Yeah, and it would be even safer of the entire functionality of the ATM were implemented as an ASIC. Except that's completely impractical. My point is that a s

Yeah, and it would be even safer of the entire functionality of the ATM were implemented as an ASIC. Except that's completely impractical. My point is that a system's resilence against manipulation is not all that important if the way it is operated affords little or no opportunity for manipulation. Note that the trojan described in the article apparently requires a criminal to be physically present at the machine to harvest the collected information and says nothing about how the machine would get infected. Remote infection (which is impossible for a normally operated ATM) wouldn't be much use when profiting from it requires physical access, so I infection probably also requires physical access to the inside of the machine. That's a worst case security scenario anyway.