9 ms·

Cash machines robbed with infected USB sticks

97 points by joosters 13y ago

deleted 13y ago
[deleted]
jsundquist 13y ago
I notice at the end of the article it says a filename was hack.bat. Looks like they are windows based machines. Wonder if they left auto-play running on them?
- mmicn 13y ago
  from experience (I was a security assessment professional and I have looked at multiple of these ATM machines in the past from a hackers point of view), these machines are almost always windows XP SP3 or the newer once are running windows 7. A number of usb devices are added like the pinpad, keyboard, printer, smartcard reader, cash dispenser, ... Next the entire thing is managed using XFS. (http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WSXFS.aspx http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WS...) So even tho it might appear the researcher had a large amount of knowledge, this is not so uncommon.
- marcosdumay 13y ago
  That's also in the article, they left auto-play running. I'd bet they use standard PC motherboards. The only unusual things the thiefs knew where where to open the hole, and how to use the cash dispenser (altough, I'm quite sure one'd be able to get the entire dispenser documentation from Google). Knowing that they are Windows machines, why don't people attack the ATMs by the network?
  - loupgarou21 13y ago
    I'm vaguely surprised they bothered to cut a hole to do this. When I was working on ATMs, none of my clients ever bothered to have they ATMs uniquely keyed. I had a keyring of about 30 keys that could open pretty much any ATM I came across.
  - wil421 13y ago
    Most ATMs are in running on Windows 7 with PC hardware. The hardware is probably custom made but still very similar to what you would find in a desktop. As far the network, you cant access ATMs from the Internet at least in the US. Most of the providers have leased lines to a central server somewhere and then leased lines to whatever 3rd parties they talk to. US banks arent too crazy on letting people remotely service ATMs that are having software problems.
bliker 13y ago
this reminds me of this ATM hacking talk at DEFCON https://www.youtube.com/watch?v=w1KfSSDh3gU https://www.youtube.com/watch?v=w1KfSSDh3gU pretty much an exact description of the attack with nice demo.
bastawhiz 13y ago
So a lot of things clearly came together here: 1. The attackers knew there was a USB port on these devices that would auto-play, or at least trigger the auto-play dialog. 2. The attackers knew all of the software internals of the machines before they started. You don't just write code that works with any old ATM software. 3. The article stated that 'the organisers displayed "profound knowledge of the target ATMs"'. "Profound knowledge" seems to be an understatement. That's the kind of knowledge that you get when you work for a company that designs and builds ATMs. Really, I don't see this as anything more than something to chuckle at. It's like if a restaurant was robbed by someone that knew the code for the back door and that a spare key to the safe was taped to the underside of the desk in the back room. If you know what you're doing, of course you can break in.
- lotsofcows 13y ago
  "That's the kind of knowledge that you get when you work for a company that designs and builds ATMs." Or you just buy your own: http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_from=R40&_nkw=atm http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_f...
  - walshemj 13y ago
    Just ban civilian ownership of ATM's make them like Machine Guns and require end user certificates for sale.
    - PeterWhittaker 13y ago
      So ATMs would enter the same class as the Kinder Surprise treat, at least in the US? :->, of course. EDIT: Originally tried to raise a smiley to the Nth degree, but HN appears to dislike consecutive asterisks and kept munging them to nothingness.
      - scott_s 13y ago
        Text surrounded by asterisks becomes italicized.
rhblake 13y ago
The actual talk, "Electronic Bank Robberies - Stealing Money from ATMs with Malware", from 30C3 a few days ago: http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_saal_2_-_201312271600_-_electronic_bank_robberies_-_tw_-_sb.html http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_...
peterwwillis 13y ago
For what it's worth, there's a fair number of Windows-based ATMs in the US and around the globe. You can find articles as old as 2003 about exploiting Windows-based ATMs. My favorite was the machine that had a Paint program enabled by an intrepid hacker. Every year without fail the ATMs of the hotels surrounding DEFCON get owned multiple times, sometimes advertising it. ("Dumb" ATMs are often much easier to attack using default passwords, but harder to install malware on) https://www.informationweek.com/mobile/banks-struggle-to-get-atms-off-windows-xp/d/d-id/1110965 https://www.informationweek.com/mobile/banks-struggle-to-get... http://www.engadget.com/2007/02/25/windows-based-atm-machine-hacked-gets-painted/ http://www.engadget.com/2007/02/25/windows-based-atm-machine...
- mmicn 13y ago
  Depends on what you mean by "harder to install malware on". Most of these machines are regular Windows, and inherit the default risk associated with such machines. The only difference is that some might have better hardening.
  - BuildTheRobots 13y ago
    > Most of these machines are regular Windows What's "Regular" Windows" when it's at home? The couple of ATMs I managed to see the inside of were either running WinCE or OS/2.
    - mmicn 13y ago
      The windows CE and OS/2 are getting rare. those I have tested all had win XP and win 7. (I have tested nearly every major financial institution in my country)
      - thrownaway2424 13y ago
        Whenever I come across a green-screen ATM running decent old software I practically leap for joy. Why? I can get my money in 5 seconds. The new ones, that I guess are running Flash on top of MSIE on top of WinXP, are unbelievably slow.
tony_mono 13y ago
I have about a year of industry knowledge working with ATMs. NCR and Diebold hold a huge portion of the North American ATM market and likely European too. All of the NCR and Diebold machines I worked on were running locked down Windows XP as of a couple of years ago. The PC hardware is fairly standard. Most of the peripherals like cash dispensers connect via USB to the PC in the ATM. I haven't had a chance to look at the exploit but I'd assume it didn't necessarily use auto-play. The OS images that are loaded on these machines are highly customized and would likely prevent auto-loading a usb driver. However, either it auto-loaded or they exploited some other USB bug in Windows. Once they could load code then they would have been able to manipulate the cash dispenser using an XFS app[0]. This would let them dispense bills from the safe to the customer facing throat. However, once the machine was restocked the bill counts would be off and the banks backend should detect the tampering. Based on the story it sounds like they were able to load code into the banking application to allow activating their hack from the pin pad. To me that seems to indicate either a former engineer of NCR/Diebold or someone who got their hands on a used ATM and spent a lot of time reverse engineering the application software and chassis. I've also made the assumption that this was done on a free-standing ATM[1]. Wall mount ATMs that you see at most banks are mostly behind the wall and would be extremely difficult to get access to a USB port. [0] http://en.wikipedia.org/wiki/CEN/XFS http://en.wikipedia.org/wiki/CEN/XFS [1] http://www.diebold.com/products-services/atm-self-service/terminals/full-function-cash-dispenser/Pages/522-lobby.aspx http://www.diebold.com/products-services/atm-self-service/te...
- mattchamb 13y ago
  I also have a little bit of (indirect) experience with software dev for ATMs, although it was in south east Asia. They were running Windows XP, and once you opened up the case you could just plug in a keyboard and mouse. From what I remember, don't want to be specific for obvious reasons, the screens in the ATM program are defined by a configuration file which is distributed from a central server. If you could intercept or modify that configuration, then you could get the atm to show whatever you want without having to reverse engineer the whole software.
- tekromancr 13y ago
  Do the NCR ATMs dispense bottle caps?
ketralnis 13y ago
This is surprisingly easy. Look for the defcon talk "atm jackpotting". The summary is there there are only a few vendors of ATMs and ATM software. They often have a tubular lock with a small number of lock combinations. You open it, and there's the main board. USB (some with auto-play still enabled), CF card (main storage), everything. Plug in what you want. Some insist on code-signing of the CF card to boot, but it can be bypassed. Often they are exposed to the internet, and as of the talk at least one vendor had a pre-login vulnerability to an internet-exposed port (which the speaker reported, so that particular one is probably fixed now, but goodness knows if the sites in the real world are patched). Once you have your code running, it's game over. Open the cash drawer, record stripe data (and phone it to yourself whenever you like), rootkit the device to make yourself undetectable. He bought several ATMs of the most popular model to experiment, right off the internet, some from the vendors themselves. Nobody questioned him. Watch the talk, it was great.
- rodrodrod 13y ago
  Link to the talk, for convenience: http://youtu.be/Ss_RWctTARU http://youtu.be/Ss_RWctTARU Fun watch indeed!
- SeparateWolf 13y ago
  Whatever happened to Barnaby Jack? I know he was found dead in his SF apartment sometime after this DefCon talk. Port 18456 is the port BTW. If you do a masscan sweep you'll find a ton of them facing the internet..... I don't think he ever released his exploit or scrooge rootkit.
  - coldtea 13y ago
    Hmm, just read on this Jack guy. What was that thing? He was 35 years old and wasn't sick or obese. Now, for people who believe the generally good nature of states (and/or Santa) this might not even raise an eyebrow, but for people who have read their history, well...
deleted 13y ago
[deleted]
mariusz79 13y ago
First things first: USB sticks were not infected. They were just a tool used to infect.. It's like saying that the needle was infected.
RRRA 13y ago
The sad part is that BBC takes this random fact and completely missed the important ones about the more massive problem that the NSA and complacent / blackmailed government represent...
knodi 13y ago
Please stop all auto-run options.

97 points by joosters 13y ago

deleted 13y ago

[deleted]

I notice at the end of the article it says a filename was hack.bat. Looks like they are windows based machines. Wonder if they left auto-play running on them?

mmicn 13y ago
from experience (I was a security assessment professional and I have looked at multiple of these ATM machines in the past from a hackers point of view), these machines are almost always windows XP SP3 or the newer once are running windows 7. A number of usb devices are added like the pinpad, keyboard, printer, smartcard reader, cash dispenser, ... Next the entire thing is managed using XFS. (http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WSXFS.aspx http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WS...) So even tho it might appear the researcher had a large amount of knowledge, this is not so uncommon.
marcosdumay 13y ago
That's also in the article, they left auto-play running. I'd bet they use standard PC motherboards. The only unusual things the thiefs knew where where to open the hole, and how to use the cash dispenser (altough, I'm quite sure one'd be able to get the entire dispenser documentation from Google). Knowing that they are Windows machines, why don't people attack the ATMs by the network?
- loupgarou21 13y ago
  I'm vaguely surprised they bothered to cut a hole to do this. When I was working on ATMs, none of my clients ever bothered to have they ATMs uniquely keyed. I had a keyring of about 30 keys that could open pretty much any ATM I came across.
- wil421 13y ago
  Most ATMs are in running on Windows 7 with PC hardware. The hardware is probably custom made but still very similar to what you would find in a desktop. As far the network, you cant access ATMs from the Internet at least in the US. Most of the providers have leased lines to a central server somewhere and then leased lines to whatever 3rd parties they talk to. US banks arent too crazy on letting people remotely service ATMs that are having software problems.

bliker 13y ago

this reminds me of this ATM hacking talk at DEFCON https://www.youtube.com/watch?v=w1KfSSDh3gU https://www.youtube.com/watch?v=w1KfSSDh3gU pretty much an exact description of the attack with nice demo.

bastawhiz 13y ago

So a lot of things clearly came together here: 1. The attackers knew there was a USB port on these devices that would auto-play, or at least trigger the auto-play dialog. 2. The attackers knew all of the software internals of the machines before they started. You don't just write code that works with any old ATM software. 3. The article stated that 'the organisers displayed "profound knowledge of the target ATMs"'. "Profound knowledge" seems to be an understatement. That's the kind of knowledge that you get when you work for a company that designs and builds ATMs. Really, I don't see this as anything more than something to chuckle at. It's like if a restaurant was robbed by someone that knew the code for the back door and that a spare key to the safe was taped to the underside of the desk in the back room. If you know what you're doing, of course you can break in.

lotsofcows 13y ago
"That's the kind of knowledge that you get when you work for a company that designs and builds ATMs." Or you just buy your own: http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_from=R40&_nkw=atm http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_f...
- walshemj 13y ago
  Just ban civilian ownership of ATM's make them like Machine Guns and require end user certificates for sale.
  - PeterWhittaker 13y ago
    So ATMs would enter the same class as the Kinder Surprise treat, at least in the US? :->, of course. EDIT: Originally tried to raise a smiley to the Nth degree, but HN appears to dislike consecutive asterisks and kept munging them to nothingness.
    - scott_s 13y ago
      Text surrounded by asterisks becomes italicized.

rhblake 13y ago

The actual talk, "Electronic Bank Robberies - Stealing Money from ATMs with Malware", from 30C3 a few days ago: http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_saal_2_-_201312271600_-_electronic_bank_robberies_-_tw_-_sb.html http://media.ccc.de/browse/congress/2013/30C3_-_5476_-_en_-_...

peterwwillis 13y ago

For what it's worth, there's a fair number of Windows-based ATMs in the US and around the globe. You can find articles as old as 2003 about exploiting Windows-based ATMs. My favorite was the machine that had a Paint program enabled by an intrepid hacker. Every year without fail the ATMs of the hotels surrounding DEFCON get owned multiple times, sometimes advertising it. ("Dumb" ATMs are often much easier to attack using default passwords, but harder to install malware on) https://www.informationweek.com/mobile/banks-struggle-to-get-atms-off-windows-xp/d/d-id/1110965 https://www.informationweek.com/mobile/banks-struggle-to-get... http://www.engadget.com/2007/02/25/windows-based-atm-machine-hacked-gets-painted/ http://www.engadget.com/2007/02/25/windows-based-atm-machine...

mmicn 13y ago
Depends on what you mean by "harder to install malware on". Most of these machines are regular Windows, and inherit the default risk associated with such machines. The only difference is that some might have better hardening.
- BuildTheRobots 13y ago
  > Most of these machines are regular Windows What's "Regular" Windows" when it's at home? The couple of ATMs I managed to see the inside of were either running WinCE or OS/2.
  - mmicn 13y ago
    The windows CE and OS/2 are getting rare. those I have tested all had win XP and win 7. (I have tested nearly every major financial institution in my country)
    - thrownaway2424 13y ago
      Whenever I come across a green-screen ATM running decent old software I practically leap for joy. Why? I can get my money in 5 seconds. The new ones, that I guess are running Flash on top of MSIE on top of WinXP, are unbelievably slow.

tony_mono 13y ago

I have about a year of industry knowledge working with ATMs. NCR and Diebold hold a huge portion of the North American ATM market and likely European too. All of the NCR and Diebold machines I worked on were running locked down Windows XP as of a couple of years ago. The PC hardware is fairly standard. Most of the peripherals like cash dispensers connect via USB to the PC in the ATM. I haven't had a chance to look at the exploit but I'd assume it didn't necessarily use auto-play. The OS images that are loaded on these machines are highly customized and would likely prevent auto-loading a usb driver. However, either it auto-loaded or they exploited some other USB bug in Windows. Once they could load code then they would have been able to manipulate the cash dispenser using an XFS app[0]. This would let them dispense bills from the safe to the customer facing throat. However, once the machine was restocked the bill counts would be off and the banks backend should detect the tampering. Based on the story it sounds like they were able to load code into the banking application to allow activating their hack from the pin pad. To me that seems to indicate either a former engineer of NCR/Diebold or someone who got their hands on a used ATM and spent a lot of time reverse engineering the application software and chassis. I've also made the assumption that this was done on a free-standing ATM[1]. Wall mount ATMs that you see at most banks are mostly behind the wall and would be extremely difficult to get access to a USB port. [0] http://en.wikipedia.org/wiki/CEN/XFS http://en.wikipedia.org/wiki/CEN/XFS [1] http://www.diebold.com/products-services/atm-self-service/terminals/full-function-cash-dispenser/Pages/522-lobby.aspx http://www.diebold.com/products-services/atm-self-service/te...

mattchamb 13y ago
I also have a little bit of (indirect) experience with software dev for ATMs, although it was in south east Asia. They were running Windows XP, and once you opened up the case you could just plug in a keyboard and mouse. From what I remember, don't want to be specific for obvious reasons, the screens in the ATM program are defined by a configuration file which is distributed from a central server. If you could intercept or modify that configuration, then you could get the atm to show whatever you want without having to reverse engineer the whole software.
tekromancr 13y ago
Do the NCR ATMs dispense bottle caps?

ketralnis 13y ago

This is surprisingly easy. Look for the defcon talk "atm jackpotting". The summary is there there are only a few vendors of ATMs and ATM software. They often have a tubular lock with a small number of lock combinations. You open it, and there's the main board. USB (some with auto-play still enabled), CF card (main storage), everything. Plug in what you want. Some insist on code-signing of the CF card to boot, but it can be bypassed. Often they are exposed to the internet, and as of the talk at least one vendor had a pre-login vulnerability to an internet-exposed port (which the speaker reported, so that particular one is probably fixed now, but goodness knows if the sites in the real world are patched). Once you have your code running, it's game over. Open the cash drawer, record stripe data (and phone it to yourself whenever you like), rootkit the device to make yourself undetectable. He bought several ATMs of the most popular model to experiment, right off the internet, some from the vendors themselves. Nobody questioned him. Watch the talk, it was great.

rodrodrod 13y ago
Link to the talk, for convenience: http://youtu.be/Ss_RWctTARU http://youtu.be/Ss_RWctTARU Fun watch indeed!
SeparateWolf 13y ago
Whatever happened to Barnaby Jack? I know he was found dead in his SF apartment sometime after this DefCon talk. Port 18456 is the port BTW. If you do a masscan sweep you'll find a ton of them facing the internet..... I don't think he ever released his exploit or scrooge rootkit.
- coldtea 13y ago
  Hmm, just read on this Jack guy. What was that thing? He was 35 years old and wasn't sick or obese. Now, for people who believe the generally good nature of states (and/or Santa) this might not even raise an eyebrow, but for people who have read their history, well...

deleted 13y ago

[deleted]

mariusz79 13y ago

First things first: USB sticks were not infected. They were just a tool used to infect.. It's like saying that the needle was infected.

RRRA 13y ago

The sad part is that BBC takes this random fact and completely missed the important ones about the more massive problem that the NSA and complacent / blackmailed government represent...

knodi 13y ago

Please stop all auto-run options.