Can Your ATM Play Beethoven?

bpiltz writes "A funk band in Harrisonburg, VA, called Midnight Spaghetti, has posted a story with photos about a newly installed Diebold Opteva 520 ATM at Carnegie Mellon University that crashed, then rebooted. The Windows XP operating system initialized without the actual ATM software. The result was a public desktop computer, with only a touch screen interface, left wide open for the amusement of the students at the most wired university in the U.S. Interestingly, Diebold is one of the leading manufacturers of e-voting machines."

Comments

"Progress"?

[FyRE666]

You know, I've been thinking for a few years now that ATMs (in the UK at least)
seem to be getting slower and slower to use. 10 years back, you'd insert your
card, be able to key in your pin number straight away and be straight into the
menu. Now, you insert the card, stand about while it thinks about checking it,
then you eventually enter a pin and wait around a bit more before using the
sluggish interface. Now I know that these machines have media player, web browser and
all sorts of other redundant crap installed on a full version of XP, I understand the
reason the queues are growing!

I don't need 24 million colours, animations and other crap just to take money out
of my account, dammit! It's staggering to think that the software has become so
bloated and slow that machines produced 10 years ago, with only a fraction of the
computing power of today were actually far more responsive to use.

I remember seeing an ATM reboot a few years back (brief power outage). It briefly
showed the OS2 logo before resuming normal operation ;-)

Re:"Progress"?

[zakezuke]

Bottom line is that some one needs to make a new ATM solution that works, propably on an open source platform (is that secure enough, you tell me), and most impotrant is ...IT WORKS....

Platform? One of the nice things about vintage cash machines was the fact that the software was written in assembly. Let's face it, all a bank machine is is just a glorified terminal. It has no need to store information, no need to access disks, mount devices, nor access a network outside of it's banking protocal. There is no need for it to accept new software other then perhaps firmware update from time to time, nor the ability to run background processes. Doesn't need to do cron events or anything above and beyond take card, peform action on account, say thank you.

Re:"Progress"?

[ruiner13]

"It has no need to store information, no need to access disks, mount devices, nor access a network outside of it's banking protocal."

True, except that modern ATMs will have biometrics (finger scanners and whatnot), plus that printer thingy that gives your receipt, then there's the monitor, maybe some sort of check scanner for inputting money, a dispenser for giving cash, and viola, you have attached devices which need drivers.

I just don't know whether to laugh or cry!

[oiron]

COME ON!!!!!!!!!! Why in the world would someone waste a computer that's capable of running Windows XP (which probably means at least a Pentium with 64 MB RAM?) on an ATM? I mean, the thing is supposed to check your card, pin and then give you a load of cash... Last time I checked, that's a job for something less than an 8080, which could do the job faster, more securely, and cheaper. The right tool for the right job, people! /me rolls eyes

Re:I just don't know whether to laugh or cry!

[eggstasy]

Thing is, its easier to code up a quick ATM script in Flash or something, than it is to design a whole "lean and mean" super customized secure embedded system from scratch, then code up some basic OS and development tools for it, and THEN do the interface in some obscure language with crappy libs.
People are lazy, and costs have to be kept down. What's usually important in a company, is to make their business process "lean and mean", not their software or PCs.

Re:I just don't know whether to laugh or cry!

[Anonymous Coward]

Why would anyone need to re-implement an ATM?
The old ones work.

Re:I just don't know whether to laugh or cry!

[eraserewind]

So they can show you pretty advertisements for mortgages and loans.

Re:I just don't know whether to laugh or cry!

[LinuxHam]

Because business drives technology more than anything else. Just like all things tech, ATMs replaced humans because they can do a human's job 24x7x365 without taking coffee breaks or sick days. And if coded correctly, they can do it without errors. In the old days when you would sit down with a bank representative, they would ask you, "is there anything else I may help you with? Would you like to hear about our low mortgage rates? a new low-rate credit card?"

Once you replace the person with a machine, you lose the revenue stream generated by the "cold selling" tactics. So, as technology advances and the machines can handle more tasks, why not? If a company is paying to own or lease IT 24 hours a day, that IT should be earning you money 24 hours a day. Just spitting out greenbacks without advertising more products is just not taking full advantage of the technology. Business doesn't care that that's all YOU want out of the machine.

For once...

[Kjella]

If I find out this particular ATM is Windows-operated, I will hunt down Mr. Gates, roll him in tar and feathers and chase him out of town with a stick. In the meantime I will file a complaint with Ulster Bank for taking away my sole source of cash until next pay-day.

I'd rather find the execs of the bank, and roll them in tar and feathers and chase them out of town with a stick. Any one can make an offer... I can offer to run their ATM network on Linux 2.6.4-alpha1-test4-pre2 too. If they're willing to buy it, that's their stupidity, not mine.

Kjella

Economics, that's why

[tkrotchko]

This machine is indeed massive overkill, but the economics are that a desktop PC is about the cheapest computer out there.

An 8080 computer set up in a config with USB ports, serial, parallel, video, etc etc will probably run you something close to $3,000 US, and spares will be difficult as they'll have to be single supplier.

Also, the drivers for things like printers and card readers are only going to be available for Windows (and increasingly Linux), so if you have an embedded device, the integration costs are going to be high.

On the other hand, you can get a robust PC from a major manufacturer for something under $1,000 US and it can be replaced by any manufacturer. There are drivers for everything, and software development will be cheaper because windows programmers are more available than embedded programmers.

Stupid Student's or maybe..

[sh0rtie]

too honest

they had a machine that would give them money and all they did was use media player ? Diebold got off lightly!.

they [evil student] could of written a keylogger/pin reader/card cloner/data capture using the on-board vbscript/wscript language, (full access to filesystem and shell), build in a network check so as soon as the machine detects a network connection (as the students said it wasnt connected to anything presume at some point it will be connected to a network by an engineer or repairman) it trys to post the captured data to some.random.location.com, install it as a system service so it runs automatically in the background , even schedule it to run at specific times and you have one totally compromised machine

would of taken an hour max of programming time, maybe 15min if all you had to do was type it in and not compose it.

scary that not only is the software Windows but it has its own built in programming enviroment with access to every program on that machine including network access, and the only tool you need is notepad.

Windows XP Embedded

[XNormal]

If they insist on using a Microsoft OS at least the could use Windows XP Embedded.

It's a componentized version of Windows XP with a set of tools to customize it, remove any unnecessary components and prepare system images. It also has tricks like running from read-only media and intercepting message boxes that end users should not see.

It's even cheaper (for a moderate number of licenses).

Re:I've seen OS/2 on ATM screens many times

[vadim_t]

The problem's not so much Windows as the lack of customization.

If those machines were locked down embedded Windows or something similar, then I wouldn't be so worried. But these things appear to be more like a normal Windows installation with an ATM program on top. That *is* scary.

Think of it, if so much care was taken on the design of the ATM, how do you know that your credit card number and PIN aren't in a text file that can be read directly if you manage to get to the Windows interface?

And what will happen when the virus of the week hits it because nobody bothered closing unneeded ports?

Re:Election Day...

[s20451]

Here's the problem with any argument that electronic voting can lead to truly massive voter fraud, of the kind that you suggest. All the news organizations take exit polls, and in fact they usually have a good idea as to the winner even before the polls close. If the exit polls massively disagreed with the result, there would be no question that fraud had occurred, especially if there was no paper trail to back up the votes.

Fraud can still occur. It's just that those conducting the fraud have to be extremely careful to avoid detection: only chaning a few dozen votes in areas where the vote is close to begin with, and so on. They always have to stay within statistical margins of error.

As they should!

[Chemisor]

> The point is, banks will assume the worst when it
> comes to you no longer physicaly having your card.

As they should. Really, it is much simpler for the bank to just issue a replacement card than to bother returning the old one. Think about it: should they print a piece of embossed plastic that costs a few cents, or have the kindhearted finder send the old card in (37 cents) and remail it to the owner (another 37 cents + 15 minutes of somebody's time [or more, if Windows crashes]) all the while ensuring that no fraudulent transactions take place in the meantime (priceless)?

Re:Moderators: +5 Insightful!!!

[linzeal]

Because most moderators just scroll down the page and anything that is not to 5 yet they moderate it up, because most moderators play it safe instead of looking for that gem in the rough.

Re:Why use Win32 on a ATM?

[t_allardyce]

Actually you really dont need much of an OS on an ATM, infact i bet some of the earlier ones running on a calculator were 10 times more reliable and secure in their day!!

An ATM has only afew simple requirements

The GUI
Dont even start about "windows gui" all ATMs use a custom designed GUI! theres no need for a graphical OS behind it!

Network Connection
This aint rocket science, you dont need a big OS to send an encrypted message.

Reliability
The ideal machine would simply have a ROM for the software and a small ammount of RAM, no hard-drive is required. You should be able to do a full reset and have the machine running in seconds. Does this idea fit well with a large windows installation? no.

Infact i would go as far as to say an ATM doesnt even need multitasking! think about it, you do your stuff, it says please wait, that stays in the video buffer while it does its transaction. All this over complexity is very bad KISS.