5 ms·

I wonder how they get access to a communication line or access port or whatever to load their malware onto the ATM. I would think that's the tough part - once y

by ufmace 6y ago

I wonder how they get access to a communication line or access port or whatever to load their malware onto the ATM. I would think that's the tough part - once you get that, it's probably easy to compromise.

non-entity 6y ago
I'm now genuinely curious if it's possible to purchase an old atm to hack around with (solely educationally of course) Was shocked to recently find semi-modern (mid-2000s) gas-pumps for sale cheap on eBay so who knows.
- fortran77 6y ago
  Yes! Look on the DEFCON channel on YouTube and watch several live demos with ATMs that were purchased second-hand.
- toast0 6y ago
  Find your local liquidation auction house. You'll see a lot more of the types of atms that show up at cash only businesses than bank location style atms, but sooner or later, one will show.
- joezydeco 6y ago
  Here you go: https://www.surplustraders.net/banking-and-pos/atm https://www.surplustraders.net/banking-and-pos/atm
- keyme 6y ago
  Just keep in mind that it's very heavy. Very. Like your building's construction code may not allow that much weight per floor area. Shipping or mooving it around would be similarly "fun".
  - RandomBacon 6y ago
    They make motorized hand carts ("dollies") that make it easy for a single person to move large safes. Either with motorized wheels, or a motorized actuator that lifts a second set of wheels up and down which makes it possible to go over curbs and other obstacles. It would still probably be "fun" (not easy) for someone who hasn't done it before, but not impossible.
    - shakna 6y ago
      Whilst that's true... It doesn't change that the floor you're moving it to is probably not rated for the weight. Picking it up only solves half the problem, and the easier half.
- stevenwoo 6y ago
  I had an acquaintance whose side business was running ATM's in convenience stores in California (the fees are outrageously profitable) so I assume it's possible to buy/rent the latest models for personal use and hack it all you want.
  - sukilot 6y ago
    Hacking a rented device likely violates the contract and perhaps law.
- abraham 6y ago
  There is a great youtube video about buying and converting a second hand ATM https://youtu.be/nHDpzczgdo0 https://youtu.be/nHDpzczgdo0
jedberg 6y ago
A lot of ATMs sit in places like convince stores or strip clubs or other places where you might need quick cash. They are profit centers for those places, because those places get to keep some of the fees collected. They are also very very insecure. You can literally just walk around behind them and attach stuff without anyone really noticing. I was renewing my registration at a DMV kiosk, which is like an ATM that spits out registration tags instead of money. The machine was broken, and the supermarket said to just call the number on the side. I did so, and they told me to unplug it and plug it back in. So I went around the back and did exactly that. No one questioned me. Then they remotely logged in, messed around on it (which I could watch them do on the display) and it was fixed. But my point here is that no one questioned me when I went around back, no one questioned a mouse moving around on a touch screen, no one questioned random control panels coming up, and the people who owned it (the DMV) didn't seem to care about the information leaks they were providing me.
- sillysaurusx 6y ago
  Still, though, what sort of data lines do ATMs use? Ethernet? If so, how would you exploit it? It seems like the ATM's software might work like this: on bootup, connect to server atm.foobar.com at port xyz. Oh, right. In that case, you'd write an MITM server. You could sneak a raspberry pi so that it goes ATM <-> RPI <-> ethernet, and then set up the RPI to broadcast all the network traffic via a wifi dongle to your laptop. But... certificate pinning would trivially subvert that. I guess ATM manufacturers might not have done any pentests though, so perhaps they don't do cert pinning. Assuming cert pinning, is there still a way?
  - dylz 6y ago
    The kind of ATM I see at gas stations usually seem to involve a legacy ethernet cable of some sort (I've been told it's probably RJ12) and/or a small antenna magnet-mounted to the top of it. Not sure if they both serve the same communications purpose. The few times I've used one they also take a ridiculous amount of time to connect/return anything, on the order of 30s-1m.
    - 6y ago
hn_throwaway_99 6y ago
This was my exact question as well, and I wish the article did a better job answering it. There was a linked article that explained how it worked with physical access, i.e. popping the top of the ATM panel (it said the physical lock that keeps this down is like a "bathroom lock" and easily picked), and then there are USB or SIM card ports you can interface with. For the remote attacks, though, like the one where it said could result in many ATMs at the same time being hacked, I don't begin to understand where the attack vector starts.
- jcrawfordor 6y ago
  ATMs generally connect to a management system to retrieve configuration and report status. Like many back-end systems, these are often poorly designed and don't receive extensive security review. So if you can compromise one, there's an opportunity to potentially deliver a malicious configuration to a large number of machines at once. Similarly, there are several ways that attackers can find ATMs on the internet or telephone system in bulk. Although the situation has improved, ATMs historically had very poor authentication for remote management (some likely still do) which made them vulnerable to malicious reconfiguration over the internet or telephone modem.

by ufmace 6y ago

non-entity 6y ago

I'm now genuinely curious if it's possible to purchase an old atm to hack around with (solely educationally of course) Was shocked to recently find semi-modern (mid-2000s) gas-pumps for sale cheap on eBay so who knows.

fortran77 6y ago
Yes! Look on the DEFCON channel on YouTube and watch several live demos with ATMs that were purchased second-hand.
toast0 6y ago
Find your local liquidation auction house. You'll see a lot more of the types of atms that show up at cash only businesses than bank location style atms, but sooner or later, one will show.
joezydeco 6y ago
Here you go: https://www.surplustraders.net/banking-and-pos/atm https://www.surplustraders.net/banking-and-pos/atm
keyme 6y ago
Just keep in mind that it's very heavy. Very. Like your building's construction code may not allow that much weight per floor area. Shipping or mooving it around would be similarly "fun".
- RandomBacon 6y ago
  They make motorized hand carts ("dollies") that make it easy for a single person to move large safes. Either with motorized wheels, or a motorized actuator that lifts a second set of wheels up and down which makes it possible to go over curbs and other obstacles. It would still probably be "fun" (not easy) for someone who hasn't done it before, but not impossible.
  - shakna 6y ago
    Whilst that's true... It doesn't change that the floor you're moving it to is probably not rated for the weight. Picking it up only solves half the problem, and the easier half.
stevenwoo 6y ago
I had an acquaintance whose side business was running ATM's in convenience stores in California (the fees are outrageously profitable) so I assume it's possible to buy/rent the latest models for personal use and hack it all you want.
- sukilot 6y ago
  Hacking a rented device likely violates the contract and perhaps law.
abraham 6y ago
There is a great youtube video about buying and converting a second hand ATM https://youtu.be/nHDpzczgdo0 https://youtu.be/nHDpzczgdo0

jedberg 6y ago

A lot of ATMs sit in places like convince stores or strip clubs or other places where you might need quick cash. They are profit centers for those places, because those places get to keep some of the fees collected. They are also very very insecure. You can literally just walk around behind them and attach stuff without anyone really noticing. I was renewing my registration at a DMV kiosk, which is like an ATM that spits out registration tags instead of money. The machine was broken, and the supermarket said to just call the number on the side. I did so, and they told me to unplug it and plug it back in. So I went around the back and did exactly that. No one questioned me. Then they remotely logged in, messed around on it (which I could watch them do on the display) and it was fixed. But my point here is that no one questioned me when I went around back, no one questioned a mouse moving around on a touch screen, no one questioned random control panels coming up, and the people who owned it (the DMV) didn't seem to care about the information leaks they were providing me.

sillysaurusx 6y ago
Still, though, what sort of data lines do ATMs use? Ethernet? If so, how would you exploit it? It seems like the ATM's software might work like this: on bootup, connect to server atm.foobar.com at port xyz. Oh, right. In that case, you'd write an MITM server. You could sneak a raspberry pi so that it goes ATM <-> RPI <-> ethernet, and then set up the RPI to broadcast all the network traffic via a wifi dongle to your laptop. But... certificate pinning would trivially subvert that. I guess ATM manufacturers might not have done any pentests though, so perhaps they don't do cert pinning. Assuming cert pinning, is there still a way?
- dylz 6y ago
  The kind of ATM I see at gas stations usually seem to involve a legacy ethernet cable of some sort (I've been told it's probably RJ12) and/or a small antenna magnet-mounted to the top of it. Not sure if they both serve the same communications purpose. The few times I've used one they also take a ridiculous amount of time to connect/return anything, on the order of 30s-1m.
  - 6y ago

hn_throwaway_99 6y ago

This was my exact question as well, and I wish the article did a better job answering it. There was a linked article that explained how it worked with physical access, i.e. popping the top of the ATM panel (it said the physical lock that keeps this down is like a "bathroom lock" and easily picked), and then there are USB or SIM card ports you can interface with. For the remote attacks, though, like the one where it said could result in many ATMs at the same time being hacked, I don't begin to understand where the attack vector starts.

jcrawfordor 6y ago
ATMs generally connect to a management system to retrieve configuration and report status. Like many back-end systems, these are often poorly designed and don't receive extensive security review. So if you can compromise one, there's an opportunity to potentially deliver a malicious configuration to a large number of machines at once. Similarly, there are several ways that attackers can find ATMs on the internet or telephone system in bulk. Although the situation has improved, ATMs historically had very poor authentication for remote management (some likely still do) which made them vulnerable to malicious reconfiguration over the internet or telephone modem.