Slashdot Mirror

← Back to Stories (view on slashdot.org)

Diebold ATMs hit by Nachi Worm

Posted by CmdrTaco on from the that-makes-me-feel-safe dept.

red floyd writes "The Register is reporting confirmation that Diebold ATMs were hit by the Nachi worm back in August. Apparently some Diebold ATMs run XP Embedded, and got hit with a variant of the RPC DCOM worm. Seems that they hadn't yet applied the available patch."

9 of 414 comments (clear)

  1. Diebold spins it. by grub · · Score: 5, Insightful


    A patch for the critical RPC DCOM hole had been available from Microsoft for over a month at the time of the attack, but Diebold had neglected to install it in the infected machines.

    Nice spin, Diebold. I highly doubt these were the only unpatched machines. It's likely more accurate to say "these unpatched machines, of which there are many more, weren't well protected on their respective VPNs". Think about it: the infection had to come from somewhere, right? Other unpatched machines are probably much better protected on their respective private networks.

    --
    Trolling is a art,
    1. Re:Diebold spins it. by Anonymous Coward · · Score: 5, Insightful

      I watched guy patch an ATM once.

      It was done from a laptop.

      My guess is that an infected laptop managed to screw things up (but no-one would admit to that). If it were because of a network connection, it would have been an 'all or nothing' infection and would've spread like wildfire. I'm not sure how exactly ATMs are connected, but they have to be networked in the grander scale of things for the system to work properly.

      Anyways, my bet is an unsecure laptop - that's how most RPC hole attacks I've seen have spread recently. Having said that, we'll see lots of posts of an anti-MS nature in response to this story, when in actual fact, it's down to user bad practise, patch deployment and the fact that some people get a kick out of writing this stuff in the first place...

    2. Re:Diebold spins it. by SatanicPuppy · · Score: 5, Insightful

      It's just as likely to be a scrap of code inloaded off the back of a credit card. Why in Gods name would anyone use a proven insecure operating system as the base for a series of teller machines? Are ATMs so complex that you need a whole operating system running on the damn things? I seriously doubt it.

      The answer to this is to make a simple, purpose built program, which is INCAPABLE of running externally introduced code. You need to patch? Run the software off a CD/DVD, and when you need to change the code, change the CD. Nothing to get cracked, nothign to get corrupted, nothing but hardwired code. Burn an extended BIOS on a rom chip to run the physical end. Then lock the whole thing up in a metal box, and BAM its as secure as you can make it.

      Diebold should go back to making safes and padlocks, because they sure as hell don't know crap about ATMs and Voting Machines.

      --
      ad logicam Claiming a proposition is false because it was presented as the conclusion of a fallacious argument.
    3. Re:Diebold spins it. by pmz · · Score: 5, Insightful

      Why in Gods name would anyone use a proven insecure operating system as the base for a series of teller machines?

      Because their executives are idiots and their engineers are sheep.

      --
      Healthcare article at Kuro5hin
  2. Just goes to show.. by iantri · · Score: 5, Insightful
    I think this just goes to show that consumer operating systems are a bad idea to put on important machines that need to be reliable.

    I'd think QNX or something else very simple and reliable would be a much better choice to rnu on ATM machines..

  3. Someone's going to come up short... by abb3w · · Score: 5, Insightful

    The customers at large will; it will most likely be reflected in higher account/ATM fees. Banks will likely pass on the cost of theft just like merchants do the cost of shoplifting. Which sucks for the honest folk out there... all seventy-two of them.

    --
    //Information does not want to be free; it wants to breed.
  4. Just lame by GillBates0 · · Score: 5, Insightful
    "But worms are always going to be able to infect a lot more interesting machines than individual intruders are." Moreover, before reaching an ATM network, a human attacker would likely encounter more alluring high-finance targets along the way. "They're going to have to go through a lot of juicer networks first."

    Just the fact that ATM machines are reachable from the public Internet is a huge cause of concern to me. A VPN connection without an intervening firewall at the ATM machine itself (which they claim they are installing now) is plain ridiculous.

    You are then just hoping that none of the insiders will try to sabotage the machines, either knowingly, or unknowingly because of an infected laptop etc. They have to realize that VPN is a VIRTUAL PRIVATE network, and NOT a dedicated line, and hence, security measures have to be MUCH more stronger than if it was a REAL private connection. Does it take rocket science to figure that out?

    And then there's that quote from the " Windows expert and "chief hacking officer" that malocious hackers will probably not go for ATM machines, even though they are reachable/hackable, because of other "jucier targets", presumably the bank network itself. Most malicious hackers would do it just for the fun of making an ATM machine spew out cash, if they figure out they can make it do that. That is a very lame assumption from a security expert.

    And finally, for your reading convenience, here's an earlier /. story which mentions that 65% of the ATMs will be running a stripped down version of Windows by 2005.

    --
    An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
  5. Re:False sense of security still in effect by Angstroem · · Score: 5, Insightful
    I still don't see any reason why a ATM machine must run a bloated operating system. That thing needs:

    (1) A display driver; any text console is sufficient, but if the banks prefer to show logos and useless graphics, fine, make it a simple framebuffer device.

    (2) A rudimentary keyboard controller; any 4x4 matrix will easily do the job. Make it 8x8 and you have more keys you'll ever need.

    (3) Some additional hardware controls to perform currency selection and output, and receipt printing.

    (4) A network driver to hook the ATM machine into the banking network plus the relevant service applications including mandatory security services. Shouldn't be much different from setting up credit card terminals, BTDT.

    So why does anyone need anything like a striped down consumer OS, no matter if it is Windows Embedded or some embedded Linux for that?

    But if I decide to use it, then I better hurry and apply any goddamn bugfix meant to close wide-open security holes. Plus, I keep my networks strictly separated and eventual gateway points heavily firewalled. How could Nachi enter the money transfer network anyway?

    Somebody obviously did not make their homework, both on ATM and network infrastructure design.

  6. Re:False sense of security still in effect by RealProgrammer · · Score: 5, Insightful
    A virus like this bypasses zero levels of account security.

    What color is the sky in your world?

    This worm was caught because it wasn't expecting to be on an ATM. It thought it was on just another XP box on some network and started scanning. Suppose the next worm is patient, stealthily looking for ATMs?

    Malignant code could potentially monitor any device I/O it wanted. How about grabbing the bits on your ATM card swipe and saving them in an arrary with the PIN you just typed? No need to decipher anything, just send a day's worth in a batch and self-destruct.

    The attacker can then recreate your ATM card from the bits on the stripe.

    You're right, we're still safe.

    --
    sigs, as if you care.