Windows ATMs by 2005

Mo Money! Mo Money! Mo Money! by ChaoticChaos · 2003-09-19 02:41 · Score: 5, Funny

Holy cow! Can you say, "Free cash!"

Just stand in front of ATM the next time a worm rocks through and watch it start spitting out bills.

ROFL!!!!!!!!!!!!!!!!!

Re:Mo Money! Mo Money! Mo Money! by Bonker · 2003-09-19 02:55 · Score: 5, Interesting

Fortunately for the banking industry and unfortunately for you, most ATMs have built-in failsafes to keep that from happening.

If you completely disregard that most ATMs don't have built-in TCP/IP stacks-- even the ones that communicate via CDPD, or cellular to internet use a transmitter that works through a serial port and sends an encrypted stream of data to the processor-- Most ATMs are designed to go balls-up at the first sign of trouble and shut themselves down after sending detailed error messages to their owners via leased lines. Out of paper? Error message, shut down. Out of money? Error message, shut down. OS Crash? Error message, shut down. Damage to the ATM Case? Error message, shut down.

--
The next Slashdot story will be ready soon, but subscribers can beat the rush and slashdot the links early!
Re:Mo Money! Mo Money! Mo Money! by sphealey · 2003-09-19 03:03 · Score: 5, Insightful

f you completely disregard that most ATMs don't have built-in TCP/IP stacks-- even the ones that communicate via CDPD, or cellular to internet use a transmitter that works through a serial port and sends an encrypted stream of data to the processor-- Most ATMs are designed to go balls-up at the first sign of trouble and shut themselves down after sending detailed error messages to their owners via leased line
The problem being that once a commercial technology ("commercial off-the-shelf" or COTS in milspeak) starts to leak into a closed architecture application, it becomes almost impossible for manufactuers to resist the pressure to use all the features of the commercial technology to reduce cost.
If Vendor A makes an ATM that uses propriatary closed architecture and its units cost $125,000, while Vendor B uses Windows but its units cost $110,000, guess who is going to win the bids? So Vendor A goes to Windows + TCP/IP and gets down to $100,000/unit. Vendor B then responds with Windows + TCP/IP + "Internet connection to eliminate costly leased line charges". Guess who will win that bid? And there we are - the security of a closed system gone in three rounds of bidding.
Now perhaps that example is bad, because there might be regulations in the financial industry to prevent it. And such regulations might even be enforced. But then again, if Enron or Dick Cheney had bought a large ATM network...
sPh
Re:Mo Money! Mo Money! Mo Money! by Reylas · 2003-09-19 03:04 · Score: 5, Informative

Sorry, but you obviously do not work in banking as a lot of new ATM's do have a TCPIP stack on them. That was the big push from finance institutions in order to play along with current network configurations. I am looking at a diebold ATM right now that is based on TCPIP.

Reylas
Re:Mo Money! Mo Money! Mo Money! by MarkusQ · 2003-09-19 03:26 · Score: 4, Insightful

OS Crash? Error message, shut down.
There's a level problem there. The problem with OS crashes is the application doesn't get a chance to decide what to do, and even if it did generally wouldn't have the wherewithall to do anything useful. Even impending power failure is easier to catch.
-- MarkusQ
Re:Mo Money! Mo Money! Mo Money! by spruce · 2003-09-19 03:28 · Score: 5, Insightful

You're forgetting that there are actaully some smart people in the banking industry that will realize that having your ATM's running windows hooked up to the internet is a bad idea. The people that make these kinds of decisions are not fools.
Re:Mo Money! Mo Money! Mo Money! by sphealey · 2003-09-19 03:37 · Score: 5, Informative

You're forgetting that there are actaully some smart people in the banking industry that will realize that having your ATM's running windows hooked up to the internet is a bad idea. The people that make these kinds of decisions are not fools.
I would have said the same thing about the electric utility and railroad industries, as both have over 120 years of experience handling dangerous large-scale technology. And yet CSX operations were seriously affected by the MSBlaster worm, and there are some indications that the latest East Coast blackout may have been triggered by attacks on COTS-based systems (the CSX incident is confirmed; the First Energy incident is {so far} rumour).
I have seen the pressure to go COTS first-hand myself in an application where it really wasn't a good engineering decision. But the price and functionality of the COTS system exerted tremendous pressure on the selection process.
And again, Enron was a financial services company, as were the New York investement houses that served it, but that didn't make them immune from doing stupid things.
sPh
Re:Mo Money! Mo Money! Mo Money! by 1g$man · 2003-09-19 03:41 · Score: 4, Informative

They already run off the shelf software and have for quite some time. At least one major national bank runs NT on their ATMs, while most other ATMs in the country run OS/2.
Re:Mo Money! Mo Money! Mo Money! by tetra103 · 2003-09-19 04:28 · Score: 5, Interesting

The banking industry is one where cutting corners simply isn't allowed.

You'ld be surprized at just how cheap banks and money institutions can be. Although it wasn't a bank, I once worked for the largest government bonds firm as a sysadmin. Their clients were banks themselves. Bonds were traded in lots of 10 million and in one day you'ld get serveral thousands of transactions. I was amazed at just how much money use to flow through the systems I was running. As a brokerage firm, they made their commision with a few pennies on every transaction. They were making tons of cash daily. Money was everywhere, but what amazed me most was the equiptment. Many of the hub servers were old SPARC 5's and if it was a bigger client, they got a spanky Ultra 5. Not even servers! For such a critical app, I suggested they buy into Netra's or something teco grade that could withstand a beating. The response I got was it was too much money. I couldn't believe it. Here's they'd pull in 20 million in one day from a single client, and they couldn't spend $1000 to upgrade the server. Then it was explained to me by another admin who's worked that arena a while. He said the cheapest companies you'll ever work for (from a sysadmin perspective) will be banking institutions and financal firms. They're filthy rich, but you can't squeeze a penny from them.

That's been my only experience with being a sysadmin at a money institution, but from that experience, it wouldn't surprize me at all to hear how banks would opt for the lowest bidder for any project. Hell, these guys were so cheap, they'd try to avoid buying directly from Sun and go with some third party refurbish vendor. Just unbelievible how cheap they'd be....but they all wore very nice suites. And just so you know....yes....they're still in buisness and they're still the largest bonds brokerage firm in the world. Pretty scary from a tech perspective.
Re:Mo Money! Mo Money! Mo Money! by KernelHappy · 2003-09-19 04:32 · Score: 5, Informative

Ummm... You're the optimist aren't you.

I worked in the EFT industry for about 5 years as an engineer and I can say that you are so wrong it's not even funny. The people that make decisions are worried most about how much it's going to cost. If it wasn't for cost, every bank would be processing transactions in real time rather than relying on batch processing on IBM's that are as old as I am.

When a "new" technology comes along in the industry, it's usually applied to the old technology model. For example, when the processor I worked for started using TCP/IP as a transport between datacenters, they didn't encrypt the data end to end. Instead they just replaced some older dedicated link and relied on the same weak ass pin block encryption they always did, paying no mind to the fact that someone with a notebook and a network card could easily yeild 40-50 complete cards per second.

And if you think because it's financial that everything has to be balanced to the penny, you're so wrong. To start with the legacy systems that some networks have to deal with ensure that reconcilliation will NEVER be 100%. Then add to it that if the money is right, a processor will further bastardize their code to accomodate someone else's improper implementation. You end up with a legacy system that often produces unexpected results when something out of the ordinary occurs (I remember one morning when people were being credited several billion dollars to their account after returning something to a store).

As far as auditors or regulators plugging the holes, fat chance. Regulators are more concerned about transaction fees being present on the front of ATMs and the taxability of the transactions that occur. The auditors only know what the engineers tell them since they are usually not engineers or marginal ones at best. The auditors are primarily interested in the paperwork trail left behind from production code installs. If the paperwork looks good they're happy. Mind you that as far as the auditors are concerned, good looking paper work means that it exists. They do not look for proof of testing other than a signature, in other words no supporting documentation showing the before and after effects of the change are required to be documented. Furthermore no regression test is required to show that nobody piggybacked malicious code on the issue. In otherwords the auditors just smile nicely if you hand them a big stack of papers.

Ultimately, the EFT idustry is filled with dinosaurs, people that talk about how funny it was when they used punch cards or learned some obscure language in college that hasn't been used in decades. When I left the industry 4-5 years ago, there were people that still used their PCs as dumb terminals because they didn't understand the whole personal computer thing (I'm REALLY not joking).

So as far as Windows being used on ATMs, they are going to do as they've done in the past. They will build the machine but instead of putting OS/2 on it, they'll install windows on it. They will rely on the same security they always have, and why shouldn't they? It's served them well for 30 years.

--
-- Button up, your ignorance is showing

Three Major Vulnerabilities by RobertB-DC · 2003-09-19 02:42 · Score: 4, Insightful

From the Wired article:
But one of Anderson's colleagues, Bruce Schneier, chief technology officer at security monitoring and consulting company Counterpane Internet Security, dismissed this [money-dispensing virus] scenario. He pointed out that the machines would not operate online and therefore would not become vulnerable to a malicious Internet attack or to some virus passed around in an e-mail attachment. Because the machines have no peripherals like floppy disks, it would be difficult for a cracker to install code or steal information.

Of course, everyone knows that ATMs have no communications links of any kind. It's just a box full of money with a power plug, right?

Duh! The ATM communicates with the bank, with the ATM user, *and* with the maintenance staff.

* The bank connection is some sort of comm line. Put encryption on it and maybe it's safe. But what happens when it turns out they've used some Win-standard encryption .dll that gets hacked?

* The customer sticks a card in and punches buttons. This is reasonably safe now, when you have little more than a numeric keypad with "Cancel" and "Enter" buttons. But the more Windoze crap they add -- they're talking about "lottery tickets and soft drinks" -- the more robust the UI will have to be. Are you sure you checked that buffer overflow?

* Finally, the maintenance staff has "root-like" physical access to the system. Sure, you have to get past some heavy-duty locks to get to the control panel inside the machine. Big deal, lots of crooks know how to pick locks... how many, though, know OS/2? But what happens when trojan-friendly Windows is the OS? Pick the lock, load the software (because there *will* be a floppy, CD-ROM, or USB port for upgrades), and dispense free, untracable cash whenever someone inserts an ATM card with magic cardno "1111-2222-3333-4444".

Perhaps using OS/2 was a way of de facto "security by obscurity". Installing Windows is more like "security by crossing-your-fingers".

--
Stressed? Me? Of course not. Stress is what a rubber band feels before it breaks, silly.

Re:Three Major Vulnerabilities by gl4ss · 2003-09-19 02:53 · Score: 4, Interesting

well, the physical attack is always there.

year or two ago some estonian wiseguys pulled a nice gig here in finland(iirc they did it in sweden too, but i'm not too sure anymore). what they did was install a fake panel on top of the original atm machines panel, so that when you put in a card it recorded it(iirc it even replaced the pad and stored those numbers too). the guys who make up the ideas like this and make up the devices are no idiots, so security by obscurity would be a dead end street.

though, when reading email from public terminals is risky, i'd think a few times before doing my banking from them if i could avoid it.

i trust atm's enough to use them though, would probably even if it had a bit more complicated software in it, provided that it wasn't written by an idiot.

--
world was created 5 seconds before this post as it is.
Re:Three Major Vulnerabilities by twisty7867 · 2003-09-19 03:03 · Score: 5, Insightful

Your arguments are foolish on the face.

* The bank connection includes federally mandated encryption. The FFIEC (Federal Financial Institutions Examination Council) specifies the exact standard of encryption used. by the way, have you notice that there are no "Windows standard" encryption schemes anyway? They are all industry standards.

* Buffer overrun exploits also rely on unchecked input - if input is screened to a limited variety of characters few if any buffer overrun exploits would be possible.

* Finally, the maintenance staff has *gasp* physical access to the cartridges of cash loaded into the machine. Why the hell would they bother with a virus when they can just take the money and wander off? The basic premise of any bank is that you can trust the employees not to take the money. As someone who has worked for financial institutions for most of his career, I can tell you without a doubt that anyone who violates this trust is detected and dealt with in a quick and harsh fashion.
Re:Three Major Vulnerabilities by Digital11 · 2003-09-19 03:08 · Score: 5, Informative

Trust me when I say that you have no clue what you're talking about. I work for a bank. We communicate with our ATMs over a dedicated line. Having an extremely stripped down version of Windows on an ATM really isn't going to make it a whole lot less secure. It'll still be the same way its always been: The easiest way to get money from an ATM is just to take the ATM. (No, I'm not kidding. We've had that happen a couple of times.)

Maintenance staff does not have 'root' access to the system. They have the ability to open the safe to place more money in, as well as to restock the paper feed for receipts. Thats it. If they're going to take money they're going to do it from the safe, then they'll get caught by doing so. We have one ATM technician and even he doesn't have 'root' access to the boxes.

Please do a little research before opening your mouth.

--
I am a leaf on the wind. Watch how I soar.
Re:Three Major Vulnerabilities by larien · 2003-09-19 03:28 · Score: 4, Insightful

Oh, wait - the machine it connects up to would be a large mainframe that runs 1/2 the speed of the slowest PC, and written entirely in COBOL - I forget these things about the stogy old banks we know and love.
On the other hand, how often does that mainframe crash?
People forget that mainframes have a completely different design object in mind; these systems CANNOT tolerate ANY downtime, not even for half a second. Also, you CANNOT tolerate losing even one transaction, as it may be a billion dollar transfer between accounts. These things are over-designed to the nth degree, with very good reason. Part of that over-design means they can't use the fastest technology around.
As for using COBOL, this will be code that is known to be accurate and error-free; again, you don't want to trust billions of dollars to something untested.
Now, as for why they're thinking of switching to Windows for ATMs, I really can't fathom; is there some problem with their current systems? The articles seem to imply it's because Windows is "open"; why not use linux (or OpenBSD) instead? Then they can tinker with everything to their heart's content and customize all they want.

Windows ATMs by elvum · 2003-09-19 02:42 · Score: 5, Informative

We have them in the UK already - the sight of ATMs showing an NT4 logon screen is not uncommon...

Re:Windows ATMs by martingunnarsson · 2003-09-19 02:45 · Score: 5, Informative

Yep, in Sweden too. I've seen them displaying Windows error messages a couple of times. On the other hand I've seen the Unix ones reboot about as many times.

--
Martin
Re:Windows ATMs by @madeus · 2003-09-19 02:56 · Score: 4, Interesting

Yeah we've had them for 6+ years (surprised this is news to others). I've seen them BSOD, ask for a login, and the one round the corner from me had a DHCP expiry/conflit alert on it for 3 months. You'd think SOMEONE would be arsed to fix it!

(Still worked though, but it put other people off using it, meaning I didn't have to queue to use it).

Lots of them are color and have shockwave flash type intro's.

The underground here in London (well, really DLR, the Docklands Light Railway) has ticket machines that run OS/2, apparently in French or German though (definately not English!). They often die at early hours of the morning (~6) until rebooted remotely.
Re:Windows ATMs by l-ascorbic · 2003-09-19 02:59 · Score: 5, Interesting

I saw one crashed the other day and was so amused that I took a photo of the screen. It's poor quality: taken with a phone, at night. The sheet of paper at the bottom of the picture was taped over the screen, saying "Out of order". Of course I was curious and peeled it down.
Re:Windows ATMs by Anonymous Coward · 2003-09-19 02:59 · Score: 5, Interesting

Picture of ATM in Sweden: http://www.cs.umu.se/~c97pir/resources/images/minu t.jpg One interesting thing is how/why it was successfuly uptated (if the bank wanted to do it I don't think the dialog would be there). -E

You have requested 100 dollars by the_other_one · 2003-09-19 02:42 · Score: 4, Funny

You must not reboot to receive your cash.

--
134340: I am not a number. I am a free planet!

Already there by I8TheWorm · 2003-09-19 02:43 · Score: 5, Informative

Um.... a good number of ATM's issued by a large bank I used to code for run NT 4.0. This isn't late breaking news.

--
Saying Android is a family of phones is akin to saying Linux is a family of PCs.

Re:Already there by syle · 2003-09-19 03:16 · Score: 4, Informative

You're right. I write code for the banking industry now, and this is nothing new to me. The ATMs are certainly the last line of change, but the move from OS/2 to NT/2000 has been sweeping through the industry the past few years. Most manufacturers that used the platform (like Unisys) have officially stopped supporting it within the last year, which makes all the bank execs change immediately.
Honestly, having ATMs on NT isn't so worrisome to me, since I know the back room sorters, remmitance machines, data entry stations, and imaging apps have all been using Windows for at least a few years. Those are much more dangerous in terms of having direct access to your personal banking databases. A lot of banks don't connect them to any internal networks at all, but a lot do because remote management is a big deal amongst companies reselling the machines to banks.
At least ATMs have security cameras and all that stuff. These machines and software in the back room is rarely half as secure as a given ATM.

--
/syle

Blue Screen of ... by Anonymous Coward · 2003-09-19 02:44 · Score: 5, Funny

... Debt.

ATM Windows error picture by wherley · 2003-09-19 02:46 · Score: 5, Funny

Windows on an ATM - already happening. Already
getting errors.

as much as i hate defending MS.... by smd4985 · 2003-09-19 02:46 · Score: 4, Insightful

i think this is less of a concern than it is made out to be. an ATM OS can be tested very rigorously much more easily than an entire OS (especially a bloated one). so i am not afraid of windows ATMs, security-wise. what i AM afraid of is how this lays another layer of brick that reinforces that MS monopoly - i hope some enterprising individuals offer a cheaper, features-competitive open-source system.

--
smd4985

uh.. by grub · 2003-09-19 02:47 · Score: 5, Funny

"They have tried to cut out the unnecessary rubbish that clutters up the typical PC."

but.. but.. the article says they're running Windows.. now I'm confused.

--
Trolling is a art,

How can I stay compatible? by G4from128k · 2003-09-19 02:49 · Score: 4, Funny

If I get cash from an Microsoft ATM, do I have to put it in a Microsoft Wallet?

--
Two wrongs don't make a right, but three lefts do.

Biggest pet peeve by sib888 · 2003-09-19 02:50 · Score: 5, Insightful

Automated Teller Machine Machine?

I Hate That!!!!

--
I'm sib888, and I approved this comment.

Wireless Security & updates by Dugsmyname · 2003-09-19 02:51 · Score: 4, Insightful

I've got 2 questions concerning security:

With the amount of local banks in my local area that are using unsecured (non-WEP) protected wireless access points on their local LAN, I wonder how long it will take for a RDC that tells the ATM to spit out money?

There are security updates that take months for companies to patch on their local servers & workstations... how will a known security vunerability be fixed on a "stripped" version of 2K or NT in an ATM, and how long do you think it will take them to impliment these updates, if they can update them at all?

IBM and Diebold by superid · 2003-09-19 02:54 · Score: 4, Funny

I'm not sure of actual numbers, but I recall that IBM is heavily invested in Diebold, a major ATM manufacturer. I also recall that a large percentage of ATM machines run OS/2.

If this is true, I would expect IBM to be pushing a linux-based solution.

But then again, who knows what the banks want to buy? I just got a letter last week from my bank informing me that "for my security" they will be requiring online banking customers to use 128 bit encryption. Ack! 1998 called, they want their security back!

Re:Fatal Exception by I8TheWorm · 2003-09-19 02:54 · Score: 4, Insightful

A lot of truth to that... but that's generally because of a bad software developer.

As a long time Windows developer, I would have to say that, for a great many painfully obvious reasons, Linux would be a better choice for this. It's cheaper, more reliable in that a developer can see the source code, and see what it's trying to accomplish, has nice GUI's, and many development platforms to choose from.

Even though the article says they would run on a stipped down version of Windows, Linux takes up a much smaller footprint and runs faster, so older/cheaper hardware could be used without any concern.

With large banks trying to cut costs/increase earnings (anyone tried to cash a payroll check at a large bank recently? "that'll cost you $5, sir") I find it hard to believe that they would choose the more expensive OS to run their software.

--
Saying Android is a family of phones is akin to saying Linux is a family of PCs.

Re:Public BSOD by DaveV1.0 · 2003-09-19 02:56 · Score: 4, Informative

Take your pick:

http://zem.squidly.org/bsod/

http://www.piemaster.co.uk/gallery/BSOD

--
There is no "-1 offended" or "-1 you don't agree with me" mod options for a reason.

Usability by Geekenstein · 2003-09-19 02:57 · Score: 5, Interesting

As someone who has used and stood in line to use one of these machines, let me just say that they are a far cry from the efficiency of the current ATMs. Just on a rough estimate, it takes 3-4 times longer for your average Joe Sixpack to make a transaction.

From my own experience, and knowing what I'm doing, the OS runs a good bit slower than the tried and true green on black systems. Top that off with the annoying pointy finger and IE "click" noises, and you have an example of change for change's sake.

Of course, the only reason at all they seem to be using this new system is so they can bombard you with advertising while you're using the machine.

All and all, a bad change all around.

No more banks by devphaeton · 2003-09-19 02:59 · Score: 4, Funny

Looks like it's time to pull all the cash out of the banks and go back to the Bank of Between The Matresses. Last thing we need is a stupid windows worm to have a huge impact on the finances of the United States (or any other countries that use this scheme).

Oh, and out of spite, i'll figure out a way to make my bed run FreeBSD* or something.

[*]"BSD" always makes me think of something like Bondage/Sado-Domination or something.

--

do() || do_not(); // try();

How about we already have ATMs running windows by quantax · 2003-09-19 02:59 · Score: 4, Insightful

This is nothing new, certain banks have had NT running as for atms for a while now. Hell, the subway card dispensing machines in NYC run NT as well as the entire line of NJ Transit ticket-dispensing machines. So dont go off making silly comments of doom and destruction since guess what, they're already here and have been for a while! This is not to say that things cannot go wrong (I see the above mentioned machines being serviced fairly often and they do get errors), but lets not get too dramatic.

--
"What can a thoughtful man hope for mankind on Earth, given the experience of the past million years? Nothing." -Bokonon

Is security really an issue here? by verbatim_verbose · 2003-09-19 03:10 · Score: 5, Insightful

I understand the standard windows=bad theme for slashdot postings, but think about it for a minute. It's in a box that's locked up tight, many with cameras around, not connected directly to the internet... so really... is there any significant security issue to worry about any more so than with the other ATMs around?

Pavlov's geeks... by ryanvm · 2003-09-19 03:10 · Score: 4, Insightful

Man, you guys are like Pavlov's dogs. Taco rings the Microsoft story bell and out comes the rhetoric-spouting zealots. Sure, your points are valid security concerns. But they sure as hell aren't specific to Windows. Time for rebuttals...

Point 1 - Comm line: But what happens when it turns out they've used some Win-standard encryption .dll that gets hacked?

Ah yes, God knows non-Windows communications software never has exploits (it's a link to the SSH exploit story).

Point 2 - UI: The more Windoze crap they add -- they're talking about "lottery tickets and soft drinks" -- the more robust the UI will have to be. Are you sure you checked that buffer overflow?

Uh, this is specific to Windows how? Microsoft isn't going to be writing the interface, the ATM companies are. And they'd be writing the EXACT same interface on whatver platform you want them to use.

Point 3 - Physical Access: But what happens when trojan-friendly Windows is the OS? Pick the lock, load the software (because there *will* be a floppy, CD-ROM, or USB port for upgrades)

Guess what - the best hackers out there are more familiar with non-Windows OSes than they are with Windows. TiVo runs Linux and it's had the shit hacked out of it. ReplayTV, while still hackable, hasn't had nearly the level of "unofficial" customization. It's a lot easier to muck around with software if you have the source to it.

Now, I'm not saying that Windows is more secure than other OSes. That thought is absurd. My point is that in a very tightly controlled environment, it can be just as secure as the next OS. My other point is that you guys are fucking insane with anti-MS zealotry. Why don't you try looking at the world without that chip on your shoulder.

Security concerns spreading by nomadicGeek · 2003-09-19 03:11 · Score: 4, Insightful

I work with a lot of embedded controls systems and the use of Windows with these systems (for Human Machine Interface, data gathering, etc) is increasingly common. The security concerns related to viruses and worms are also more common.

Back when more of these systems used Unix, VMS, etc, it was not a big concern. The environment was so heterogeneous that you didn't need to worry. Now that everyone is running Windows, it becomes a huge problem.

I've been helping several of my customers lock things down and better isolate their control systems. There are plenty of ways to do this effectively but it only takes one careless tech to screw the whole thing up. While I'm confident that I can develop the infrastructure and procedures to protect the systems, I'm not confident that the procedures will be adhered to.

This has become such a large concern that many of them are reevaluating their purchasing decisions and considering turning away from Windows. The problem is that nearly all of the vendors are now producing Windows only solutions.

I would like to say that there would likely be similar problems if everyone was running Linux. While you can lock things down when you start to put the systems into the hands of less sophisticated users you will have the same problems. I see this as more of a user problem than a technology problem. The reason that these worms and viruses spread so fast is that users are not taking the procautions that they should.

Anecdotal support for this argument can be found at any large LAN party. There are always a number of bozos running Red Hat infected with all kinds of crap because they have no idea what they are doing.

You can give two guys the best woodworking equipment in the world and the best wood. One will produce an heirloom and the other will be in the emergency room getting his fingers sewn back on. There are more of the latter than the former in this world.

Not as big a security risk as you guys think by zapp · 2003-09-19 03:13 · Score: 4, Insightful

Guys... you have to realize these ATMs (unix, windows, other) are NOT on the public internet. They're not even on the same network as the workstation computers inside the bank. They may not even be using the same protocols, but I don't know about that.

The fact that they run Windows doesn't honestly mean much to me, because if the security experts in those banks are stupid enough to connect an ATM (or any number of other important machines internally) to any sort of public network... they're gonna get fucked at one point or another.

How often do you think a UNIX ATM's kernel/packages gets patched to fix that latest overflow discovered? Probably never.

--
no comment

Built in failsafes? by suso · 2003-09-19 03:22 · Score: 4, Funny

Yeah, they have built in failsafes to keep this from happening. Just like the power companies have built in failsafes to keep a massive blackout from occuring.

Re:Buffer Overflow? by Anonymous Coward · 2003-09-19 03:24 · Score: 5, Interesting

I'll start working on modifying my ATM card's magnetic strip to overflow the ATMs card reader.

I think you were being funny but I actually develop ATM software and some of the code I have inherited from the previous idiots would have been succeptible to exactly that. It wouldn't get you any money unless you knew the internal protocols for dealing with the cash dispenser in addition to knowing how to exploit a buffer overflow (in which case you would likely know 10 other/better/easier ways to rip it off) but that is almost certainly a hole in more than a few machines out there.

Re:ATM scams by Richard_at_work · 2003-09-19 03:26 · Score: 5, Informative

The latter scheme seemed dubious; the chain-letter like WARNING on the machine, and the insertion sensors on card slots I can't see allowing something jammed that far into them. Plus this was at a gas station deep in suburbia where hanging around the ATM would be suspicious, and where the ATM was in a corner making its use a complete screen of the keyboard.

This scam is called the lebanese loop, and involves installing a thin bit of wire into the card slot, which jams the card in there. This of course stops the ATM from actually doing anything, but a kind gentleman behind you suggests that maybe you should input your PIN a second time. While he is shoulder surfing. This of course doesnt work, and the ATM refuses to give your card back, mainly because it actually cant :)

Then you give up, wander into the bank to complain, and he has extracted your card (easy if you know how with these things) and run off to another ATM in the locality to quickly drain your account of everything he can get.

This scam has been ran a number of times in my town, and people keep getting caught out, even tho there are now massive warnings on the ATMs.

Re:Very questionable logic... by syle · 2003-09-19 03:32 · Score: 4, Insightful

This sounds like a bunch of ignorant suits were herded into a room by MS salespeople and told the "benefits" of XP Embedded.

You're exactly right, and I'm not sure how sarcastic you intended that to be, but it's the perfect truth of the matter. What it comes down to is that none of the top 10 banks in the U.S. would ever seriously consider something that an undergrad in an intro-to-programming class could write.

It comes down to (1) liability, (2) how well it works, and distantly (3) price. In that order. Most large resellers who would be installing these systems don't use Linux, so they would never pitch it to the banks. Why? Because in the corporate world, everyone knows Windows works and everyone is happy with it. It's a no-brainer to use. What's linux? Who cares? They use Windows every day. When it breaks, they call someone who fixes it. They would view it as "taking a chance" on Linux, and they're not paid to take chances. Upgrading ATMs is probably a deal that takes 3-5 years from the initial start, and that's too much to risk on an OS that they've never heard of.

As someone who has done troubleshooting for these type of systems, I'll tell you flat out, they don't care about security the same way you or I do. What they care about is whether they have someone to blame when it breaks. Sad but true.

--

/syle

Re:ATM TCP/IP Stack by hackwrench · 2003-09-19 03:36 · Score: 5, Funny

So, are you posting from that ATM right now?

ATM security is not really at risk... by Anonymous Coward · 2003-09-19 03:37 · Score: 4, Interesting

In many european countries ATMs have a secure cryptographic device attached, which stores all cryptographic keys used to encrypt data between the ATM and the ATM server. All cryptographic computations are made in that device and it is designed to "erase it's memory" if someone tries to pull it out or do something weird.

Normally, the PIN you type is directly transfered (encrypted) to the secure device and does not go through the PC memory. So your PIN is pretty safe from any virus or trojan horse.

These requirements are imposed by VISA/Mastercard, because they take PIN security very seriously.

The remaining risk comes from an insider who would put a trojan horse in the ATM such that it would dispense cash automatically for example if you type a certain key combination :-)
This does not endager your PIN though or any transaction. It's basically a problem for the bank :)

This is a rather complex attack, even if you have Windows, OS/2 or linux on the ATM (Windows might just make it easier). The hard part is getting into the system (these machines don't run any standard services and there are access control policies). There are easier and less dangerous ways to get money from the credit/debit card systems than hacking into an ATM in a protected environement.

One of the reasons they use windows is because it's the cheapest alternative (YES! Shock! :-) ). The specific drivers exist and also the engineering skills. Moreover banks are very conservative, some still have DOS or OS/2 ATM's so they stick to stuff they know (usually not your favorite free OS).

Crashing ATMs by Leto2 · 2003-09-19 03:57 · Score: 4, Funny

Nothin' new here.

I've had a picture of this ATM for the past 5 years on my website :)

--
<grub> Reading /. at -1 is like driving through Cracktown in a convertible that is stuck in 1st

V-Com by Lemmeoutada+Collecti · 2003-09-19 04:05 · Score: 5, Informative

I have had the recent pleasure of watching the V-Com ATM machines being installed in our local convenience stores. They are PC's controlling the system, using Internet connections over TCP/IP to communicate, running Windows NT Workstation 4.0 SP6a. They have a custom keyboard missing the CTRL, ALT, and other state keys, and a touch screen interface to boot. And they can be crashed so easily it goes beyond funny to just plain sad.

The tech doing updates opens the bay, plugs in a regular keyboard, logs on to an e-mail account, and runs the patches distributed that way.

Not something I really would trust with my money!

--

You can have it fast, accurate, or pretty. Pick any 2.

FACTS ABOUT ATM SCAM IN FINLAND COUPLE YEARS AGO. by johu · 2003-09-19 04:46 · Score: 4, Informative

Device Estonian folks used was actually quite sophisticated. I saw short clip of it on YLE News on TV back then. From later news transmission that part where electronics and construction of device were shown was removed and on the one time they showed it some police came and moved device away from cameras. Guess cops said you're not allowed to show that on TV.

These are facts:

Device had card reader. It was placed on front of real card slot so when you inserted card magnetic stripe was read.

People who's cards got copied said it was difficult to get card out from ATM machine. This was because after transaction ejected card was partially blocked by extra reader device those guys installed.

Keypad had kinda sticks on bottom so when you pushed number on spying keyboard it pushed real button under it at the same time. Electronics connected to fake keyboard recorded your PIN and saved it to NVRAM among content of magnetic stripe it just read as well.

Card reader was connected to keypad module that had most of electronics using cable. Cable was covered with square plastic housing to keep it less obvious what was going on.

Since you got your money from ATM no-one suspected anything fishy until day or two later when your bank account was empty.

Crooks were waiting on nearby car. After some
time they went to ATM and removed their device.

Ok, those were facts. There were some claims that device had also WLAN or some other wireless connectivity so card numbers and PIN codes would have been transferred to crooks realtime. However I think that's just rumour.

Device had factory made looking PCB inside. Probably some SBC development thingy.

If there's someone with Helsingin Sanomat archive access you could probably find more details from there. HS is Finnish newspaper so that part was for finnish readers.

Exactly: Cost is key by stewby18 · 2003-09-19 06:22 · Score: 4, Insightful

The people that make decisions are worried most about how much it's going to cost.

And you don't think it's conceivable that someone will decide that the cost of losing billions upon billions of dollars when the Windows+TCP/IP+internet connection machines are hacked isn't worth it?

They may not be very security-savvy, but they won't do a massive rollout that will leave them with a nationwide network of completely broken ATMs that divulge money at the drop of a hat. Insider addition of malicious code, while a pain, doesn't even begin to compare cost-wise with complete public access to machines with internet-enabled, free-for-download, no-knowledge-required exploits.

You can catch and arrest a malicious insider if the losses start adding up. You can't just arrest the entire US.

My experience with a microsoft ATM by natet · 2003-09-19 06:51 · Score: 4, Interesting

A little over a year ago, I went into my bank to get $20 for lunch or something. I put my card in, typed my pin number, selected which account to get money from, and the amount.

Then all of a sudden, the screen went blue. I stared in disbelief for a moment, then a boot sequence began to display on the screen. And what did I see on the bottom of the screen, but the Microsoft trademark. I couldn't believe it. I had been bluescreened at the bank. I had to get the bank to credit the money back to my account and to get my card back (which I couldn't get back for a couple of days). So I guess you could say that I am less than thrilled about Windows running ATM's.

--
IANAL... But I play one on /.

51 of 802 comments (clear)