Slashdot Mirror
Can Your ATM Play Beethoven?
bpiltz writes "A funk band in Harrisonburg, VA, called Midnight Spaghetti, has posted a story with photos about a newly installed Diebold Opteva 520 ATM at Carnegie Mellon University that crashed, then rebooted. The Windows XP operating system initialized without the actual ATM software. The result was a public desktop computer, with only a touch screen interface, left wide open for the amusement of the students at the most wired university in the U.S. Interestingly, Diebold is one of the leading manufacturers of e-voting machines."
You know, I've been thinking for a few years now that ATMs (in the UK at least)
;-)
seem to be getting slower and slower to use. 10 years back, you'd insert your
card, be able to key in your pin number straight away and be straight into the
menu. Now, you insert the card, stand about while it thinks about checking it,
then you eventually enter a pin and wait around a bit more before using the
sluggish interface. Now I know that these machines have media player, web browser and
all sorts of other redundant crap installed on a full version of XP, I understand the
reason the queues are growing!
I don't need 24 million colours, animations and other crap just to take money out
of my account, dammit! It's staggering to think that the software has become so
bloated and slow that machines produced 10 years ago, with only a fraction of the
computing power of today were actually far more responsive to use.
I remember seeing an ATM reboot a few years back (brief power outage). It briefly
showed the OS2 logo before resuming normal operation
Code, Hardware, stuff like that.
I see you're trying to extract free cash from a bolloxored ATM cum jukebox. May I help you?
Sheesh, evil *and* a jerk. -- Jade
So who got the fastest ATM minesweeper times?
Start --> Programs --> ATM --> Configure --> Flush Cash (sic)
The geek Jim goes to the election booth. Jim touches the opening screen. Jim watches while the screen BSoDs. Computer reboots. Jim is presented with the XP interface. Jim, finds the voting system back end. Jim "adjusts" the result:
Bush 15%
Kerry 15%
Nader 70%
Jim set's all Bush and Kerry votes to go to Nader.
Jim runs the voting system front end. Sets it to full screen.
Jim leaves.
Nader wins
Indefinitely Detained US Citizen
COME ON!!!!!!!!!! Why in the world would someone waste a computer that's capable of running Windows XP (which probably means at least a Pentium with 64 MB RAM?) on an ATM? I mean, the thing is supposed to check your card, pin and then give you a load of cash... Last time I checked, that's a job for something less than an 8080, which could do the job faster, more securely, and cheaper. The right tool for the right job, people! /me rolls eyes
I got a chance to talk to one of my bank's IT people about this a few months ago, and basically, they don't know what's causing the crashes because analyzing the log files would just be too much trouble. So their SOP is to have some guy with a key come out, literally pull the plug on the machine and wait till it reboots.
He also told me that they were slowly migrating over to a "custom XP version", whatever that's supposed to mean. I probably should have told him that Windows machines can be prone to virus infections (cough cought).
Would it be possible to load data on
a swipe card so that the software reading the card
suffered some kind of buffer overrun ? (Depending
of course on how carefuly the software checked for
them).
I see "ordinary" ATMs stuck at a Phoenix BIOS boot prompt all the time. While I've never gotten to the Windows part of an ATM, it happens at information kiosks a lot.
They should have used the "On-Screen Keyboard" under Accessibility. It is a little scary that this was connected to cash.
If you want a good read for the database schemas an ATM uses, read "Principles of Transaction Processing." One interesting bit of knowledge is that the entire table of valid account names and their card hashes is replicated to each ATM! (Obviously for your bank only.) It sends out a ping that records "Joe took $50" to the main bank but it's only sort of a summary, the "full details" is kept at the ATM and sync'd at night.
One crazy thing that happened to me was I tried to withdraw $1100 from Bank A at Bank B's ATM. I got into a "Distributed Transaction Rollback" -- it got all the way through, printed out out my receipt that said I got the money, and -- never gave me my money. When I checked at a Bank A ATM, it showed the "hit" on my account. In about 15 minutes the Transaction Processor rolled back the transaction.
It's not immediately evident how Windows XP opens a security risk on an ATM, nor how this means that Diebold voting machines are somehow hackable.
ATMs not connected to the Internet and without keyboard are pretty much unhackable unless you can pry open the case and attach a keyboard and/or wireless connection. And if you could do that, I suspect pretty much any ATM would be hackable. There is a reason why ATMs are built from heavy steel and anchored in concrete.
Diebold systems raise paranoiac hackles for another reason: control and oversight. You don't need to invoke security flaws and Windows XP to realize that ballot boxes represent power and money. Whoever controls the counting process controls billions, trillions of $, and this is a temptation that few, if any, people can resist.
The argument against paperless touch-screen voting systems comes from the fact that such systems open the way to serious internal fraud, rather than hacking through any hardware or software weakness. Election fraud is done by incumbent politicians, not by hackers exploiting BSoDs.
The nightmare scenario for future US elections is where after a largely electronic and unverifiable poll, the governing party gets 55% of the vote despite exit polls showing that it got 45%. What would happen after such an event is anyone's guess, but it would not be pleasant.
Ceci n'est pas une signature
http://yogi.pdl.cmu.edu/~cgeisser/photos/
Video with audio of ATM in action
Take a look here
The moving cursor writes, and having written, blinks on.
Here is the Diebold specificaion PDF for the 520. It says the thing has a P4 in it, and I would assume this is because they designed some sort of software framework for the Optiva to be expandable in the future to do things like sell concert tickets.
Imagine if that CDR drive was usable to load programs onto it. Furthermore, I'm really hoping these things don't have bluetooth in them.
520 Spec PDF
-Steve
If I find out this particular ATM is Windows-operated, I will hunt down Mr. Gates, roll him in tar and feathers and chase him out of town with a stick. In the meantime I will file a complaint with Ulster Bank for taking away my sole source of cash until next pay-day.
I'd rather find the execs of the bank, and roll them in tar and feathers and chase them out of town with a stick. Any one can make an offer... I can offer to run their ATM network on Linux 2.6.4-alpha1-test4-pre2 too. If they're willing to buy it, that's their stupidity, not mine.
Kjella
Live today, because you never know what tomorrow brings
Why's getting out money so hard?
Windows, Windows, every where,
It's eaten up my card.
The spirit deep within: O Gates!
That ever this should be!
Yea, buggy things did crawl with legs
Within Windows XP.
About, about, it must reboot
My card's still held within!
No beer to quench my thirst tonight,
Blue screen, and wallet thin.
And some in dreams assured were
Of the spirit that plagued me so:
The demon Gates had followed me
From Redmond's deepest flows.
And my poor tongue, through beerish drought,
Was withered at the root;
I could not speak, no more unless
This teller would reboot.
Ah! well a-day! what evil looks
Had I from old and young!
Instead of the cross, this penguin fine
About my neck was hung.
Gentoo Linux - another day, another USE flag.
This machine is indeed massive overkill, but the economics are that a desktop PC is about the cheapest computer out there.
An 8080 computer set up in a config with USB ports, serial, parallel, video, etc etc will probably run you something close to $3,000 US, and spares will be difficult as they'll have to be single supplier.
Also, the drivers for things like printers and card readers are only going to be available for Windows (and increasingly Linux), so if you have an embedded device, the integration costs are going to be high.
On the other hand, you can get a robust PC from a major manufacturer for something under $1,000 US and it can be replaced by any manufacturer. There are drivers for everything, and software development will be cheaper because windows programmers are more available than embedded programmers.
You were mistaken. Which is odd, since memory shouldn't be a problem for you
too honest
they had a machine that would give them money and all they did was use media player ? Diebold got off lightly!.
they [evil student] could of written a keylogger/pin reader/card cloner/data capture using the on-board vbscript/wscript language, (full access to filesystem and shell), build in a network check so as soon as the machine detects a network connection (as the students said it wasnt connected to anything presume at some point it will be connected to a network by an engineer or repairman) it trys to post the captured data to some.random.location.com, install it as a system service so it runs automatically in the background , even schedule it to run at specific times and you have one totally compromised machine
would of taken an hour max of programming time, maybe 15min if all you had to do was type it in and not compose it.
scary that not only is the software Windows but it has its own built in programming enviroment with access to every program on that machine including network access, and the only tool you need is notepad.
If they insist on using a Microsoft OS at least the could use Windows XP Embedded.
It's a componentized version of Windows XP with a set of tools to customize it, remove any unnecessary components and prepare system images. It also has tricks like running from read-only media and intercepting message boxes that end users should not see.
It's even cheaper (for a moderate number of licenses).
Stop worrying about the risks of nuclear power and start worrying about the risks of not using nuclear power.
Reminds me of a couple of years back when by wiggling their god-awful pointer device too fast I managed to crash the in-flight seat-back entertainment system. BSOD, reboot, turns out it's a 90MHz Pentium running Win NT 4.0 Server Edition - no wonder the response was so sluggish (on the order of seconds).
:-)
I got to the desktop for about 5 seconds before their entertainment app autostarted again. I then spent a fun hour or two re-crashing the blasted thing and trying to defeat the autostart. Never managed it though - that's the only time I recall that I wished I knew more about Windows.
Eventually I had to stop because it turned out that poor old Pentium wasn't my in-seat client but actually the server for the entire cabin, and a lynch mob was starting to form... 8-O
Be faithful to your obsessions. Identify them and be faithful to them, let them guide you like a sleepwalker. JG Ballard
Once more with the right tags...
Mignight Spaghetti
As a grad student who has their office in this building, I got more than a little kick when I saw the tech fumbling aimlessly to try and fix the thing later. He was there literally all day long and each time I walked by he was on the phone trying to get more info. Where is a good ole OS/2 ATM when you need one?
Anyway, some people on misc.market also posted some movies that you might find interesting.
My Slashdot account is old enough to drink...
About a month ago, all of the National City ATMs in Pittsburgh (where CMU is) got switched from ancient working machines to snazzy new Diebold touch screens. Aside from the one playing Beethoven, there has been at least another one that BSOD'd.
The one on this article was funny and everything until that night when I remembered that I have my life savings in National City.
I stopped at some competing banks in the area on Thursday to get some pamphlets and I will be switching banks on Monday.
--------
It's OK to be social, just don't tell anyone about it.
But does any one know why atm's here in the states have a decimal in the amount? So if I want to take out an amount (say $15) that isn't listed, I have to type:
1-5-0-0
to let the machine know I want 15 dollars instead of 15 cents. No atm that I've seen (granted, limited experience) will dispense change. I don't think I've seen any that even dispense dollar bills, so getting $17 is impossible. So why the decimals?
> The point is, banks will assume the worst when it
> comes to you no longer physicaly having your card.
As they should. Really, it is much simpler for the bank to just issue a replacement card than to bother returning the old one. Think about it: should they print a piece of embossed plastic that costs a few cents, or have the kindhearted finder send the old card in (37 cents) and remail it to the owner (another 37 cents + 15 minutes of somebody's time [or more, if Windows crashes]) all the while ensuring that no fraudulent transactions take place in the meantime (priceless)?
Actually, in Pittsburgh, my old PNCBank branch (just across the busway from Shadyside, I can't remember the street address) had both a single-dollar dispenser, as well as a change cup. It was fed in the same way that I believe those automated change dispensers you sometimes see in banks and at ticket booths get fed - a single slide down which coins fall. I think the manufacturer was NCR, but I'm not sure.
It didn't ever seem to be filled up, but at least one ATM has been designed that could dispense change! I used to withdraw $19, just because I could put the 4 $1 and the $5 into the change machine for the washer and dryers.
The machine also could accept deposited checks WITHOUT AN ENVELOPE. It would scan the front of the check, show you an image and ask you if the scan was valid. If you deposited a check this way, it got into your account a full day faster than if it was in an envelope. I think it must have OCRed the text, as well as read the magnetic information from the bottom. Plus I imagine the workflow for the ATM operator was speedier. Of course, this all ran under OS/2 1.3, as I confirmed later.
Ahh, Pittsburgh, land of the oddball ATMs.
"But always she's the spectre of uncertainty I first endured, then faded, then embraced..."