This is surprisingly easy. Look for the defcon talk "atm jackpotting". The summary is there there are only a few vendors of ATMs and ATM software. They often h

This is surprisingly easy. Look for the defcon talk "atm jackpotting". The summary is there there are only a few vendors of ATMs and ATM software. They often have a tubular lock with a small number of lock combinations. You open it, and there's the main board. USB (some with auto-play still enabled), CF card (main storage), everything. Plug in what you want. Some insist on code-signing of the CF card to boot, but it can be bypassed. Often they are exposed to the internet, and as of the talk at least one vendor had a pre-login vulnerability to an internet-exposed port (which the speaker reported, so that particular one is probably fixed now, but goodness knows if the sites in the real world are patched). Once you have your code running, it's game over. Open the cash drawer, record stripe data (and phone it to yourself whenever you like), rootkit the device to make yourself undetectable. He bought several ATMs of the most popular model to experiment, right off the internet, some from the vendors themselves. Nobody questioned him. Watch the talk, it was great.