Slashdot Mirror
Researcher Discovers ATM Hack, Gets Silenced
Al writes "A researcher working for networking company Juniper has been forced to cancel a Black Hat presentation that would have revealed a way to hack into ATMs. The presentation focused on exploiting vulnerabilities in devices running the Windows CE operating system, including some ATMs. The decision to cancel was made to give the vendor concerned time to patch the problem, although the company was notified 8 months ago. The article mentions a growing trend in ATM hacking: In November 2008 thieves stole nearly $9 million from more than 130 cash machines in 49 cities worldwide. And earlier this year, the second biggest maker of ATMs, Diebold, warned customers in an advisory that certain cash machines in Eastern Europe had been loaded with malicious software capable of stealing financial information and the secret PINs from customers performing ATM transactions."
...it must be pretty abstract, since an "automated teller machine machine" is apparently running in emulation anyhow.
So they've had 8 months warning, and now suddenly when researchers want to publish they now want time to fix it? Not indicative of a company that gives a flying fuck about security. They don't deserve time.
Is why everyone cares so much about Money. It's just pieces of paper and little bits of metal. What really matters is Love! If people stopped worrying about money then maybe there wouldn't be so much poverty and swine flues. Also, I read that Linuxes are free, so, again, we don't need money anymore, since our computers are free! Look at the big picture, people.
UNITE with the Campaign for a Free Internet because today, our future begins with tomorrow!
I can't believe that people use WinCE for a real world application that requires security and reliability. The morons who built these systems are reaping the reward for their ignorance.
I don't read your sig. Why are you reading mine?
You don't need a conference to publicize a security problem. Post it on the internet, and the vendor will have plenty of incentive to implement a fix immediately.
Give me Classic Slashdot or give me death!
Everytime I see "ATM" these days I think "Anal to Mouth".
I need to stop surfing the Diabolic site....
Sig Follows: "Suppose you were an idiot. And suppose you were a member of Congress. But I repeat myself." -- Mark Twain
If we estimate that world wide, only 8 million dollars was stolen out of ALL of the ATMs that are out there, I would think that that's actually a success, more than a liability.
I mean, people steal more than that in cars, in what, every few hours?
This is my sig.
It is quite unsurprising, really. We see the same thing going on in the SCADA security space. The book, Hacking Scada: Industrial Network Security From the Mind of the Attacker , has been held up for at least a year past it's original planned publication date for similar thinking.
I am not merely a "consumer" or a "taxpayer". I am a Citizen of the State of Texas
What? They put Windows on ATMs? ...and they're still surprised people are hacking them?
so diebold's ATMs are as good as their voting machines!
... I know in my heart that John Conner is to blame. Or at least his mom, for teaching him how to hack ATMs. What I don't understand is this: why did John Conner only withdraw 3 dollars?
They are now much easier for the disabled to use. While it was possible for someone who was blind to use an OS/2 ATM, it relied more or less on memorizing what to do. The buttons had braille on them but there wasn't really any feed back other than beeps. So it was a situation of memorize the key presses to do what you want. New ATMs have headphone jacks and can give audio feedback, allowing those with vision problems to use them much easier.
It's an ATM.
It reads a card, checks your balance and pokes money out a slot.
What increased functionality is there?
(well, yes, it takes in deposits, too, but...)
Really, why aren't these things running the most limited OS possible?
Running WinXP on them is just silly. I would have thought WinCE would
be more locked down, but apparently not.
The comment about OS/2 machines being more secure is interesting.
I'd rather have IBM running my cash machines than Microsoft.
Hiding security holes doesn't mean they aren't there. Everyone knows that a bank has a fairly obvious security hole - most people would rather hand the money over vs. getting shot, so bank robbers tend to burst in guns blazing and then make off with tons of cash. Since that's public knowledge, it's easier to defend against such tactics. Hiding that would make both the bank and its customers more susceptible to gun-toting robber attacks, since they would be unprepared for the unknown.
stuff |
It's unfortunately not too odd to hear that ATMs run Windows (especially with some of the error messages I've seen). But there are even odder devices running Windows.
I work at a somewhat-hated international retailing chain that will go unnamed, and while working there the other night my merchandise scanner, one of the portable hand-held ones used on the floor, froze. Not uncommon, but when I reset it it booted into Windows CE. A normal windows desktop. I tried starting Windows Media Player, but it wouldn't do anything. The funny thing is that when it works properly, it uses minimal ASCII art and no graphics at all.
Why these kind of things need to use Windows is beyond me. Windows, security issues aside, is alright for general purpose machines, but not highly-specialized machines like a scanner or ATM.
. . . from TFA:
The operating system used in the affected system, Windows CE, poses hurdles to a quick fix. Microsoft recommends that Windows CE is used for "low-end cash-dispensing ATMs," while Windows XP Embedded and Windows XP Professional are used on more full-featured ATMs, according to a white paper on kiosk and ATM operating-system platforms issued by the software maker. Windows XP Embedded, the latest version of which is Windows Embedded Standard 2009, and Windows XP Professional are more secure because they are easier to update, the software giant says.
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
For those of you who aren't aware, the Black Hat tradition for vulnerability presentations which have been similarly blocked due to court orders, etc. is to offer BH a replacement safe/bland presentation and then deliver the banned exploit demonstration regardless. This action typically results in a large lawsuit against the researcher's employer, subsequent termination of the researcher, and a short-lived rock star notoriety for the researcher making the afore mentioned termination totally worth it.
The article is transparent in saying that he chose to cancel his own presentation on his own volition, because it hadn't been fixed yet.
No kidding!!! What do you say at this point?
Do you have any idea what the QA procedure would be for a release of baking software?
The QA cycle on it alone would be 6-12 months. Then you would need 6-12 months to roll it out to all the ATMs globally.
I reckon time is exactly what they deserve, I'm sure we could make room next door to Mahdof. Perhaps they will discover the alternate meaning of ATM first hand while there, as taught by the ever present Big Bubba and colleagues.
;)
Oh, wait....you meant time to fix the problem. My bad
So, did anybody factor this into those Total Cost of Ownership (TCO) figures?
1. Cost to find security flaws
2. Cost to fix security flaws
3. Cost to deploy fix
4. Losses due to security flaw exploits
5. Cost to suppress black hat who's going to tell the world how to #4 with style
6. ???
N. PROFIT!!!11!1!elevenone!
Pretty much the only reason I trust an ATM is that I can visually verify that it gave me the right quantity and denominations of cash, and/or it printed out a deposit receipt. If I was blind I wouldn't want to use the fracking things, I'd go to a teller I trusted.
I only read this on another forum so take with a grain of salt.
The hack is based on the assumption that if you make a withdrawal from an ATM and don't take the money you forgot to take it, so the machine takes the money back and refunds the amount to your account.
The thing is that the machine doesn't have a way to count how much bills it takes back, so you can just take the bills from the middle and you will get a full refund.
Supposedly this also works if you take the money right before the ATM pulls back in the money.
Obligatory
ATMBSOD
http://www.chrisb.com.br/blog/wp-content/uploads/2009/03/blue-screen-of-death-atm.jpg
Not sure where you see that. As far as I know Diebold, Wincor, and NCR only put out drivers for Win XP for their ATMs. This is a Win CE bug, it's probably a white-label machine.
no Diebold CHose to use WinCE as a cheap platofrm. Prior to that they had another platform that was not windows based. they chose Wince and its cause multiple problems precisely because they willing delegated the security.
Some drink at the fountain of knowledge. Others just gargle.
Despite the exploit being out there, there is likely only a few malicious people that know about it.
And if those people wanted to get rich off it, which would be easier and safer: to hack a bunch of ATMs themselves, or to sell the secret to organized crime?
Breakfast served all day!
"A new car built by my company leaves somewhere traveling at 60 mph. The rear differential locks up. The car crashes and burns with everyone trapped inside. Now, should we initiate a recall? Take the number of vehicles in the field, A, multiply by the probable rate of failure, B, multiply by the average out-of-court settlement, C. A times B times C equals X. If X is less than the cost of a recall, we don't do one."
:(){
(a. k. a. "Binging") on the Web.
Why would I "binge" on the web? Do I then need to "purge" my cache?
Sorry, Steve. Your attempt to verb your new search engine will be thwarted by literate people.
"I know that every word that man just said is true, because it's EXACTLY what I wanted to hear." -- Space Ghost
and Russian cracker ring sites very soon. :)
If not already. Wait, I'll go look. I could use some money! I like money! Maybe I could buy a latte with it. With extra cream! Cuz I like sex too!
Any sufficiently advanced intelligence is indistinguishable from stupidity.
You've made the classic mistake ...
Starting a land war in Asia or going up against a Sicilian when death is on the line?
(Inconceivable!)
Hackers won't wait.
Working in the banking software industry myself, I can tell you that anything associated with ATMs is incredibly slow to change. Unlike, say, computerized voting, ATM software generally has to go through scads of certification and changes. Usually 2-3 companies must actively collude to provide the entire system, if not more, and all of them have to have their systems certified in turn.
To make matters less urgent, everything is traceable. For a bank, culpability (accountability if you pardon the pun) is more important than theft prevention. I don't mean that the actual thief is found, but rather, that there's a log of every transaction and operation.
No urgency and a huge barrier to change, coupled with a very low rate of occurence - not really a 'real' problem.
WinCE deserves whatever comes their way. There is NO reason that an ATM can't run the FREE embedded Linux kernel and a custom banking app.
" director of corporate social media relations for Juniper" so.. you get paid to F off all day and talk to your friends on Twitter and MySpace all day... And get paid for it? Juniper needs to get their act in gear and pay some people to WORK.
A consumer operating system does NOT belong on an ATM nor any other critical systems for that matter.
Putting windows on an ATM is just inviting bad guys to the table.
They couldn't find something more stable and secure?????
Think of how stupid the average person is, and realize half of them are stupider than that.
Boy, there's a uid that's a blast from the past.
Jesus was all right but his disciples were thick and ordinary. -John Lennon