4 ms·

>Computer security experts have long warned that no computer should be considered secure if an attacker takes physical control of it. I think the lack of physi

>Computer security experts have long warned that no computer should be considered secure if an attacker takes physical control of it. I think the lack of physical security is more surprising than the lack of electronic security. A three-inch hole is pretty big, all things considered. I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism. Why isn't the computer protected to similar degree?

wnevets 10y ago
>Why isn't the computer protected to similar degree? It was cheaper not to.
- scardine 10y ago
  I can confirm this. I used to work for a major ATM supplier and this was the answer I got every time I asked bank personal about the lack of physical security. They would compute the average loss from burglarized ATMs against the cost to install and maintain better alarm systems and decide against it.
- flukus 10y ago
  I'm guessing there may be some cooling issues to solve as well.
Someone 10y ago
"I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism" I would use a hole saw (https://en.wikipedia.org/wiki/Hole_saw https://en.wikipedia.org/wiki/Hole_saw), and would think it fairly hard to protect a large enclosure against that. Locally strengthening the enclosure might be enough, but chances are thieves would start drilling around it to remove a larger patch or start employing an endoscope to connect something to the serial port. Hardware-wise, it probably is easier to glue the connector shut, giving up on using the diagnostic port.
- Declanomous 10y ago
  I know what a hole saw is. The thing is you aren't going to be cutting through hardened steel with a normal hole saw, assuming the cash box is metal. They could probably have made the enclosure for the cash 8 inches taller and put the computer inside of that, and routed the cables for the modem, the pin pad and the screen through Making a hole in hardened steel is not easy. If you use a hole saw, it will either need to have diamond abrasive, or you will need carbide bits. If you don't use a hole saw, you are going to be using an angle grinder or a plasma torch. Getting in fast will either generate a ton of heat or a ton of noise, or both. Plus, carbide and diamond tools are super expensive. Angle grinders, not as much, but I'd notice someone with a 3 foot trail of sparks behind them before I'd notice someone running a drill at a few hundred rpm. Anyways, I do think they probably used a hole saw, which leads me to believe the computer was located behind some combination of aluminum/plastic/ordinary steel. Which is pretty ridiculous
  - ams6110 10y ago
    It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine, if that is indeed the case.
    - kogepathic 10y ago
      > It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine Well humans have to interact with the machine somehow. You can't exactly prevent physical access to the keypad, and from the nature of this attack, thieves could just hack out the pin pad to connect to the internal bus. It would be noticed much more quickly, but they'd still be away with the cash.
      - Dylan16807 10y ago
        Well that's part of the point. The wire carrying that particular bus should be entirely inside the box.
  - 10y ago

wnevets 10y ago

>Why isn't the computer protected to similar degree? It was cheaper not to.

scardine 10y ago
I can confirm this. I used to work for a major ATM supplier and this was the answer I got every time I asked bank personal about the lack of physical security. They would compute the average loss from burglarized ATMs against the cost to install and maintain better alarm systems and decide against it.
flukus 10y ago
I'm guessing there may be some cooling issues to solve as well.

Someone 10y ago

"I have to imagine that ATMs are designed to resist drilling three inch holes through to the money or the dispenser mechanism" I would use a hole saw (https://en.wikipedia.org/wiki/Hole_saw https://en.wikipedia.org/wiki/Hole_saw), and would think it fairly hard to protect a large enclosure against that. Locally strengthening the enclosure might be enough, but chances are thieves would start drilling around it to remove a larger patch or start employing an endoscope to connect something to the serial port. Hardware-wise, it probably is easier to glue the connector shut, giving up on using the diagnostic port.

Declanomous 10y ago
I know what a hole saw is. The thing is you aren't going to be cutting through hardened steel with a normal hole saw, assuming the cash box is metal. They could probably have made the enclosure for the cash 8 inches taller and put the computer inside of that, and routed the cables for the modem, the pin pad and the screen through Making a hole in hardened steel is not easy. If you use a hole saw, it will either need to have diamond abrasive, or you will need carbide bits. If you don't use a hole saw, you are going to be using an angle grinder or a plasma torch. Getting in fast will either generate a ton of heat or a ton of noise, or both. Plus, carbide and diamond tools are super expensive. Angle grinders, not as much, but I'd notice someone with a 3 foot trail of sparks behind them before I'd notice someone running a drill at a few hundred rpm. Anyways, I do think they probably used a hole saw, which leads me to believe the computer was located behind some combination of aluminum/plastic/ordinary steel. Which is pretty ridiculous
- ams6110 10y ago
  It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine, if that is indeed the case.
  - kogepathic 10y ago
    > It is pretty surprising that the computer board/diagnostic ports are not inside the "armored" part of the machine Well humans have to interact with the machine somehow. You can't exactly prevent physical access to the keypad, and from the nature of this attack, thieves could just hack out the pin pad to connect to the internal bus. It would be noticed much more quickly, but they'd still be away with the cash.
    - Dylan16807 10y ago
      Well that's part of the point. The wire carrying that particular bus should be entirely inside the box.
- 10y ago