Slashdot Mirror
Wells Fargo Web-Enables ATMs
smooth wombat writes "Wells Fargo has completed a five-year project to Web-enable its 6,200 ATMs in 23 states. Now the ATMS will be Windows based rather than OS/2 based. Avivah Litan, an analyst at Gartner Inc., in Stamford, Conn., said the move to Windows-based systems is "not great news for the security of the system. I'm sure there's a lot of holes that will be created because of this.""
What was wrong with OS/2 atms?
However, come to think of it, a lot of those things would look better with that Aquarium Screensaver. I think I'll click on the ok download button next time.
Don't blame Durga. I voted for Centauri.
They're going to use Windows Embedded, not Windows XP. Two completely different code bases.
Just because one has security issues does not mean the other will too.
Real programmers can write assembly code in any language. -- Larry Wall
What could possibly go wrong?
I RTFA and have no idea why they did this. OS/2 is not EOL'ed yet. Methinks someone did a snow job on thiese guys.
Help fight continental drift.
Gretings, I am Govermet Minster of Nigeria, and if you send me your PIN you wil share 20% of 1.3 milion American US dolars that I must retrive. THis wil only take a moment since you are already at your ATM.
"We want to make sure our ATMs are integrated with every other channel so when I do a deposit in a [branch] I want to be able to go to [an] ATM immediately and see that deposit"
I do that regularly anyway. An ATM doesn't have to be on "the net" to do that. It has to communicate to the central handling server regardless of it's OS.
This is not a great move. Try and search for 0S/2 exploits even with Google. You're not going to find tons. I sure don't want to use an ATM running Windows and IE where someone that use the security expoit(s) of the month on it.
... darn I hope this gets submitted because my browser crashed when all the results came back.
Search on Windows security exploits and display the results and oh
They can't all be fake, and I have a good feeling about this one.
It's good too, because I needed a place to see MSNBC tickers and movie trailers and also get money at the same time.
Now that this has rolled out on all Wells Fargo ATM's, they will allow you to watch full movies on them and will be opening concession stands. If you pull up to an ATM, and the car in front of you has the windows all fogged up
or else!
Does anyone else remember the end of Sneakers? Because that's what this reminds me of. I'm just thinking about the potential news headlines...
"Wells-Fargo reportedly went bankrupt yesterday. Company spokesman: 'The money... it just disappeared...'
In other news, the EFF is reporting record donations!"
pb Reply or e-mail; don't vaguely moderate.
While it's unlikely that these machines are actually on the internet, but if they are it's probably not a big deal anyways. They'd likely be using some kind of hardware VPN, and even if they weren't they are most likely shutting off all external ports other than their own software, making it no more vulnerable than any other OS they might choose. No open ports, no way to exploit it.
If you need web hosting, you could do worse than here
A couple of weeks ago I saw an ATM that had crashed. It was running Netscape on some version of Windows.
Surely enough, it was made by the same manufacturer who f***ed up US voting machines. I do have some pictures if anyone is interested.
where's all that Karma?
am I the only one who finds the new Wells Fargo ATM key response time to be laggardly?
After I enter my pin, the beep sound and the asterisk that's displayed take so long that I think i've miskeyed, so press again getting a double entry which i have to cancel and slowly and carefully retry.
Is it because of being Windowized, or just bad programming? The old OS/2 ATMs responded instantly.
Stolen from Fark.
"Wells Fargo Web-Enables ATMs. Hilarity ensues."
Job? I don't have time to get a job! Who will sit around and bitch about being broke and unemployed then?
I went to the hole in the wall (ATM) and it was displaying a windows taskbar, a dos window with some process running with a dos full stop sequence progress meter and another McAfee window - I asked in the bank and they said it had been on and off all morning and an "engineer" was trying to fix it.
/. article on UK banks going ove to windoze but I never thought i'd see the day.
;-)
I remember a
Was I ever laughing.
I wonder if my atm card has a virus by now.
PS It was Bank of Scotland
Well I guess an OS and their money are easyily restarted.
Great. As if waiting for some jerk to
- Check his balance
- transfer funds
- buy stamps
wasn't bad enough, now I have to wait for him toOverrated / Underrated : Moderation
I nominate "The Windows-based infrastructure enables remote upgrades" as the loaded statement of the year. Anybody care to take a guess as to who will be writing "upgrades" for these things?
I used to work for IBM in OS/2 TCP/IP support. People would be amazed at how much OS/2 is still out there. Banking, industry, CIA, NSA, Vatican Bank, etc. Heart/Lung machines, ATM machines and the machines that make fritos. When OS/2 went down at friot-lay, no more fritos...not good times. I'm sad to see it go, it was great for apps such as these.
The Windows-based infrastructure is designed to allow Wells Fargo to update and add services such as new languages and envelope-free deposits to its entire network remotely.
Umm... Wouldn't envelope-free deposits require an on-site hardware shift anyway? That is, unless Windows Embedded now runs rapid prototype machinery.
Sounds like they're running WtFXML.
The ______ Agenda
So.... we can either use an OS that we KNOW has security problems, or we can use one that MIGHT have security problems. We can use an OS famous for crashes and instability (BMW's iDrive?) and limited platform availability, or one which runs solidly and reliably on damn near any hardware we want. We can use an OS whose source code is a secret and which we cannot review or analyze, or we can use an OS whose source code is completely open and available for review. We can use an OS who has lost a major IP lawsuit and is hoping to win on appeal (EOLAS v. Microsoft, which I frankly hope MS wins) or an OS which is on the verge of winning a major IP lawsuit and crushing the litigious bastards who filed it out of existence (SCO). Or we could use a BSD.
In any case, it's hard to justify the use of any flavor of Windows on technical grounds. Not when security is a primary concern, which it is if the ATMs are handling MY money. But when were technical issues ever the deciding factor? No, it'll some PHB who doesn't understand or care about the tech who makes the decision based on some saleshole stroking him/her just right...
Of course, that's just my opinion.
Ce n'est pas un vrai mouvement de robot!
..with home PCs.
We put Windows on them and gave them all high speed net access... it wasn't the most successful experiment, and they weren't stuffed full of cash.
Does OSX run outside the box?
Exam 4/C again. Maybe I'll do better this time.
They weren't helpful enough, Well Fargo ATM customers can now look forward to the ATM Assistant(TM)!
"Hi, I'm Clippy, would you like help:
Depositing Funds?
Withdrawing Funds?
Transfer your entire balance to r00m4n14n d00d?
Selecting the proper brick to smash my keyboard with?
A feeling of having made the same mistake before: Deja Foobar
Blue Screen Of Debt
Does this means more pics like these:
Runtime error
Bluescreen
I gave up with the idea of an useful sig...
And a tidbit about some new features:
What are the odds that some idiot will name his mutex ether-rot-mutex!
That can't mean they have more than 3000 in total, as that's only around half of 6046. Even in marketing-land where the margins are bigger, you'd need at least 5000 out of 6000 to claim "nearly all". Logically, this means they must have more than 3000 online stations in each of their 6046 branches. That's over 18 million Windows licenses. Some sales guy at MS just got a new yacht.
Chernobyl 'not a wildlife haven' - BBC News
Existing Windows XP embedded based ATMs, made by Diebold, have already been effected by Windows XP-targetting worms. This should be sufficient to demonstrate that the code bases at least share whatever code caused vulnerability to the Nachi worm. The obvious question then becomes, if and when further holes in Windows XP are discovered, what happens if they too are in the code shared with Windows XP Embedded?
I mean, it's just an awfully funny coincidence that the sudden emergence of the term "cyber-crime" in connection with ATMs just happens, after all these years of computer ATMs, to coincide with the introduction of Windows based ATMs.
And I somehow suspect that in five years, when WinXPEmbedded ATMs are everywhere, if anyone observes it as odd that how ATMs suddenly have a security track record now, we'll have people saying "oh that's just part of the technology, there's nothing you can do about it, it would be the same with any other vendor"...
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
And in a not unrelated story: Hacker takes 3 minutes to get your cash
--
Linux VPS Hosting you can Bank On
now they'll finally test the old adage "No one ever got fired for choosing Microsoft".. when someone gets really fired for choosing Microsoft. Wonder if they'll hold MS responsible for security breaches?
meh
Well, to me it looks like they've got a thin client in front of a J2EE backend.
I think their excitement is the new communications infrastructure: the fact that updates via a teller can immediately be checked on the ATM. They're really happy over their new SOAP/J2EE bits. Of course, all the user sees is the ATM, so it's the only drum they have to bang. They might as well bang it for all they're worth.
668: Neighbour of the Beast
"The San Francisco-based bank said it also installed more than 3,000 online stations in nearly all of its 6,046 branch locations."
How is it that less than half is considered nearly all? Or are they stretching their ATMs so that it is so large that it is physically touching more than one branch, or just building branches next to eachother and throwing an ATM in between?
The math is appaling.
All your searching needs (and free money!) - 4Lancer.net
All your money belong to us!
You can hold down the "B" button for continuous firing.
Blue Sky Of Death
My karma is not a Chameleon.
"I see you have used this ATM before. Would you like me to remember your PIN so you won't have to enter it again?"
There's a Wells Fargo ATM close to where I work, not inside a bank, and the guy who puts the money in it is always accompanied by an armed guard.
I wouldn't trust a bank that had an untrained teller doing that.
Particularly one who is taking instructions from someone over the phone. Yeah, I really trust that system.
What bank do you work for? I want to be sure that I don't have any accounts with it.
Part of security is being correctly trained. An untrained person (problem #1) taking instructions over the phone (problem #2) to service a machine that is "web enabled" (problem #3) is a script for disaster.
First one to install Linux on these machines gets a cookie, not to mention lots of money and some prison time...
The Windoze enabled ATMs do not dispense more than $640. When asked about it, Bill Gates said, "$640 should be enough for anyone."
I work for a mid size bank and we are doing the same thing. We are getting rid of our OS/2 based ATMs and replacing them with ones that run Windows XP. The ATM software is gonna run in IE in kiosk mode. I don't believe that it is our choice to run this configuration. Our ATM vendor is passing this along to us as the new solution to our ATM needs.
The patch management of these things is really becoming a nightmare, and we haven't even rolled them out yet!
What a timely post! Today I got back from a week long contract job and went to deposit some checks at the bank. Well, the local Wells Fargo closes at 4pm and I just missed it by about 10 minutes, so I went to deposit in the ATM. I inserted my card as instructed and voila, a nice windows fatal error message requiring me to click OK, but of course no mouse to click the button with and the Green enter button does nothing. In fact, none of the buttons did anything. Eventually, the ATM rebooted itself and came up with a nice "This ATM is out of service." message, and of course kept my card. So, I called Wells Fargo customer service to find out how long it would take to replace my business ATM card and it's 7-10 business days!!! Ouch! Why exactly am I paying for a business account when I get the same service as for my personal checking account? I don't know. *sigh*
Comment removed based on user account deletion
If it ain't broken, don't fix it. If an OS/2 based laptop is getting the job done, and there is no value add or return on your investment in running a windows/linux on these laptops... is it really worth it? Plus remember, when a new version of Z/OS comes out, it must support ALL the features of previous versions... the ultimate in backwards compatibility.
These laptops run Communications Manager which in some of its abilities can emulate a 3270 terminal.. (yeah tn3270 does the same thing...)
Back in 1992, IBM and the Ontario Govt. prototyped ServiceOntario kiosks to provide DMV services (license plate sticker renewal and dispensation, address changes, vehicle abstracts, fine payments).
Included digital audio and 30fps video. Special hardware was engineered to dispense license plate stickers. Not sure what the kiosks are running today, but in 1992 Windows couldn't cut it. The kiosks (advanced ATMS really) have won awards and have since been deployed into malls around the province.
Read more about government and self-service kiosks here, including US initiatives. If you think about the nature of transactions being performed, such kiosks must be connected to multiple government networks, yet be located in public spaces. Legal, technical and process innovations were required to make this hybrid device possible.
Presumably the ATM/Windows XP part of the box is *not* connected directly to the network. That there is a VPN box/pair between the ATM and the home networks...
ATM -- VPN -- Internet -- VPN -- Wells Fargo
So the real question is how secure are THOSE boxes...
Invariably, the ATMs have to talk to the Bank's internal network at some point. Even over a VPN, you can have a propagation of a worm... That's how the last little inconvienence against Windows based ATMs happened. The worm got a machine on the inside of the Bank's LAN and propagated to the ATMs that were Windows based- right over the VPN.
It's a big deal. If it's going to be web-based on it's controls, etc., it will have exposed ports.
Simply put, Windows really, really isn't suitable to task for this sort of job. Never was. As far as Microsoft's track record shows, it never will be.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
They make ATMS don't they? And no-one else would be stupid enough to put them on a public network when it is so easy to put them on a private network like we have now. How many dollars per machine do you need to save before it offsets the PR loss when the media reports instances of your machines getting owned? I suspect they won't be saving much at all per machine by putting them on the public network. If this sort of stupidity continues those bad movies about hackers getting into systems that should never be on a public network may become reality.
The ATM makers are making themselves obsolete. By providing low security publicly accessible terminals running windows, they've made them less secure than your home computer doing internet banking. Because, at least when it's in your house, you can do some due diligence in ensuring that your computer is secure. The only reason for ATMs is for getting money. Which is of minimal importance when just about everyone accepts bank cards for payment. You could even visit the bank once a week and take out cash for those smaller transactions where you can't use the bank card.
Anthropic principle: We see the universe the way it is because if it were different we would not be here to see it.
US banks are going to start using ziplock bags instead of safety deposit boxes and "very strong wooden boxes" locked with Master brand locks instead of vaults. And instead of expensive security vans to transport money, they'll be using bike curriers. More news as it develops.
If someone says he and his monkey have nothing to hide, they almost certainly do.
The Otto-ATMs in Finland have been running Windows NT 4 for years. AFAIK, the UI itself is a Java-applet running in Internet Explorer.
And yes, I've seen the IE on them crash, leaving the standard NT4 desktop, error dialog, and a command prompt window.
Scary.