13 ms·
‘Jackpotting’ Attacks Hit U.S. ATMs
- userbinator 9y agoAccording to FireEye, the Ploutus attacks seen so far require thieves to somehow gain physical access to an ATM — either by picking its locks, using a stolen master key or otherwise removing or destroying part of the machine. ATMs need to be more physically secure, like bank safes, if they are to be resistant to such attacks. The software part is mostly immaterial here, IMHO --- it doesn't matter what the software is, if you can get access to the physical money.
- amenghra 9y agoThere have been several cases of stolen construction equipment (fork lifts, wheel loader, etc.) being used to steal ATMs. For example: https://www.youtube.com/watch?v=K05LT-WpN5I https://www.youtube.com/watch?v=K05LT-WpN5I Achieving 100% physical security is going to be hard.
- ZenoArrow 9y agoIn the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the cash, resulting in obtaining £30 cash taken from the till).
- mseebach 9y agoMoving the cash from even a free-standing ATM to the till seems unlikely to be a net improvement in security.
- isostatic 9y agoThe till probably has under £500 in, probably less. The ATM probably 20 times that. By offering cash back you're reducing the amount of cash kept in store, reducing the chance of being robbed (less worthwhile). By putting an ATM in store you're increasing the cash on premises, and in your tills (as people use the ATM rather than cash back) Cash back is a win-win for stores.
- mseebach 9y agoThen either the ATM had 20x too much cash in it, or the store will be unable to satisfy 19/20 requests for cash back? People withdrawing cash from the ATM (often incurring a non-trivial fee) to pay in the same store, rather than just paying on card, seems to be a marginal case and indeed inferior to card payment.
- tialaramex 9y agoATMs are often refilled only every day or two, whereas the store's registers are replenished periodically, often at shift changes or when demand increases. Perhaps more importantly the register also takes _in_ cash as unrelated customers pay with cash.
- mseebach 9y agoCash in an ATM is orders of magnitude safer than cash in a till, most significantly for the store staff as less cash invites fewer (traumatising, dangerous) robberies. When I worked in a convenience store 20 years ago, we’d dump cash into a safe through a mail slot every time the cash in the till rose over a certain amount (the register computer would show a red bar with a message to this effect), and we’d routinely have to turn down requests for all but trivial amounts of cash back for this reason.
- HeyLaughingBoy 9y agoThe store usually has nothing to lose. In most cases, the ATM in small stores isn't owned by the store: the ATM owner pays them a fee for having it there.
- eric_h 9y agoThere are ~20 ATMs within a 5 block radius of my apartment (NYC), all in small shops that have no place for an in-wall ATM, and this is in a relatively low ATM density area of the city; there are thousands more like this across the 5 boroughs. In aggregate these small freestanding ATMs are a huge business, it's unlikely they will harden their whole fleet by building in-wall installations.
- HeyLaughingBoy 9y agoNot too many walls will stand up to being rammed by a Bobcat or other small skid loader, and those can be easily transported by a pickup truck and a trailer.
- ZenoArrow 9y agoThe ATMs built into walls tend to be larger / heavier than the standalone ones. You gonna fit a crane / forklift truck on that pickup truck / trailer too?
- HeyLaughingBoy 9y agoDo you know what a skid loader is? My point is that it'll just punch a hole in the wall, ATM and all. Then pick it up and drive away.
- ZenoArrow 9y agoOh it's going to drive away now. That will be hard for a police car to catch up with.
- eps 9y agoI used to work with various ATMs and the cash dispenser _is_ a hardened safe, with a combination lock and all. If you are to steal an ATM, you will still need to open the safe and the simplest option would indeed be to try and persuade it to just dispense the money. The thing is that ATMs from larger vendors (IBM, NCR, Bull, Siemens, etc.) have layer upon layers of protection features. For example, you can configure a secondary combination for the safe which will open it and also send an emergency alert. This is for the cases when someone is being forced to open the safe at gunpoint. There are batteries for secondary power supply. There are options for physical lock-down in case of a power loss. Tilt and movement sensors. Redundant communication options, including exotics like x.28 radio. I mean that all of this was readily available even 20 years ago. ATMs are not designed by amateurs. The issue is that all these are _options_. They need to be bought first and then they also need to be properly configured and enabled, which falls on the banks or their IT service providers to do. The smaller the bank, the less willing they are to spend even more money on configuring secondary stuff and setting up an infrastructure for it, so many of these options will remain off even if they are available.
- Tempest1981 9y agoYou explain more about the x.28 radio, and its purpose? Communication between where?
- rhexs 9y agoEmbedded software is easy to hack. Spend quite a bit of money getting access to the binary running a common ATM platform. Reverse engineer it. Find a vulnerability. Trigger it. Done! The age of (common) embedded system exploitation is finally upon us.
- cjensen 9y agoThe "hack" in question involves replacing the hard drive. This isn't an embedded issue. This is a physical access to OS issue.
- polishninja 9y agoIt doesn't help that almost all the fascia locks on each vendor's machines are a standard key. With that standard key, you have full access to the computer or embedded device drive. Nowadays the communication link to the dispenser is encrypted, making swapping the hard drive useless. The real problem is the machines aren't replaced very often so there are quite a few old models out in the field that are susceptible to these sort of attacks.
- colejohnson66 9y ago> It doesn't help that almost all the fascia locks on each vendor's machines are a standard key. Interesting. Is there a source for this?
- namibj 9y agoThere is a defcon talk about jackpotting ATMs.
- icebraining 9y agoThe "hack" in question involves replacing the hard drive. Secure Boot should be able to prevent this even with physical access.
- 9y ago
- sergers 9y agoI am guessing the pulled an unencrypted hard drive from the ATM, analyzed it and the commands. Found the one that spits out cash. They pop in one with modified code and reboot it to read the new drive. Only similar ATM I can guess in Canada would already be suspect, in convenience stores, clubs, weed shops, strip clubs lol... The none bank name brand. Had one bluescreened after taking money from account but before outputting money. Was running Windows. Didn't give any money, but kept the money from the account. Had to call my bank.
- herodotus 9y agoThe Reuters article is very low on detail. https://krebsonsecurity.com https://krebsonsecurity.com is much more informative.
- dang 9y agoOK, we've changed to that from https://www.reuters.com/article/us-cyber-atms-usa/atm-makers-warn-of-jackpotting-hacks-on-u-s-machines-idUSKBN1FG0WU https://www.reuters.com/article/us-cyber-atms-usa/atm-makers....
- SyneRyder 9y agoDirect link to the Krebs story: https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/ https://krebsonsecurity.com/2018/01/first-jackpotting-attack... Nice little punchline at the end too: "The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack."
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- rapnie 9y agofirst? the late Barnaby Jack did it in 2010 :) https://en.wikipedia.org/wiki/Barnaby_Jack https://en.wikipedia.org/wiki/Barnaby_Jack
- speedie 9y agoAnd it seems to follow his suite. The "jackpot" part. Seeing those bells on the atm gave me a good laugh ..
- p1mrx 9y agoWow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that: https://www.youtube.com/watch?v=3cfQKxUffqA https://www.youtube.com/watch?v=3cfQKxUffqA
- shaunpud 9y agoHow does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?
- ipince 9y agoThe studio (content-owner) is who receives the proceeds of monetization, even if they didn't upload the video themselves.
- deleted 9y ago[deleted]
- smnscu 9y agoPerhaps not entirely applicable in this case, but check out this humorous but informative video on fair use https://www.youtube.com/watch?v=H5ZmVheuxpo https://www.youtube.com/watch?v=H5ZmVheuxpo
- ZenoArrow 9y agoThat was possible in the 1990s: https://www.theregister.co.uk/2005/10/21/phantoms_and_rogues/ https://www.theregister.co.uk/2005/10/21/phantoms_and_rogues... I also remember seeing a report that was aired on UK TV by Channel 4 back in the 1990s that showed how easy ATM fraud was. I can't seem to find the clip, but if anyone has better luck than me I'd be interested to see it again. The only other clue I can think of was that I believe the report was presented by Krishnan Guru-Murthy, but I think it might have been on a different show than the Channel 4 News.
- 9y ago
- ilikeATMs 9y agoIf you ever open up an ATM you'll realise that the majority of things are controlled by serial interfaces (upto 6 of them) for all the motors and pneumatic hardware. If the operating system becomes hardened enough, you'll eventually have people interface with the serial ports directly to manipulate the cash-drawers directly. I'm not sure why this hasn't really been done in practice but it shouldn't be to difficult to figure out how to do correctly. In most ATM's the computer hardware and interface connectors are also all housed in the top (mostly plastic or low-quality cast metal) shrouds (as opposed to the currency locked in a safe). Traditionally wafer locks were also used to secure this section however they are slowly migrating to higher security locks like Abloys. ATM manufacturers may want to take a look at slot machine manufacturers for clues on how to harden machines against tampering.
- colejohnson66 9y agoDon’t some ATMs spray ink on the bills if they detect tampering?
- jutaz 9y agoThey do, if they detect tampering to the currency safe. However I'm not sure if they are really equipped to detect tampering to electronics.
- sitkack 9y agoThere are easily multiple locks that could be put in place internally. Encrypt the signal from the host to cash dispenser, have a debugger process that is connected to the host process that also stores the encryption keys and or talks to an HSM. Mitigates tampering of a live system, makes flashing new firmware problematic. Physically limit the cash dispenser from outputting k bills over n seconds. Have those limits be session based, again signaled by main host process. Would require a full login/logout cycle for k bills. Most likely, the systems are left wide open internally to ease development and mask bugs. My ending blanket statement is that finance people know how to be cheap, they can optimize along one axis, replacing a 5$ with a 2$ part, but the really good ones optimize the whole system over a long time horizon.
- ScottBurson 9y agoThe Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack. I think this applies, mutatis mutandis: https://xkcd.com/463/ https://xkcd.com/463/
- perl4ever 9y agoAt least they aren't running OS/2 Warp.
- the-dude 9y agoActually, OS/2 has been used for ATMs ( I've seen them in the EU, long time ago ).
- xen2xen1 9y agoYup, you'd probably be surprised how much of that is still out there. At this point I'd rather have that than XP which has lots of well known exploits.
- perl4ever 9y agoIt appears that NCR and Diebold made the decision to migrate from OS/2 to Win XP a while ago.
- perl4ever 9y agoThat was the joke - I believe it is or was used in the US too. Also Windows CE.
- Simulacra 9y agoIt seems the ATM has not evolved very much over the past 20 years. Any ideas why?
- netsharc 9y agoWhy should it? Its function is to spit out money and it functions well enough for that. Obviously they do add features, like topping up phone credit or bill paying. But I would guess nowadays the bankers would rather pay smartphone app developers rather than the ATM developers...
- chrischen 9y agoBy that definition you can say it's doing it's job even better now!
- tomalpha 9y agoIf $X million is stolen every year by thieves, but it would cost[0] $2X to upgrade ATMs to prevent it then there might be a rational justification for the status quo. Or at least, one that the person(s) making the decision might use to rationalize it to themselves. [0]depending whether you do (or even consciously don’t) include indirect costs such as law enforcement and knock-on effects such as funding other areas of crime with the proceeds
- oculusthrift 9y agofiat wallets hacked. this is good for bitcoin.
- markbnj 9y agoI people didn't need cash this problem would go away. I think of this occasionally when I visit our local bagel shop, which like many bagel shops in the area does not take cards and has an atm onsite.
- aaronblohowiak 9y agoTax fraud and/or transaction fees.
- KozmoNau7 9y agoOn the other hand, if you pay by card everywhere, your moments and spending habits will be tracked and catalogued. A lot of people are not comfortable with that.
- grey-area 9y agoThe vast majority carry an internet connected gps tracker with microphone, Wifi, Bluetooth, sms and email all in one place with them at all times, and bank accounts, sms, emails are already accessible to the state on the server side. Shops are using facial recognition and Bluetooth to advertise and track customers. So I honestly think privacy in what you purchase is a ship that has sailed, this data will be recorded in future. What we should be agitating for is proper control over the use of this info, not trying to limit ways to collect it.
- tomalpha 9y agoIn Europe, the General Data Protection Regulation supposedly does just this. There is a notable exception for “national security”, but it does at least help move in the right direction. https://www.csoonline.com/article/3202771/data-protection/general-data-protection-regulation-gdpr-requirements-deadlines-and-facts.html https://www.csoonline.com/article/3202771/data-protection/ge...
- grey-area 9y agoYes I agree that's the correct approach.
- eikenberry 9y agoI assume this will end with there being fewer ATMs. That they will become more expensive to run in due to costs of hardened physical devices and insurance. If they become too rare it could result in a reduction of cash usage, maybe significantly.
- philipodonnell 9y agoNah, you'll just see more of the "charge extra and give you cash" checkout options that were in vogue before ATMs where everywhere.
- hocuspocus 9y agoInterestingly you start seeing cash back at big chains in some European countries where the concept used to be completely foreign. With a combination of new online banks that have no physical presence, credit and debit card fees capped by EU laws, and businesses who are happy to pay those fees to get rid of cash, it makes a lot of sense.
- StudentStuff 9y agoGood luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.
- Symbiote 9y agoIf they don't have a bank account, presumably they also don't use ATMs.
- CPLX 9y agoRight. But the people with bank accounts that need to conduct transactions with them have to.
- rorykoehler 9y ago
- pferde 9y agoSeveral years ago, I've had an ATM crash and reboot after pressing one of the screen side buttons when the machine was waiting for PIN entry via the numeric pad. It rebooted, and I could see that it was running MSDOS, not even Windows. Luckily, after the reboot completed and the ATM frontend program started, it spit out my card again. With one of offices of my bank being nearby (to be able to block my card if I couldn't get it back), I tried it two more times, just to check that it wasn't a random occurrence. While it was probably nothing that could further be escalated into gaining access without additional hardware, it gave me a chuckle (and a bit of fear for my card, initially).
- dtech 9y agoI'd rather have a ATM running MS-DOS than Windows. At least the attack surface is small. God nows how many ATM's are running Windows 98 and XP, which contain major security holes which will never be patched.
- sytelus 9y agoThe details: The attackers typically use an endoscope so they can attach a cord to the computer and install malware. This makes ATM remotely controllable! In previous Ploutus.D attacks, the ATM continuously dispensed at a rate of 40 bills every 23 seconds. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash. Jackpotting it is.
- glaberficken 9y ago>"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack." I had no idea ATMs ran Windows!
- colejohnson66 9y agoTo be specific, it’s most likely Windows Embedded.
- skocznymroczny 9y agoIn Poland, few years back, I caught several ATMs rebooting to Windows NT 5.0.
- slipstream- 9y ago
- ojosilva 9y agoIf you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author: > I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few presidents were assassinated did their mission grow to include protection of the president and other dignitaries. Both are their dual roles today. https://www.secretservice.gov/about/history/events/ https://www.secretservice.gov/about/history/events/
- thaumasiotes 9y agoHow does that relate to ATM fraud? The ATMs are, presumably, issuing legitimate currency?
- JumpCrisscross 9y ago> How does that relate to ATM fraud? “In 1984, the US Congress passed the Comprehensive Crime Control Act, which extended the Secret Service's jurisdiction over credit card fraud and computer fraud.” https://en.m.wikipedia.org/wiki/United_States_Secret_Service#History https://en.m.wikipedia.org/wiki/United_States_Secret_Service...
- bgribble 9y agoThe Secret Service is the law enforcement branch of the Treasury Department, like the FBI is the law enforcement branch of the Justice Department and ICE is of the Dept of Homeland Security. The President-protecting stuff is the weird part of their duties, not the other way around :)
- ad_hominem 9y agoThe Secret Service was moved to Homeland Security in 2003.
- _asummers 9y agoIf you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.
- exikyut 9y agoI just read through the comments and was VERY surprised to see noone call this out: > At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash. Realize what this means. The ATMs are connected directly to the internet, with a VPN (hopefully...) sitting over the top of that. The ATM can still call out to the internet directly!! That is, honestly, shocklingly insecure. I'm stunned. I read https://news.ycombinator.com/item?id=16250498 https://news.ycombinator.com/item?id=16250498 and how ATMs have different options for security, but "allow anything except the VPN software access to the NIC default route" doesn't sound like something _anything_ should be able to disable. I mean... I know nothing about networking, and I was able to configure this exact behavior on FreeBSD - which I'd never used before - in a day. I set it up so a torrent program was physically incapable of doing DNS/anything outside of the VPN tunnel interface.
- Anthony-G 9y agoWhen I read that part, I figured that the crooks were using their own mobile Internet connection on the laptop or mobile device that they had connected to the ATM.
- exikyut 9y ago....Ah. That is a very real possibility. Thanks for pointing that out.
- icebraining 9y agoThat configuration only works if the attacker can't re-configure the system, but considering they're suggesting that many ATMs are still running Windows XP, I'm guessing that finding a privilege escalation exploit is not that hard.
- Hendrikto 9y ago> The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack. I would argue that Windows isn‘t at all the right OS for this.
- gkgicccj 9y agoWhat is? And do you have an OS that you are comfortable calling "secure"? Remember security through obscurity as enjoyed by Mac and Linux doesn't apply here because there is actual money and hence incentive to find vulnerability at stake.
- speleding 9y agoIt should be much easier to secure a small OS targeted at the job at hand rather than a general purpose OS that supports everything from mouse drivers to webcams which gives it a huge attack surface.
- JohnStrangeII 9y agoVMS or Symbolics GENERA. Security by obscurity works.
- deleted 9y ago[deleted]
- kuschku 9y agoseL4? Other microkernels optimized for secure use cases? If you wish, you can put the actual UI in a separate chip, with more modern hardware, handling rendering and input. But please, do not run the control logic for the ATM on a desktop OS
- toomanybeersies 9y agoI would argue that any embedded OS (e.g. FreeRTOS) would probably be more appropriate. You don't need a fully featured OS, with the massive attack surface that it provides.
- 9y ago
- YTGRK 9y agohttps://youtu.be/I2l8xkjTUh4 https://youtu.be/I2l8xkjTUh4
- speedie 9y agoOvereheared a smalltak about something similar in croatia couple days ago . I tought guy was drunk and bs-ing the waitress . Now I hope I bump into him again ;)
- _cerv 9y agoOne of the first unethical “hacker” things I did was to attempt to change the bill output to larger bill. I got so incredibly nervous when I went into the debug screen that I power walked out of the corner store when the clerk noticed I had been at the machine for several minutes and had not inserted a card. You find a lot of these ATMs that are even more insecure than the larger WinXP machines. Those little kiosks are perfect for skimmers, manipulation, or just fucking around with.
- londons_explore 9y agoHah - the old "swap the tray configs around" trick...
- oldpond 9y agoI guess diebold makes their atms just like their voting machines. https://www.unhackthevote.com/ https://www.unhackthevote.com/
- skc 9y agoI worked for Diebold on their ATM's for a while. I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons. Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the device, so it could spit out whatever denominations you liked without talking to the banks mainframe. We used to have fun printing out ATM receipts showing our fake balances of millions of dollars etc.
- Someone1234 9y agoA full version of Windows or Windows Embedded ("Windows IoT")?
- skc 9y agoFull version of Windows. And want to know something else? The UI layer was html + javascript and some funky css that ran on a custom modified version of ie6. Beneath that, to handle fetching of data, comms, navigation, window management and other business logic etc, we used good old .Net and C#. It was a bizarre setup from a dev perspective but once you got used to it you could crank out new features incredibly quickly as you had a heavily regimented workflow (Usability trumps _everything_ with these machines). If you open up an ATM you will find your standard run of the mill beige PC inside it and in fact in many of the older machines they _literally_ stuff an _entire_ PC case in there simply laid on it's side. There is also an extra monitor back there with a little keyboard attached. The only impressive aspect of ATM's is the engineering that goes into all of the supporting hardware and peripherals such as the stackers, the cash acceptors, the cheque validators, the printers, the recycling cash canisters, the electronic pin pads, the various fraud detection features etc. I found that stuff much more interesting than the dev work I did day to day.
- Massacr3 9y agoI read that the software for the diebold model being targeted is built by Kal. Is this true? http://www.kal.com/en/video/multi-vendor http://www.kal.com/en/video/multi-vendor This article states that other manufacturers using Kal's software can be targeted as well with some alteration to the code. How possible could that be? https://arstechnica.com/information-technology/2018/01/in-a-first-us-hit-by-jackpotting-attacks-that-empty-atms-in-minutes/ https://arstechnica.com/information-technology/2018/01/in-a-...
- amelius 9y ago> To carry out a jackpotting attack, thieves first must gain physical access to the cash machine. Ok, like breaking the machine open, but that's cheating, and hasn't got a lot to do with software security.