6 ms·

So a lot of things clearly came together here: 1. The attackers knew there was a USB port on these devices that would auto-play, or at least trigger the auto-p

So a lot of things clearly came together here: 1. The attackers knew there was a USB port on these devices that would auto-play, or at least trigger the auto-play dialog. 2. The attackers knew all of the software internals of the machines before they started. You don't just write code that works with any old ATM software. 3. The article stated that 'the organisers displayed "profound knowledge of the target ATMs"'. "Profound knowledge" seems to be an understatement. That's the kind of knowledge that you get when you work for a company that designs and builds ATMs. Really, I don't see this as anything more than something to chuckle at. It's like if a restaurant was robbed by someone that knew the code for the back door and that a spare key to the safe was taped to the underside of the desk in the back room. If you know what you're doing, of course you can break in.

lotsofcows 13y ago
"That's the kind of knowledge that you get when you work for a company that designs and builds ATMs." Or you just buy your own: http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_from=R40&_nkw=atm http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_f...
- walshemj 13y ago
  Just ban civilian ownership of ATM's make them like Machine Guns and require end user certificates for sale.
  - PeterWhittaker 13y ago
    So ATMs would enter the same class as the Kinder Surprise treat, at least in the US? :->, of course. EDIT: Originally tried to raise a smiley to the Nth degree, but HN appears to dislike consecutive asterisks and kept munging them to nothingness.
    - scott_s 13y ago
      Text surrounded by asterisks becomes italicized.
      - PeterWhittaker 13y ago
        Oh, yeah. And the first character after the first * wasn't whitespace, it was another *, so HN ate them both and inserted an italicized zero length string.
  - StavrosK 13y ago
    Or put the USB port on the other end.
  - badman_ting 13y ago
    Or, do not do that.
    - walshemj 13y ago
      Why not its always private atm's (you know the ones with ripoff charges) at mom and pop stores that seem to be the ones getting hacked not ones embedded in the walls of a bank. Making ATM's only available to organizations with a full banking license might help and some body define proper security standards Bruce Schenier's looking for a new job maybe he might want to take this on?
      - DerpDerpDerp 13y ago
        I find it much more likely they'd skimp on hardening, the bad guys would still find ways to get them but white hats would have an extremely hard time working on the problem, and we'd be in an even worse situation. Sort of like the problems we have right now with locks.
        walshemj 13y ago
        Well skimp on the hardening and the regulator shuts your atm network down - only have to do it the once.
walshemj 13y ago
So why in the name of "bruce" was an ATM ever shipped with a USB port in the firstplace. The firmware update process should be locked down. what needs to happen is that all the executives of the ATM company and the bank concerned (going back 15 years or so) need to be banned for life from ever being directors and b from ever working in the finance industry
- bronson 13y ago
  USB port or no, once you have physical access to the internal electronics then the game is over. It seems to me the failure was using materials that could be quickly breached and then patched. Do you have unique experience to justify up your vitriol?
  - TacticalCoder 13y ago
    "once you have physical access to the internal electronics then the game is over" Common... Someone used an X-acto knife to plug in an USB stick on a PC configured to auto-play it and we should take it as a proof that "physical access to the internal electronics then the game is over"? Companies like Brinks are using special sprays that renders bills unusable in case someone tries to break in the safes if I'm not mistaken. What about an ATM where any tentative of opening it to physically access the internal electronics would result in the ATM bricking and all the bills getting instantly sprayed as to render them unusable? What about spraying the bills and rendering them unusable in case the ATM is powered down and making it impossible to install new software without powering the machine down? (so that when you come with your new harddisk and access the internal to plug it in, you're SOL). This would even have the benefit of rendering attacks of the type: "I come with a truck and steal the part of the wall that contains the ATM" impractical (yes, people have done these). And where the only way to prevent that, for example during legitimate maintenance, would be to first enter a token generated by the ATM company and communicated to the (legit) employee doing the maintenance when he's working on the machine? I've never worked on ATMs and I'm sure it shows, but that's not the point. Honestly I find it quite sad that simply plugging in an USB stick allows to steal money from the machine. I find it also very sad that several people here consider that "nothing can be done against a rogue employee" or that "nothing can be done if you have physical access to the internal electronics". And I do honestly hope that people working on ATMs will start thinking about how to better secure their ATMs and which kind of trust systems can be put in place so that rogue employees (and other thieves) have a much harder time attacking ATMs. "It seems to me the failure was using materials that could be quickly breached and then patched." That is just one failure. The attacker exploited several holes and the answer from ATM companies should be more complex than just putting duct tape on one of the holes.
jmj42 13y ago
Autoplay isn't required for these kinds of attacks. I'll confess that I did not watch the actual talk (linked elsewhere), so I don't know if that route was used in this case. I do know, however, that autoplay is not actually required. Here's a video of a demonstration given back in November of a system (Crossing Guard) being developed at Dartmouth (under the Trustworthy Cyber Infrastructure for the Power Grid). The attack takes advantage of lower level USB operation and does not rely on autoplay. http://youtu.be/NIlmDpUDudo http://youtu.be/NIlmDpUDudo [Edit: missing 'not']
- taejo 13y ago
  The attack in the video, AIUI, doesn't use autoplay: they plug the USB drive in and then restart the machine so it boots off the drive.
viraptor 13y ago
1. You can find both pictures of the machines and the ATMs themselves on the internet. 2. Most likely it's (and old) windows. You don't need to write special code for any old ATM software. They could even just use autoplay once to test the grounds and copy anything they could back to the USB for analysis. 3. Ok, I'm not saying the profound knowledge / inside job was not involved... but people have done much more crazy and advanced attacks on black boxes with next to no knowledge. Once they knew they have access to software inside with auto-play they could do anything. Even connect the box to wifi via usb and do everything else remotely.
mikeash 13y ago
The point is that ATMs shouldn't be proverbially taping the proverbial spare key to the underside of the proverbial desk. A well-designed system can withstand the attacker knowing all of its details aside from the secret key chosen by the owner. That's the whole point of avoiding "security through obscurity".

lotsofcows 13y ago

"That's the kind of knowledge that you get when you work for a company that designs and builds ATMs." Or you just buy your own: http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_from=R40&_nkw=atm http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_f...

walshemj 13y ago
Just ban civilian ownership of ATM's make them like Machine Guns and require end user certificates for sale.
- PeterWhittaker 13y ago
  So ATMs would enter the same class as the Kinder Surprise treat, at least in the US? :->, of course. EDIT: Originally tried to raise a smiley to the Nth degree, but HN appears to dislike consecutive asterisks and kept munging them to nothingness.
  - scott_s 13y ago
    Text surrounded by asterisks becomes italicized.
    - PeterWhittaker 13y ago
      Oh, yeah. And the first character after the first * wasn't whitespace, it was another *, so HN ate them both and inserted an italicized zero length string.
- StavrosK 13y ago
  Or put the USB port on the other end.
- badman_ting 13y ago
  Or, do not do that.
  - walshemj 13y ago
    Why not its always private atm's (you know the ones with ripoff charges) at mom and pop stores that seem to be the ones getting hacked not ones embedded in the walls of a bank. Making ATM's only available to organizations with a full banking license might help and some body define proper security standards Bruce Schenier's looking for a new job maybe he might want to take this on?
    - DerpDerpDerp 13y ago
      I find it much more likely they'd skimp on hardening, the bad guys would still find ways to get them but white hats would have an extremely hard time working on the problem, and we'd be in an even worse situation. Sort of like the problems we have right now with locks.
      - walshemj 13y ago
        Well skimp on the hardening and the regulator shuts your atm network down - only have to do it the once.

walshemj 13y ago

So why in the name of "bruce" was an ATM ever shipped with a USB port in the firstplace. The firmware update process should be locked down. what needs to happen is that all the executives of the ATM company and the bank concerned (going back 15 years or so) need to be banned for life from ever being directors and b from ever working in the finance industry

bronson 13y ago
USB port or no, once you have physical access to the internal electronics then the game is over. It seems to me the failure was using materials that could be quickly breached and then patched. Do you have unique experience to justify up your vitriol?
- TacticalCoder 13y ago
  "once you have physical access to the internal electronics then the game is over" Common... Someone used an X-acto knife to plug in an USB stick on a PC configured to auto-play it and we should take it as a proof that "physical access to the internal electronics then the game is over"? Companies like Brinks are using special sprays that renders bills unusable in case someone tries to break in the safes if I'm not mistaken. What about an ATM where any tentative of opening it to physically access the internal electronics would result in the ATM bricking and all the bills getting instantly sprayed as to render them unusable? What about spraying the bills and rendering them unusable in case the ATM is powered down and making it impossible to install new software without powering the machine down? (so that when you come with your new harddisk and access the internal to plug it in, you're SOL). This would even have the benefit of rendering attacks of the type: "I come with a truck and steal the part of the wall that contains the ATM" impractical (yes, people have done these). And where the only way to prevent that, for example during legitimate maintenance, would be to first enter a token generated by the ATM company and communicated to the (legit) employee doing the maintenance when he's working on the machine? I've never worked on ATMs and I'm sure it shows, but that's not the point. Honestly I find it quite sad that simply plugging in an USB stick allows to steal money from the machine. I find it also very sad that several people here consider that "nothing can be done against a rogue employee" or that "nothing can be done if you have physical access to the internal electronics". And I do honestly hope that people working on ATMs will start thinking about how to better secure their ATMs and which kind of trust systems can be put in place so that rogue employees (and other thieves) have a much harder time attacking ATMs. "It seems to me the failure was using materials that could be quickly breached and then patched." That is just one failure. The attacker exploited several holes and the answer from ATM companies should be more complex than just putting duct tape on one of the holes.

jmj42 13y ago

Autoplay isn't required for these kinds of attacks. I'll confess that I did not watch the actual talk (linked elsewhere), so I don't know if that route was used in this case. I do know, however, that autoplay is not actually required. Here's a video of a demonstration given back in November of a system (Crossing Guard) being developed at Dartmouth (under the Trustworthy Cyber Infrastructure for the Power Grid). The attack takes advantage of lower level USB operation and does not rely on autoplay. http://youtu.be/NIlmDpUDudo http://youtu.be/NIlmDpUDudo [Edit: missing 'not']

taejo 13y ago
The attack in the video, AIUI, doesn't use autoplay: they plug the USB drive in and then restart the machine so it boots off the drive.

viraptor 13y ago

1. You can find both pictures of the machines and the ATMs themselves on the internet. 2. Most likely it's (and old) windows. You don't need to write special code for any old ATM software. They could even just use autoplay once to test the grounds and copy anything they could back to the USB for analysis. 3. Ok, I'm not saying the profound knowledge / inside job was not involved... but people have done much more crazy and advanced attacks on black boxes with next to no knowledge. Once they knew they have access to software inside with auto-play they could do anything. Even connect the box to wifi via usb and do everything else remotely.

mikeash 13y ago

The point is that ATMs shouldn't be proverbially taping the proverbial spare key to the underside of the proverbial desk. A well-designed system can withstand the attacker knowing all of its details aside from the secret key chosen by the owner. That's the whole point of avoiding "security through obscurity".