3 ms·
I'm not terribly shocked. Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN. And if you can plug in a wire somewhere, you can
by kefka 10y ago
I'm not terribly shocked.
Most communication happens either at serial, SPI, or i2c busses. If it's cars, CAN.
And if you can plug in a wire somewhere, you can damage or pwn it. Most things don't have security, other than software security and physical locks. And even when there is other types of security, like cryptokeys and such, physical wires can usually bypass even those.
If they wanted something that was secure, they could do that glass mesh thing the ORWL does, and have some sort of black dyepack on the money that explodes everywhere. Go for "we ruin so you cant have". But then again, I could see criminals pissed off and taking a hammer primarily to ruin their money, and cause customer consternation.
- mjevans 10y agoI could see a more effective solution being embedded chassis intrusion meshes. Disrupt the meshes in any way (EG drilling) would result in three actions. 1) Electronic erase MOST programmable memory in the machine. (Brick it) 2) Engage something akin to an EMO (Emergency Machine Off) 3) If an uplink of some sort exists, broadcast repeatedly on it that such an event occurred and the current uptime.
- monocasa 10y agoI mean, there's chips that have that in their top metal layers, and there's still crazy people out there with electron microscopes and tiny pins that subvert them. https://web-beta.archive.org/web/20111124050620/http://www.flylogic.net/blog/?p=86 https://web-beta.archive.org/web/20111124050620/http://www.f... I wouldn't be surprised if increased physical security on ATMS isn't worth the practical difference in losses.
- mjevans 10y agoSure, someone COULD do that, but how long and how fiddly is that process? How big of a risk is there to disrupting internal components. What if you sandwich the sensitive layer as a thin mesh encased in weak resin between two metal plates? The point of security isn't absolute, but to ruin the risk + effort vs reward balance.
- ams6110 10y agoEasier than fitting a mesh would be an internal vibration sensor/microphone tuned to detect drilling/sawing.
- mjevans 10y agoThat's way easier to trigger a false positive on... Not that my mesh idea doesn't need fine tuning as well. The drilling idea I could see someone just walking by with a very loud powertools song... watch the ATM brick in the face of their first amendment freedom of expression.
- ben_jones 10y agoI wonder how many older models of ATMs are still in service and what the process for "updating" them would be like, or perhaps that it wouldn't be realistic at all. I see a lot of small family-owned corner stores with very old machines.
- deleted 10y ago[deleted]
- lucaspiller 10y agoI don't think there is a process for updating them, other than in the interest of adding new features or when they break. Recently I saw a green-screen CRT ATM in use by a bank in the UK. Maybe the internals have been updated, but it seems unlikely that they would change that and not the screen.