3 ms·

"once you have physical access to the internal electronics then the game is over" Common... Someone used an X-acto knife to plug in an USB stick on a PC config

"once you have physical access to the internal electronics then the game is over" Common... Someone used an X-acto knife to plug in an USB stick on a PC configured to auto-play it and we should take it as a proof that "physical access to the internal electronics then the game is over"? Companies like Brinks are using special sprays that renders bills unusable in case someone tries to break in the safes if I'm not mistaken. What about an ATM where any tentative of opening it to physically access the internal electronics would result in the ATM bricking and all the bills getting instantly sprayed as to render them unusable? What about spraying the bills and rendering them unusable in case the ATM is powered down and making it impossible to install new software without powering the machine down? (so that when you come with your new harddisk and access the internal to plug it in, you're SOL). This would even have the benefit of rendering attacks of the type: "I come with a truck and steal the part of the wall that contains the ATM" impractical (yes, people have done these). And where the only way to prevent that, for example during legitimate maintenance, would be to first enter a token generated by the ATM company and communicated to the (legit) employee doing the maintenance when he's working on the machine? I've never worked on ATMs and I'm sure it shows, but that's not the point. Honestly I find it quite sad that simply plugging in an USB stick allows to steal money from the machine. I find it also very sad that several people here consider that "nothing can be done against a rogue employee" or that "nothing can be done if you have physical access to the internal electronics". And I do honestly hope that people working on ATMs will start thinking about how to better secure their ATMs and which kind of trust systems can be put in place so that rogue employees (and other thieves) have a much harder time attacking ATMs. "It seems to me the failure was using materials that could be quickly breached and then patched." That is just one failure. The attacker exploited several holes and the answer from ATM companies should be more complex than just putting duct tape on one of the holes.

mmicn 13y ago
With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). But I do agree that when a machine is breached it should halt immediately. Having said that, financial institutions are not going to take this route for a variety of reasons, one of which is just general maintenance. If the case is breached, do you suspect that the intruders had access to everything? If so you want need to brick the entire device, to prevent any data from leaking back to the intruders. Your suggestion with regards to maintenance is indeed a valid one, but again the increase in cost is simply to big. Most financial institutions in my country and region (western europe) actually see ATM purely as a cost, and install them simply because they want customers to get a hold of their money. It is that simple. So why would they increase the costs? I think, and I don't want to start any flamewars or anything, that reconsidering the use of Windows in its current form is a valid route. If you were to start from an extremely limited & stripped down version sure, but not in the way companies are currently using it (for those that might wonder, yes full installs of windows happen all the time). Anyway, I'm glad this is in the open. The more people talk about it, the more things will change.
- lucaspiller 13y ago
  > With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). I used to work in a supermarket with the 'self service' checkouts. The cash dispenser internals looks to be exactly the same as that in basic ATMs [0]. Without going into too many details, in our case the security was minimal and there was no tamper proofing. If you really wanted to get inside it wouldn't have been particularly hard. ATMs may by different as they are slightly more portable than a checkout though :) [0] http://gadgets.boingboing.net/2009/05/11/this-picture-of-an-a.html http://gadgets.boingboing.net/2009/05/11/this-picture-of-an-...
  - wil421 13y ago
    Basic ATMs found in gas stations and liquor stores are different. All the ATMs in big banks have a safe at the bottom that houses the case made of 1/4 inch or so steel plates.

mmicn 13y ago

With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). But I do agree that when a machine is breached it should halt immediately. Having said that, financial institutions are not going to take this route for a variety of reasons, one of which is just general maintenance. If the case is breached, do you suspect that the intruders had access to everything? If so you want need to brick the entire device, to prevent any data from leaking back to the intruders. Your suggestion with regards to maintenance is indeed a valid one, but again the increase in cost is simply to big. Most financial institutions in my country and region (western europe) actually see ATM purely as a cost, and install them simply because they want customers to get a hold of their money. It is that simple. So why would they increase the costs? I think, and I don't want to start any flamewars or anything, that reconsidering the use of Windows in its current form is a valid route. If you were to start from an extremely limited & stripped down version sure, but not in the way companies are currently using it (for those that might wonder, yes full installs of windows happen all the time). Anyway, I'm glad this is in the open. The more people talk about it, the more things will change.

lucaspiller 13y ago
> With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). I used to work in a supermarket with the 'self service' checkouts. The cash dispenser internals looks to be exactly the same as that in basic ATMs [0]. Without going into too many details, in our case the security was minimal and there was no tamper proofing. If you really wanted to get inside it wouldn't have been particularly hard. ATMs may by different as they are slightly more portable than a checkout though :) [0] http://gadgets.boingboing.net/2009/05/11/this-picture-of-an-a.html http://gadgets.boingboing.net/2009/05/11/this-picture-of-an-...
- wil421 13y ago
  Basic ATMs found in gas stations and liquor stores are different. All the ATMs in big banks have a safe at the bottom that houses the case made of 1/4 inch or so steel plates.