I just read through the comments and was VERY surprised to see noone call this out: > At this point, the crook(s) installing the malware will contact co-conspi

I just read through the comments and was VERY surprised to see noone call this out: > At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash. Realize what this means. The ATMs are connected directly to the internet, with a VPN (hopefully...) sitting over the top of that. The ATM can still call out to the internet directly!! That is, honestly, shocklingly insecure. I'm stunned. I read https://news.ycombinator.com/item?id=16250498 https://news.ycombinator.com/item?id=16250498 and how ATMs have different options for security, but "allow anything except the VPN software access to the NIC default route" doesn't sound like something _anything_ should be able to disable. I mean... I know nothing about networking, and I was able to configure this exact behavior on FreeBSD - which I'd never used before - in a day. I set it up so a torrent program was physically incapable of doing DNS/anything outside of the VPN tunnel interface.