USB Sticks Used In Robbery of ATMs 252
First time accepted submitter JeffOwl writes "BBC is reporting that thieves are infecting ATMs with malware using USB sticks. The malware creates a backdoor that can be accessed at the front panel. The thieves are damaging the ATM to access a USB port then patching it back up to avoid notice. This indicates that the crew is highly familiar with the ATMs in question. Once the ATM is infected, the thieves use a 12 digit code to bring up the alternate interface. The thieves, not wanting their crew to go rogue, have built a challenge-response access control into their software and must call another member who can generate the response for them."
That's what you get (Score:5, Insightful)
Re:That's what you get (Score:5, Funny)
Mod parent up! Linux machines are impenetrable, even if an expert has physical access. This is why Torvalds gets so aggressive: he keeps locking himself out of his testing machines and has to buy new ones.
Re:That's what you get (Score:5, Insightful)
Furthermore, you presumably wouldn't get administrative access.
Re: (Score:2)
Yes, because it's impossible to configure Linux to auto-mount all new devices, check for the presence of a specifically named file and execute commands within.
Re: (Score:2)
Re: (Score:3)
I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?...)
(posting as AC due to non-orthodox opinion favoring Windows over Linux.)
Go ahead and take your head out of your ass, and re-read his comment: "Yes, because it's impossible to configure Linux to auto-mount all new devices, check for the presence of a specifically named file and execute commands within.
Emphasis mine. Linux can easily auto-mount thumb drives. Many distros have it enabled out of the box. What you wont find is any that scans the drive for things to run and then does so, with elevated privileges (something present in many recent versions of windows). Having an ea
Re:That's what you get (Score:4, Informative)
Windows doesn't do that anymore either. It gives the user an option to invoke autoruns, but doesn't trigger them.
Attacks on USB tend to target the drivers these days, not the OS.
Re: (Score:2)
I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?
Um - I plug a USB stick into my Linux computer and an icon pops up on the desktop named "USB Drive" (or whatever name it has) that I can double click and do whatever I need.
I'm guessing that if you were actually trying to read an honest to goodness floppy disk it was more than a "few years ago". Linux has come a long way. The "year of Linux on the desktop" was 5 years ago for me.
Of course my parents called me to come look at their (Windows) computer a while back because it wasn't acting quite right, and I
Re: (Score:3)
I'm pretty sure Ubuntu (and derivatives) have add the "auto detect plugged USB, put icon on desktop, double-click to mount" practically since I started futzing with it back in 2007...and if you're going to say "Year of the Linux Desktop," you pretty much mean Ubuntu.
QED.
And even Windows machines don't generally have floppy drives anymore, right?
Re: (Score:3)
CentOS will automount removable flash drives under the /media directory. Similar with optical media. One can disable this so media will need manually mounted to be used. It won't run or execute anything on the drives though... just mount it and have it usable for the user.
Re: (Score:2)
Not a troll either, it's a very interesting read (and you're demonstrating quite a lot of the misconceptions cleared in that article -- read it.
Re: (Score:2)
Same autorun that is now disabled by default and was always trivially disabled?
Re: (Score:2)
It is probably a fake keyboard and mouse device, many of those ATMs run their applications with administrator privileges, so anything can be run with that kind of device
Re: (Score:2)
You know how I know you didn't read the article?
Hint: It runs a file called "hack.bat"
Re: (Score:2)
so? an executable name tells you it was an autorun? it could have been a USB subsystem buffer overflow or any other vulnerability, or a USB HID device that injected Win_Key+R and typed d:\hack.bat. Many options
Re:That's what you get (Score:5, Informative)
I'd be very surprised if the "alternative interface" isn't installed by rebooting the machine off the USB stick. The Diebold voting machines were configured to preferably boot off a USB, and Diebold is still the largest manufacturer of ATMs in the US.
Re:That's what you get (Score:4, Informative)
Say it ain't so...
Re:That's what you get (Score:4, Interesting)
You should read up on what a security nightmare the voting machines are, it's appalling. Doesn't help that there are a dozen or more manufacturers, all of them being sold on the basis of friendly back slaps with local politicians rather than actual analysis of the hardware and software (which is always closed source). Testing procedures are a joke, by design, and even systems that fail testing get sold on the promise of an update in future firmware versions. Don't overlook punch card counters either, they put out by far the largest deviations from exit polls of any of the machines.
Re: (Score:2)
I like optical scan, where the voter draws a line between arrowheads next to the name of the candidate or their position on the question. I like it because it can be machine-counted for speed, and can be human-counted when there's a dispute or an automatic-recount based on the closeness of an election. It is, by default, its own paper trail.
Re: (Score:2)
Of course when you can't access the actual ballots except with a court order, and you can't get a court order without some proof that wrongdoing has occurred, the paper trail is kind of moot.
Re:That's what you get (Score:4, Interesting)
I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun. Furthermore, you presumably wouldn't get administrative access.
It doesn't require autorun. A usb device that emulates a keyboard or other input device would do the trick. Send the keystrokes necessary to break in. Think Linux is immune? How about the keystrokes necessary to reboot the machine and start up in single user mode? Even if single user mode has been protected, the usb device could provide both keyboard emulation and cdrom emulation -- during reboot the hack could boot to alternate media. The real fail is a design that allows access to the hardware (physical access is full access) and not the choice of operating system.
Re:That's what you get (Score:4, Interesting)
Err, not really. If we're building a *nix ATM, then you can fix it in one go: If the USB port requires elevated privs just to mount/use anything plugged into it (say, a long numbered sequence entered from the ATM keypad, unique to that machine, that would translate to a variation of "sudo /bin/mount"), the whole USB stick trick falls flat.
Not sure if there would even be a feasible analog for that in embedded XP/CE/WE
Re: (Score:2)
Running *nix on ATMs would go against the banks' standard practice of 'low bid always gets the job.' Keep in mind that these are the same organizations who allowed access to any account configured for online banking simply by changing the account number in the address bar of the browser (and then left it that way for years). Had an instructor who did pen tests for financial institutions, the stories he told were depressing.
Re: (Score:2)
Based on the limited information, it looks like it was setup as a recovery/maintenance feature that required physical security, and physical security was compromised. Sure, for "security" you could program all ATMs to self destruct on any OS halt, but I'm not sure that would be in the best financial interests of the owning company.
Re: (Score:2)
I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick.
My Acer netbook reflashes the BIOS if it is turned on with a USB stick containing a file of a certain name in place. If you control the BIOS, you control the computer.
This feature truly is a good thing, since turning the netbook off improperly while running some linux versions bricks it.
Re:That's what you get (Score:5, Insightful)
Or, in layman's terms, AT BEST the USB port should only work for a keyboard interface as a prompt for a password until the operator is authenticated.
It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default. It should not give the OS kernel access to media plugged into it. It should CERTAINLY not automatically engage media plugged into it to read it. Arguably, it shouldn't do ANYTHING even with a keyboard plugged in until the technician servicing the machine has otherwise entered passwords, like on an internal keypad.
Re: (Score:3)
With properly managed devices, USB is disabled. This is an option, even in windows. And it is even an option at the BIOS/UEFI level on some systems. However, I wonder why they aren't using some soft of VDI for protecting the ATMS. This would prevent any direct access to the hardware running windows.
Re:That's what you get (Score:5, Informative)
The USB port is enabled to write the Electronic Journal when Brinks or whoever comes by to refill the ATM. The copy of the journal is then given to the institution responsible for the ATM.
Quack! (Score:2)
http://hakshop.myshopify.com/products/usb-rubber-ducky
Re: (Score:2)
Re: (Score:3)
It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default. It should not give the OS kernel access to media plugged into it. It should CERTAINLY not automatically engage media plugged into it to read it.
There is at least one exploit out there that relies on fragility in the USB firmware - the code that auto-negotiates with a USB device when it gets plugged in, sets up the bus, etc. The exploit works by sending unexpected data (buffer overflow, out-of-range values, etc).
That kind of exploit works even if the OS does not autoplay or even automount.
Joanna Rutkowska covered USB exploits (Score:3)
Here in this blog post: http://theinvisiblethings.blogspot.com/2011/06/usb-security-challenges.html [blogspot.com]
Is definitely a concern to her Qubes OS project.
Re: (Score:3)
Sounds apocryphal.
But it sounds like a way to hack a usb device, rather than the computer that hosts it.
It is that precise mechanism by which the PS3 was fully jailbreaked
http://thexploit.com/secnews/ps3-heap-overflow-exploit-explained/ [thexploit.com]
After all, USB sticks don't have much in the way computing power.
Lol, who can take you seriously after such a statement? People are putting entire PC's on usb stick form factors. Dell's got their "thumb PC" google has their chromecast, and there are plenty no-name chinese units too.
Buffer overruns from an input device are trivial to prevent. And even windows does that these days.
That's what we in the security biz call "famous last words."
Re: (Score:3)
At this point I am now convinced you don't have a fuckin clue how security exploits work. Enjoy your ignorance. It's all you've got.
Apparent I have a better Idea of it than you do. You seem to think walking by a USB socket with a thumb drive and it roots what ever operating system happens to be installed on said computer.
That is bullshit of the highest order. You've been watching too much TV.
Re:That's what you get (Score:4, Informative)
It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default.
Remember: This feature was brought to you by the same company who thought it was a good idea to execute .exe files attached to emails without even asking you.
Re: (Score:2)
Had that new laptop not had problems with Linux (the clock would advance strangely and inconsistently, which broke just about everything attempting to run eventually) I probably wouldn't have fallen back into the MS path of least resistance.
Re: (Score:2)
Yeah, but you don't have to give it up to the first male USB connector that comes by.
Re: (Score:3)
They're federally insured so they don't care...
Re:That's what you get (Score:5, Insightful)
no, this is what you get when you put a USB port on a frigging ATM. Whose bright idea was that anyways?
Re:That's what you get (Score:5, Insightful)
Making it easy to install upgrades? Or to connect say, a proper keyboard, to do maintenance?
USB stick is better than over network as physical access is needed. And in this case, they indeed had to physically break the ATM to gain access to this USB port.
Re: (Score:2)
Re:That's what you get (Score:5, Informative)
Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.
Re:That's what you get (Score:5, Insightful)
Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.
All of the flames about windows vs linux are a red herring. This is the real design flaw. Any design that assumes the USB interface to the software is not just as important to protect as the cash itself completely ignores why they would ever put the USB port on there in the first place (to make material changes to the ATM software).
Re: (Score:3)
Which really begs the question which idiot designed the machine with a USB port for updates and NOT protecting it properly!
Re: (Score:2)
That'd mean a lot more destruction to the ATM, and as a result instant detection of the crime. Instead of days or weeks later when the number of notes in the machine was compared with the ledger (no idea how frequently that's done).
Re: (Score:2)
Color me puzzled, but if you already have already physically broken into the ATM to gain access to the USB port, why not just grab the cash instead?
Because that would be easily detected and would be a one-shot win. By grabbing account data from every person who uses the machine you can clean out accounts -- which would be a lot more than the cash in the machine.
touch screen and other parts are USB. new SLOT MAC (Score:2)
Well the touch screen, printer and maybe even the link to the cash system may be USB.
Even new SLOT MACHINES use USB and the Incredible Technologies games are ALL USB and load code from USB drives.
Re:That's what you get (Score:5, Insightful)
The USB port is pretty well hidden and secure, which is why the article points out the fact that the thieves appear to be familiar with the machines enough to know where and how to best break that part open. Even the best of security measures won't hold up against an inside job.
Re: (Score:2)
Crack open the keypad area, cut the wires and connect them to your device (also defeats anything that tries to use a non-standard connector). Twist the wires back together when you are done (it isn't like you are trying to reconstruct the wires from a parallel port...usb is easy). If the keypad is still needed, then you hijack the receipt printer or you add a USB hub to your device and hook the keypad up to that.
Re: (Score:3)
Pro-tip- most ATMs (I work for a financial, so have seen a few) have only a single locked front panel that is opened up to gain access to the internals (with only the cash in a more secure safe box inside that). ATMs in busy areas will be serviced pretty much every day. If you want a good look at where the various internals are (including any USB ports), all you'd need to do is hang around the ATM until someone comes to service it- everything you need to see will be right there on display. Take a snap with
Re:That's what you get (Score:4, Interesting)
ATMs generally run on commodity hardware and a commodity OS (most I've seen are Windows NT 4.0 and newer).
Re: (Score:2)
No directly related but that reminds me of the time i saw an EJB error displayed on a credit card terminal :-)
Re:That's what you get (Score:4, Interesting)
My bank still uses os/2 on their ATMs.
Re: (Score:2)
eCS/2 (eComStation, the company that is maintaining OS/2) still is used in some ATMs. If the OS works, is well maintained, and has earned its bones, why change? ATMs have not changed much in 10-20 years, other than maybe display a news blurb or the daily weather on the demo screens. Might as well keep with what works.
Re:That's what you get (Score:5, Informative)
That's what you get from running Windows on ATMs, lol.
No, it really isn't. I've seen this demo'd at a security conference, and the OS has nothing at all to do with the attack. ATMs have a USB port which can be used to replace the firmware. The port is behind a simple lock, not in the vault with the money.
This attack replaces the OS on the ATM with the image the attacker provides. What the OS was before the attack really isn't all that relevant. The fact that images aren't signed or anything is.
Re: (Score:2)
The ironic thing is that even the cheapest, no-name Android phone has better protection than ATMs against this avenue of attack, assuming a bootloader with a signing process.
Re: (Score:2)
This isn't necessarily an inside job either. These guys could have stolen an ATM whole at any point and taken as long as they needed to reverse engineer the thing, dumping the old firmware directly from its internal storage and everything. A quick patch to the dumped firmware and the
Re: (Score:2)
One of the few situations where Treacherous Computing actually makes sense.
An ATM should only boot a properly signed OS, and only run signed executables. In this situation, the computer is more of an embedded system, and should not be treated as a general purpose computer.
Re: (Score:3)
Why is the USB "auto-running", rather than waiting for the user to log in with secure verification (maybe a hard-token) and prompting the USB to load? Why is the OS willing to run a firmware update which isn't signed with some sort of trusted protocol?
You're right that it isn't the OS's fault per se, but it is the fault of the software/OS as it was set up. There should be no reason why Windows can't be set up sensibly to prevent these issues, and there's definitely no reason why Linux couldn't be. Someone w
Re: (Score:2)
Re:That's what you get (Score:5, Funny)
I guess this was a...
STICK-up.
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:3)
How exactly would a video camera prevent a masked marauder from drilling?
I dunno, another panel opens and a white gloved hand on one of those scissors-like extensions comes out and slaps the thief silly? I'm pretty sure I saw that on a Bugs Bunny cartoon. Or maybe it was one of the Star Wars prequels, I forget.
Re: (Score:2)
There is no need to drill the outer shell, apparently it is not difficult to buy keys for ATM machines online, dress as a repair man and no one thinks twice. Failure by some institutions to utilize maintenance logs and scheduling for ATM repairs.
Re: (Score:2)
My bad, I posted before I read the article. I was thinking that they used keys.
Re:Moral of the story (Score:5, Informative)
In the UK you cannot access the internals of the ATM unit without either accessing the rear of the machine, which is locked away in the safe that they mention, or by cutting into the fascia of the external face, which is what they did here.
You cannot gain access to the ATM simply by using a key bought off of the internet.
And yes, most ATMs in the UK have a video camera on them to help identify fraudsters, but that does NOT help prevent the fraud from occurring because someone would have to watch it in real time and intervene. Infact they identified just how this hack was occurring by watching the CCTV footage to see just how the money was going missing, because it wasn't triggering any other alarms.
Re: (Score:3)
In most countries it depends on the ATM - there are many different kinds of ATMs installed in many different ways. Is there really some standard in the UK? Are there not cheap ATMs in convenience stores that are very different from the big ATMs next to banks?
Pretty much all ATMs these days have a camera, sure, but it typically records images on storage in the ATM. After the attack, it's going to have whatever comical pictures the attackers want it to have.
Re: (Score:2)
Re: (Score:2)
The scary thought is that all these ATMs are just as vulnerable to remote attacks. I don't know any details about that side, other than they're mostly on dial-up so you can just call them and hack them, but apparently they are very vulnerable (I would guess there's a default password that's rarely changed, or something equally inane). If the attacker wants magstripes and PINs instead of the cash in the machines, there's no reason to ever be near one.
Re: (Score:3)
Well, there is nothing to indicate anything is wrong. The ATM machines still look like they are functioning normally from the operations center and the tapes are (normally) only reviewed if they suspect something has gone wrong. It’s not like they have a bank of rent a cops monitoring these things 24/7.
Re:Moral of the story (Score:5, Insightful)
When has a video camera ever stopped someone from doing exactly what they intend to do? Youtube is full of examples of people behaving badly in front of a video camera (sometimes - because of the video camera)
Sure, video cameras may cause people to reconsider their behavior - but a criminal intent on committing a crime will just wear a mask or disable the camera with some high-tech sticky tape. If the group is repairing the machines so their modification can't be detected - nobody would be the wiser. They might consider the tape to be the work of a prankster and peel it off.
Maybe if the video camera was attached to a flame-thrower - that might do the trick.
Re: (Score:3)
Video cameras to prevent drilling of the outer shell was never considered?
Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it. Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and mad
Re: (Score:2)
Video cameras to prevent drilling of the outer shell was never considered?
Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it.
To add to the complexity, there are plenty of ATMs (more than enough for a gang to live off of) that are nowhere near a bank. Since the plan was well thought out (the software they hacked in was particularly brilliant to have two-factor auth) they probably also cased ATMs that had a minimum of video surveillance and "hit" them when there were few people around.
Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and made your getaway.
What is apparently necessary is a software tool to match up physical presence with a lack of ATM transaction activity, since these guys no doubt lef
Re: (Score:2)
Security cameras are only to record what happens, for later viewing. They don't help prevent crime, they only help solving it (they might prevent some because of the higher risk of getting caught).
These thieves did their best to not have their work detected. They drilled the hole, installed the software, then patched up the hole. Later they came back to get the money out of the machine - basically by nicely asking the machine to give it to them. And that again was detected only much later when the notes in
Barnaby jack jackpotting ATMS (Score:5, Informative)
Google the subject, he performed this attack live at both Blackhat and Defcon 18. It was definately an eye opener, and one of the reasons I tend to avoid those rental ATM's you see in mom and pop stores, and restaurants/bars...
yes I realize that even the major Bank ATM's are susceptible, but at least with a major bank you have some recourse if you have issues.
Re:Barnaby jack jackpotting ATMS (Score:4, Informative)
Re: (Score:2)
I've wondered why ATMs are not designed with some defense in depth. Yes, the cash pile and outer case tend to be well armored, but I wonder about having the core computer be in a tamper resistant case, similar to a HSM, with software for copying signed updates [2]. There wouldn't be a USB port, but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that) and a restricted interface for updates might help things. If the case holding the core CPU
Re: (Score:2)
, but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that)
Are you sure about that? http://nz.transcend-info.com/products/CatList.asp?FldNo=24&Func2No=203 [transcend-info.com]
That one runs a disconnected Wi-Fi to share the photos using the power supplied, but no connection back to the host, but I've also used networking cards in PCMCIA slots. You do know what the MC stands for in that, right? memory cards have been used for more than just flash memory, since as soon as they were invented.
Re: (Score:2)
One can use storage with a parallel port. However, the host must have specific drivers for it ready to go. So, plugging in a Wi-Fi card into a SD slot will physically work, but it is an unlikely attack avenue, just because the machine isn't likely to load drivers for it, configure an IP stack, fire up DHCP and turn that adapter on.
USB is a different animal. Plug in a device, and most USB stacks already have HID drivers, mass storage drivers, printer drivers, and other items ready to go. Unless it was ex
Re: (Score:2)
Why did we get rid of OS2 on the ATM's? (Score:3)
that one was hard to hack
Tech is perfect (Score:2)
Remember to contract private companies to build machines and systems to count votes as well. Nothing could possibly go wrong, and those companies will be as assiduous in detecting flaws in voting systems and their front ends as they are in counting vast quantities of cash. Because, you know, they will. 'Cause. Perfect.
Re: (Score:2)
Yes, because seeking solutions from government is so much better... they never deceive and only have the most purist intentions at heart.
It's not the USB drives, it's the USB ports (Score:2)
USB ports will take literally any instruction at face value and execute it. In the eyes of a USB port, there is no such thing as malware.
How do we prevent this? (Score:5, Informative)
Dev: "Hey we need to spend some time on security, for example the USB ports are not disabled, if we wan't to use them for service we should put authentication on them."
Project Manager: "Well, you have a point but none of our competitors focus on security either and were also behind on the project. It will be fine and we can fix it next time"
As a embedded dev I have had that conversation.
Re: (Score:2)
Why?
Deadlines.
Costs.
Salaries.
Oh, ffs. (Score:5, Insightful)
Fail #1: A port that can be accessed without triggering an alarm.
Fail #2: A USB port.
Fail #3: Software running that looks at, and allows unsigned executable code to be executed from, a USB storage device without explicit authorisation.
Fail #4: No intrusion detection whatsoever to notice that this USB device has been inserted, has had code taken from it, that that code has been made executable and executed, or that that code is running with privilege enough to dispense cash.
I stopped caring at #2, if I'm honest.
You can state for all the world that the ATM's need software updates, etc. but there's just no excuse for a commodity device to be able to run arbitrary code without at least BOTHERING to check the authenticity of the code it runs first and ALERTING someone somewhere that that's what's happening (i.e. alert the branch, alert the central bank, etc.).
There's nothing stopping you issuing your updates over the local banking network, even, if that's what you want to do. Just make sure they are signed, verified, encrypted and secured. Honestly, you can't download a fecking game or movie nowadays without requiring DRM... and this is where DRM, code-signing and all that other stuff we do is supposed to be being used the most.
General purpose computers SHOULD NOT BE USED in security-conscious situations.
If your ATM isn't a SecureBoot machine (at a minimum), with code-signing explicitly required for any and all updates, and ALL WAYS to execute external code disabled, you're just a fecking idiot.
Re: (Score:2)
One issue pointed out in the article is that same machin
Inside Job (Score:3)
When I worked at ABN/AMRO, I would pass the locked ATM machine engineering room, and wonder what could happen if one of these people was fired. Now we know.
Did we mention they're thieves? (Score:2)
If we used that word any less than 4 times in the 6-sentence summary, people might forget who we're talking about!
Software security in finance is surprisingly low (Score:5, Informative)
I used to write financial software for a living, including ATM driving software.
I realized, after a while, that I had certain preconceived notions about the sort of software and hardware that is running on these sorts of high profile, high risk systems. Obviously, the software will have been made highly secure; redundant checks on every action, code signing, etc. It'd likely be running a custom operating system that was built from the ground up and booted off a (P)ROM. The case would be just as impenetrable, with a separate compartment for the computer itself, requiring specialty equipment so that could only really be opened at the point of origin or in a manner certain to destroy the innards - and certainly not in the field.
Right? I mean, any of us can think up a set of reasonably secure basic premises from which we could build a system like this out of.
Imagine my surprise when I found out that half of the ATMs out there are just running off the shelf windows desktops, with the original demo software still installed. There's no real optimization, no cleanup, no limited boot, nothing; it's just a desktop machine jammed in a vending machine with a custom card & cable for driving the mechanics of the ATM. Sometimes they're even in the original manufacturer's case (though usually they're just the board). I've also done some work on vending machines, and I can tell you that they're often better made!
As a software developer, one of the things I was shocked to see was that security for ATMs was almost entirely focused on the physical. There's little to stop someone from hooking up an external line and sending approvals or just do basic proxying - most of the data is sent in the clear, just skim it, or to update the system with a cd or usb if you pull the front cover of the ATM off. Many times, you'll find someone left a keyboard and mouse behind in the unit because it's a pain to always carry your own when doing updates or what have you.
This follows the same basic trend in the rest of the financial systems I've seen; physical security is very high, software security is relatively low. When it comes down to it, most companies place a focus on tracking transactions rather than securing them, and rely on constant manual review by staff to detect problems (that's why banks close so early - the folks who don't run the registers are in the back doing the day's reconciliation.
Not robbery (Score:2)
Robbery as defined as taking something from a person through threat of force or violence. You cannot rob an inanimate object. Theft is the correct term, or perhaps burglary (which also includes illegally entering a place to commit theft). I'm rather surprised to see the BBC misusing the term as well, but I notice they refer to it as "theft" in the story, and only use "rob" in the title. Sounds like an overzealous editor tried to make headline more catchy when posting the article.
Re: (Score:2)
As an addendum, it would seem burglary is the most accurate legal term in this case, as the criminals had to physically break into an authorized area of the ATM in order to commit the theft. But "robbery" is definitely the wrong terminology regardless.
Crooks are better at security than the banks!! (Score:5, Interesting)
At least they built a challenge response system into their hack, that's just f*'ing funny to me!!
Re: (Score:2)
Re: (Score:2)
At least they built a challenge response system into their hack, that's just f*'ing funny to me!!
Alternative explanation: The outfit that developed the malware is selling it as a service to independent thieves.
in other news... (Score:2)
Who left autorun turned on? (Score:3)
Plugging something into a USB port is only effective as an attack if autorun is turned on in Windows. You can turn it off for all pluggable devices. A file system device is still recognized as having a file system, but something has to go to the device and get a file before anything happens.
Running Windows on an ATM is lame, but common. Running a desktop version of windows, instead of Windows Embedded (which allows removing all the stuff that shouldn't be there) is just stupid.
From the 30c3 Electronic Bank Robberies talk (Score:2)