4 ms·

Still, though, what sort of data lines do ATMs use? Ethernet? If so, how would you exploit it? It seems like the ATM's software might work like this: on bootup

Still, though, what sort of data lines do ATMs use? Ethernet? If so, how would you exploit it? It seems like the ATM's software might work like this: on bootup, connect to server atm.foobar.com at port xyz. Oh, right. In that case, you'd write an MITM server. You could sneak a raspberry pi so that it goes ATM <-> RPI <-> ethernet, and then set up the RPI to broadcast all the network traffic via a wifi dongle to your laptop. But... certificate pinning would trivially subvert that. I guess ATM manufacturers might not have done any pentests though, so perhaps they don't do cert pinning. Assuming cert pinning, is there still a way?

dylz 6y ago
The kind of ATM I see at gas stations usually seem to involve a legacy ethernet cable of some sort (I've been told it's probably RJ12) and/or a small antenna magnet-mounted to the top of it. Not sure if they both serve the same communications purpose. The few times I've used one they also take a ridiculous amount of time to connect/return anything, on the order of 30s-1m.
- jedberg 6y ago
  Depending on the age it's either a Cat-3 cable or just a telephone cable in a round shield. It could also just be a serial cable.
- bradtheappguy 6y ago
  This comment makes me feel old. The 2/3 sized cat5 jack is actually an RJ11 - what we used to call a 'phone jack'
  - kfarr 6y ago
    Lol yeah "legacy ethernet cable" cracked me up, it's a phone jack :)
  - ProZsolt 6y ago
    RJ12 is a thing: https://en.wikipedia.org/wiki/Registered_jack#RJ12 https://en.wikipedia.org/wiki/Registered_jack#RJ12 The jacks official name for the jack is Modular connector[1]. 6P6C for RJ14, 6P2C for RJ11 and 8P8C for RJ45 (what you described as cat5 jack) [1]:https://en.wikipedia.org/wiki/Modular_connector https://en.wikipedia.org/wiki/Modular_connector
- ericbarrett 6y ago
  Many of these even now remain on dial-up, so they just have a modem and the cable is a phone jack. If you have a favorite bodega ATM that always takes 15 seconds to respond after you type your PIN, it's probably dialing. Newer ATMs almost certainly use wireless modems, if they aren't just connected to the Internet. Fun fact, the modems still negotiate at 2400 or 9600 baud, because the extended negotiation times of higher-speed protocols more than negate time saved in transferring the small payload. They even make gateways to bridge old dial-up ATMs to IP: https://atmpartmart.com/wireless-atm-modems/systech-box-ipg-7010-atm-modem https://atmpartmart.com/wireless-atm-modems/systech-box-ipg-...
synhare 6y ago
The number of times I've heard people in the tech community mention certificate pinning as a valuable security mechanism is like the amount of times I've heard about zombies, despite the fact that they just don't exist. I've worked on a team that reverse engineered and did security audits on a lot of commercial and consumer applications. We've seen cert pinning implemented correctly was maybe like once or twice a year by companies large enough to where their security team was larger than most software companies entire payroll. Basically, it's not a thing that exist because it is really hard to implement properly. The threat model for being MITM'ed with cert spoofing is pretty exotic. In the end, cert pinning means your application is not working if something goes wrong with the certs, which EVERYONE at some point forgets to renew, or, worse, you CA inadvertently gets hosed.
- AlexCoventry 6y ago
  What's it take, to implement it correctly? What are the most common implementation mistakes?
  - codebeaker 6y ago
    Would love some pointers too, I've run into it once implement in a way j could t circumvent and was blown away. I'd love to develop the skills to do the same myself.
ZeroSync 6y ago
For remote attacks what usually happens is the malicious actor will first get access to a banks network and from there pivot to the ATMs. Often times they have some remote tool to shoot off commands and so forth. The malware itself is rather basic and easy to understand-the security layer once remotely accessed is rather moot. Depending on the malware strain they can than program the ATM to be “cashed out” during certain time or even if certain cards will be inserted.

dylz 6y ago

The kind of ATM I see at gas stations usually seem to involve a legacy ethernet cable of some sort (I've been told it's probably RJ12) and/or a small antenna magnet-mounted to the top of it. Not sure if they both serve the same communications purpose. The few times I've used one they also take a ridiculous amount of time to connect/return anything, on the order of 30s-1m.

jedberg 6y ago
Depending on the age it's either a Cat-3 cable or just a telephone cable in a round shield. It could also just be a serial cable.
bradtheappguy 6y ago
This comment makes me feel old. The 2/3 sized cat5 jack is actually an RJ11 - what we used to call a 'phone jack'
- kfarr 6y ago
  Lol yeah "legacy ethernet cable" cracked me up, it's a phone jack :)
- ProZsolt 6y ago
  RJ12 is a thing: https://en.wikipedia.org/wiki/Registered_jack#RJ12 https://en.wikipedia.org/wiki/Registered_jack#RJ12 The jacks official name for the jack is Modular connector[1]. 6P6C for RJ14, 6P2C for RJ11 and 8P8C for RJ45 (what you described as cat5 jack) [1]:https://en.wikipedia.org/wiki/Modular_connector https://en.wikipedia.org/wiki/Modular_connector
ericbarrett 6y ago
Many of these even now remain on dial-up, so they just have a modem and the cable is a phone jack. If you have a favorite bodega ATM that always takes 15 seconds to respond after you type your PIN, it's probably dialing. Newer ATMs almost certainly use wireless modems, if they aren't just connected to the Internet. Fun fact, the modems still negotiate at 2400 or 9600 baud, because the extended negotiation times of higher-speed protocols more than negate time saved in transferring the small payload. They even make gateways to bridge old dial-up ATMs to IP: https://atmpartmart.com/wireless-atm-modems/systech-box-ipg-7010-atm-modem https://atmpartmart.com/wireless-atm-modems/systech-box-ipg-...

synhare 6y ago

The number of times I've heard people in the tech community mention certificate pinning as a valuable security mechanism is like the amount of times I've heard about zombies, despite the fact that they just don't exist. I've worked on a team that reverse engineered and did security audits on a lot of commercial and consumer applications. We've seen cert pinning implemented correctly was maybe like once or twice a year by companies large enough to where their security team was larger than most software companies entire payroll. Basically, it's not a thing that exist because it is really hard to implement properly. The threat model for being MITM'ed with cert spoofing is pretty exotic. In the end, cert pinning means your application is not working if something goes wrong with the certs, which EVERYONE at some point forgets to renew, or, worse, you CA inadvertently gets hosed.

AlexCoventry 6y ago
What's it take, to implement it correctly? What are the most common implementation mistakes?
- codebeaker 6y ago
  Would love some pointers too, I've run into it once implement in a way j could t circumvent and was blown away. I'd love to develop the skills to do the same myself.

ZeroSync 6y ago

For remote attacks what usually happens is the malicious actor will first get access to a banks network and from there pivot to the ATMs. Often times they have some remote tool to shoot off commands and so forth. The malware itself is rather basic and easy to understand-the security layer once remotely accessed is rather moot. Depending on the malware strain they can than program the ATM to be “cashed out” during certain time or even if certain cards will be inserted.