I have about a year of industry knowledge working with ATMs. NCR and Diebold hold a huge portion of the North American ATM market and likely European too. All

I have about a year of industry knowledge working with ATMs. NCR and Diebold hold a huge portion of the North American ATM market and likely European too. All of the NCR and Diebold machines I worked on were running locked down Windows XP as of a couple of years ago. The PC hardware is fairly standard. Most of the peripherals like cash dispensers connect via USB to the PC in the ATM. I haven't had a chance to look at the exploit but I'd assume it didn't necessarily use auto-play. The OS images that are loaded on these machines are highly customized and would likely prevent auto-loading a usb driver. However, either it auto-loaded or they exploited some other USB bug in Windows. Once they could load code then they would have been able to manipulate the cash dispenser using an XFS app[0]. This would let them dispense bills from the safe to the customer facing throat. However, once the machine was restocked the bill counts would be off and the banks backend should detect the tampering. Based on the story it sounds like they were able to load code into the banking application to allow activating their hack from the pin pad. To me that seems to indicate either a former engineer of NCR/Diebold or someone who got their hands on a used ATM and spent a lot of time reverse engineering the application software and chassis. I've also made the assumption that this was done on a free-standing ATM[1]. Wall mount ATMs that you see at most banks are mostly behind the wall and would be extremely difficult to get access to a USB port. [0] http://en.wikipedia.org/wiki/CEN/XFS http://en.wikipedia.org/wiki/CEN/XFS [1] http://www.diebold.com/products-services/atm-self-service/terminals/full-function-cash-dispenser/Pages/522-lobby.aspx http://www.diebold.com/products-services/atm-self-service/te...