-standard connector). Twist the wires back together when you are done (it isn't like you are trying to reconstruct the wires from a parallel port...usb is easy). If the keypad is still needed, then you hijack the receipt printer or you add a USB hub to your device and hook the keypad up to that.

        • Pro-tip- most ATMs (I work for a financial, so have seen a few) have only a single locked front panel that is opened up to gain access to the internals (with only the cash in a more secure safe box inside that). ATMs in busy areas will be serviced pretty much every day. If you want a good look at where the various internals are (including any USB ports), all you'd need to do is hang around the ATM until someone comes to service it- everything you need to see will be right there on display. Take a snap with

      • by ericloewe ( 2129490 ) on Monday December 30, 2013 @02:53PM (#45820497)

        ATMs generally run on commodity hardware and a commodity OS (most I've seen are Windows NT 4.0 and newer).

        • No directly related but that reminds me of the time i saw an EJB error displayed on a credit card terminal :-)

    • by dugancent ( 2616577 ) on Monday December 30, 2013 @02:33PM (#45820299)

      My bank still uses os/2 on their ATMs.

      • by mlts ( 1038732 )

        eCS/2 (eComStation, the company that is maintaining OS/2) still is used in some ATMs. If the OS works, is well maintained, and has earned its bones, why change? ATMs have not changed much in 10-20 years, other than maybe display a news blurb or the daily weather on the demo screens. Might as well keep with what works.

    • by lgw ( 121541 ) on Monday December 30, 2013 @02:48PM (#45820443) Journal

      That's what you get from running Windows on ATMs, lol.

      No, it really isn't. I've seen this demo'd at a security conference, and the OS has nothing at all to do with the attack. ATMs have a USB port which can be used to replace the firmware. The port is behind a simple lock, not in the vault with the money.

      This attack replaces the OS on the ATM with the image the attacker provides. What the OS was before the attack really isn't all that relevant. The fact that images aren't signed or anything is.

      • by mlts ( 1038732 )

        The ironic thing is that even the cheapest, no-name Android phone has better protection than ATMs against this avenue of attack, assuming a bootloader with a signing process.

      • by jandrese ( 485 )
        I would like to say that I'm shocked that they don't use Trusted Computing principles to build ATMs, but I'm not. This stuff is built by the lowest bidder and designed to be installed and maintained by low end wage slaves.

        This isn't necessarily an inside job either. These guys could have stolen an ATM whole at any point and taken as long as they needed to reverse engineer the thing, dumping the old firmware directly from its internal storage and everything. A quick patch to the dumped firmware and the
        • by sconeu ( 64226 )

          One of the few situations where Treacherous Computing actually makes sense.

          An ATM should only boot a properly signed OS, and only run signed executables. In this situation, the computer is more of an embedded system, and should not be treated as a general purpose computer.

      • Why is the USB "auto-running", rather than waiting for the user to log in with secure verification (maybe a hard-token) and prompting the USB to load? Why is the OS willing to run a firmware update which isn't signed with some sort of trusted protocol?

        You're right that it isn't the OS's fault per se, but it is the fault of the software/OS as it was set up. There should be no reason why Windows can't be set up sensibly to prevent these issues, and there's definitely no reason why Linux couldn't be. Someone w

    • by Skiron ( 735617 )
      Yes, and I have seen many a BSOD on a few in my time - and once one that had dropped to the desktop with a message (and mouse cursor) 'Reboot Now? [Ok] [Cancel]'. Bloody joke whoever put MS stuff on them.
    • by durrr ( 1316311 ) on Monday December 30, 2013 @03:19PM (#45820855)

      I guess this was a...

  • Video cameras to prevent drilling of the outer shell was never considered?

    • Re: (Score:2, Insightful)

      by Anonymous Coward
      How exactly would a video camera prevent a masked marauder from drilling?
      • How exactly would a video camera prevent a masked marauder from drilling?

        I dunno, another panel opens and a white gloved hand on one of those scissors-like extensions comes out and slaps the thief silly? I'm pretty sure I saw that on a Bugs Bunny cartoon. Or maybe it was one of the Star Wars prequels, I forget.

    • There is no need to drill the outer shell, apparently it is not difficult to buy keys for ATM machines online, dress as a repair man and no one thinks twice. Failure by some institutions to utilize maintenance logs and scheduling for ATM repairs.

      • My bad, I posted before I read the article. I was thinking that they used keys.

      • by Richard_at_work ( 517087 ) <richardprice@gm a i l . com> on Monday December 30, 2013 @02:32PM (#45820289)

        In the UK you cannot access the internals of the ATM unit without either accessing the rear of the machine, which is locked away in the safe that they mention, or by cutting into the fascia of the external face, which is what they did here.

        You cannot gain access to the ATM simply by using a key bought off of the internet.

        And yes, most ATMs in the UK have a video camera on them to help identify fraudsters, but that does NOT help prevent the fraud from occurring because someone would have to watch it in real time and intervene. Infact they identified just how this hack was occurring by watching the CCTV footage to see just how the money was going missing, because it wasn't triggering any other alarms.

        • by lgw ( 121541 )

          In most countries it depends on the ATM - there are many different kinds of ATMs installed in many different ways. Is there really some standard in the UK? Are there not cheap ATMs in convenience stores that are very different from the big ATMs next to banks?

          Pretty much all ATMs these days have a camera, sure, but it typically records images on storage in the ATM. After the attack, it's going to have whatever comical pictures the attackers want it to have.

          • by jandrese ( 485 )
            Even if the CCTV images aren't tampered, all you are going to know is that a guy in a mask broke into the machine a week ago. At best you can limit the number of people you have to issue new cards to. Ok, you can stop laughing. I know the company is just going to offer a few months of "credit monitoring" and not reissue the compromised cards or even tell the people affected. But it could happen. Someday. Maybe.
            • by lgw ( 121541 )

              The scary thought is that all these ATMs are just as vulnerable to remote attacks. I don't know any details about that side, other than they're mostly on dial-up so you can just call them and hack them, but apparently they are very vulnerable (I would guess there's a default password that's rarely changed, or something equally inane). If the attacker wants magstripes and PINs instead of the cash in the machines, there's no reason to ever be near one.

    • Well, there is nothing to indicate anything is wrong. The ATM machines still look like they are functioning normally from the operations center and the tapes are (normally) only reviewed if they suspect something has gone wrong. It’s not like they have a bank of rent a cops monitoring these things 24/7.

    • by Crudely_Indecent ( 739699 ) on Monday December 30, 2013 @02:32PM (#45820279) Journal

      When has a video camera ever stopped someone from doing exactly what they intend to do? Youtube is full of examples of people behaving badly in front of a video camera (sometimes - because of the video camera)

      Sure, video cameras may cause people to reconsider their behavior - but a criminal intent on committing a crime will just wear a mask or disable the camera with some high-tech sticky tape. If the group is repairing the machines so their modification can't be detected - nobody would be the wiser. They might consider the tape to be the work of a prankster and peel it off.

      Maybe if the video camera was attached to a flame-thrower - that might do the trick.

    • Video cameras to prevent drilling of the outer shell was never considered?

      Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it. Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and mad

      • Video cameras to prevent drilling of the outer shell was never considered?

        Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it.

        To add to the complexity, there are plenty of ATMs (more than enough for a gang to live off of) that are nowhere near a bank. Since the plan was well thought out (the software they hacked in was particularly brilliant to have two-factor auth) they probably also cased ATMs that had a minimum of video surveillance and "hit" them when there were few people around.

        Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and made your getaway.

        What is apparently necessary is a software tool to match up physical presence with a lack of ATM transaction activity, since these guys no doubt lef

    • Security cameras are only to record what happens, for later viewing. They don't help prevent crime, they only help solving it (they might prevent some because of the higher risk of getting caught).

      These thieves did their best to not have their work detected. They drilled the hole, installed the software, then patched up the hole. Later they came back to get the money out of the machine - basically by nicely asking the machine to give it to them. And that again was detected only much later when the notes in

  • by bleh-of-the-huns ( 17740 ) on Monday December 30, 2013 @02:26PM (#45820215)

    Google the subject, he performed this attack live at both Blackhat and Defcon 18. It was definately an eye opener, and one of the reasons I tend to avoid those rental ATM's you see in mom and pop stores, and restaurants/bars...

    yes I realize that even the major Bank ATM's are susceptible, but at least with a major bank you have some recourse if you have issues.

    • by mlts ( 1038732 )

      I've wondered why ATMs are not designed with some defense in depth. Yes, the cash pile and outer case tend to be well armored, but I wonder about having the core computer be in a tamper resistant case, similar to a HSM, with software for copying signed updates [2]. There wouldn't be a USB port, but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that) and a restricted interface for updates might help things. If the case holding the core CPU

      • by AK Marc ( 707885 )

        , but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that)

        Are you sure about that? http://nz.transcend-info.com/products/CatList.asp?FldNo=24&Func2No=203 [transcend-info.com]

        That one runs a disconnected Wi-Fi to share the photos using the power supplied, but no connection back to the host, but I've also used networking cards in PCMCIA slots. You do know what the MC stands for in that, right? memory cards have been used for more than just flash memory, since as soon as they were invented.

        • by mlts ( 1038732 )

          One can use storage with a parallel port. However, the host must have specific drivers for it ready to go. So, plugging in a Wi-Fi card into a SD slot will physically work, but it is an unlikely attack avenue, just because the machine isn't likely to load drivers for it, configure an IP stack, fire up DHCP and turn that adapter on.

          USB is a different animal. Plug in a device, and most USB stacks already have HID drivers, mass storage drivers, printer drivers, and other items ready to go. Unless it was ex

          • by AK Marc ( 707885 )
            Yes, you are much more likely to have a non-storage activity enabled on USB, but this attack only needed storage that's mounted and run, and SD can do that just fine, so SD wouldn't protect from anything. And I'm just pointing out that SD doesn't prevent network connection or other types of expansion cards. Nearly all I/O connections have been turned into a network port. Maybe not all Ethernet-based TCP/IP, but most. I've used CF and PCMCIA 10/100 cards, both were originally memory only, and I've alread
  • by Joe_Dragon ( 2206452 ) on Monday December 30, 2013 @02:32PM (#45820285)

    that one was hard to hack

  • Remember to contract private companies to build machines and systems to count votes as well. Nothing could possibly go wrong, and those companies will be as assiduous in detecting flaws in voting systems and their front ends as they are in counting vast quantities of cash. Because, you know, they will. 'Cause. Perfect.

    • by DaHat ( 247651 )

      Yes, because seeking solutions from government is so much better... they never deceive and only have the most purist intentions at heart.

  • USB ports will take literally any instruction at face value and execute it. In the eyes of a USB port, there is no such thing as malware.

  • by EMG at MU ( 1194965 ) on Monday December 30, 2013 @02:47PM (#45820425)
    I feel like I might know how something like this happened.

    Dev: "Hey we need to spend some time on security, for example the USB ports are not disabled, if we wan't to use them for service we should put authentication on them."
    Project Manager: "Well, you have a point but none of our competitors focus on security either and were also behind on the project. It will be fine and we can fix it next time"

    As a embedded dev I have had that conversation.
  • Oh, ffs. (Score:5, Insightful)

    by ledow ( 319597 ) on Monday December 30, 2013 @02:50PM (#45820457) Homepage

    Fail #1: A port that can be accessed without triggering an alarm.
    Fail #2: A USB port.
    Fail #3: Software running that looks at, and allows unsigned executable code to be executed from, a USB storage device without explicit authorisation.
    Fail #4: No intrusion detection whatsoever to notice that this USB device has been inserted, has had code taken from it, that that code has been made executable and executed, or that that code is running with privilege enough to dispense cash.

    I stopped caring at #2, if I'm honest.

    You can state for all the world that the ATM's need software updates, etc. but there's just no excuse for a commodity device to be able to run arbitrary code without at least BOTHERING to check the authenticity of the code it runs first and ALERTING someone somewhere that that's what's happening (i.e. alert the branch, alert the central bank, etc.).

    There's nothing stopping you issuing your updates over the local banking network, even, if that's what you want to do. Just make sure they are signed, verified, encrypted and secured. Honestly, you can't download a fecking game or movie nowadays without requiring DRM... and this is where DRM, code-signing and all that other stuff we do is supposed to be being used the most.

    General purpose computers SHOULD NOT BE USED in security-conscious situations.

    If your ATM isn't a SecureBoot machine (at a minimum), with code-signing explicitly required for any and all updates, and ALL WAYS to execute external code disabled, you're just a fecking idiot.

    • by fermion ( 181285 )
      this is simply a case of not caring. Here are three simple cheap things that can be done to insure that the effects of these attacks are minimal and tampering evident. 1) log USB port use in a secure memory space, uploading it periodically. 2) Place a validation on the USB port dating the last access. 3) Secure the USB port separately with some lock box, tiggering an alarm in the box is broken. 4) have a switch elsewhere is energize the USB port.

      One issue pointed out in the article is that same machin

  • by Princeofcups ( 150855 ) <john@princeofcups.com> on Monday December 30, 2013 @03:00PM (#45820593) Homepage

    When I worked at ABN/AMRO, I would pass the locked ATM machine engineering room, and wonder what could happen if one of these people was fired. Now we know.

  • If we used that word any less than 4 times in the 6-sentence summary, people might forget who we're talking about!

  • by quietwalker ( 969769 ) <pdughi@gmail.com> on Monday December 30, 2013 @03:07PM (#45820697)

    I used to write financial software for a living, including ATM driving software.

    I realized, after a while, that I had certain preconceived notions about the sort of software and hardware that is running on these sorts of high profile, high risk systems. Obviously, the software will have been made highly secure; redundant checks on every action, code signing, etc. It'd likely be running a custom operating system that was built from the ground up and booted off a (P)ROM. The case would be just as impenetrable, with a separate compartment for the computer itself, requiring specialty equipment so that could only really be opened at the point of origin or in a manner certain to destroy the innards - and certainly not in the field.

    Right? I mean, any of us can think up a set of reasonably secure basic premises from which we could build a system like this out of.

    Imagine my surprise when I found out that half of the ATMs out there are just running off the shelf windows desktops, with the original demo software still installed. There's no real optimization, no cleanup, no limited boot, nothing; it's just a desktop machine jammed in a vending machine with a custom card & cable for driving the mechanics of the ATM. Sometimes they're even in the original manufacturer's case (though usually they're just the board). I've also done some work on vending machines, and I can tell you that they're often better made!

    As a software developer, one of the things I was shocked to see was that security for ATMs was almost entirely focused on the physical. There's little to stop someone from hooking up an external line and sending approvals or just do basic proxying - most of the data is sent in the clear, just skim it, or to update the system with a cd or usb if you pull the front cover of the ATM off. Many times, you'll find someone left a keyboard and mouse behind in the unit because it's a pain to always carry your own when doing updates or what have you.

    This follows the same basic trend in the rest of the financial systems I've seen; physical security is very high, software security is relatively low. When it comes down to it, most companies place a focus on tracking transactions rather than securing them, and rely on constant manual review by staff to detect problems (that's why banks close so early - the folks who don't run the registers are in the back doing the day's reconciliation.

  • Robbery as defined as taking something from a person through threat of force or violence. You cannot rob an inanimate object. Theft is the correct term, or perhaps burglary (which also includes illegally entering a place to commit theft). I'm rather surprised to see the BBC misusing the term as well, but I notice they refer to it as "theft" in the story, and only use "rob" in the title. Sounds like an overzealous editor tried to make headline more catchy when posting the article.

    • As an addendum, it would seem burglary is the most accurate legal term in this case, as the criminals had to physically break into an authorized area of the ATM in order to commit the theft. But "robbery" is definitely the wrong terminology regardless.

  • by cs668 ( 89484 ) <cservin@cromagnon.com> on Monday December 30, 2013 @03:24PM (#45820909)

    At least they built a challenge response system into their hack, that's just f*'ing funny to me!!

    • Yes, because you just can't trust crooks.
    • At least they built a challenge response system into their hack, that's just f*'ing funny to me!!

      Alternative explanation: The outfit that developed the malware is selling it as a service to independent thieves.

  • by Animats ( 122034 ) on Monday December 30, 2013 @03:34PM (#45821021) Homepage

    Plugging something into a USB port is only effective as an attack if autorun is turned on in Windows. You can turn it off for all pluggable devices. A file system device is still recognized as having a file system, but something has to go to the device and get a file before anything happens.

    Running Windows on an ATM is lame, but common. Running a desktop version of windows, instead of Windows Embedded (which allows removing all the stuff that shouldn't be there) is just stupid.

  • Details of the exploit were presented Friday durning the "Electronic Bank Robberies" talk at Chaos Communication Congress, yet some how the slashdot article completely misses that. You can watch the talk on Youtube [youtube.com] or download the MP4 Video [ftp.ccc.de](172M) if you want to watch the original talk.

"This is lemma 1.1. We start a new chapter so the numbers all go back to one." -- Prof. Seager, C&O 351