USB Sticks Used In Robbery of ATMs

First time accepted submitter JeffOwl writes "BBC is reporting that thieves are infecting ATMs with malware using USB sticks. The malware creates a backdoor that can be accessed at the front panel. The thieves are damaging the ATM to access a USB port then patching it back up to avoid notice. This indicates that the crew is highly familiar with the ATMs in question. Once the ATM is infected, the thieves use a 12 digit code to bring up the alternate interface. The thieves, not wanting their crew to go rogue, have built a challenge-response access control into their software and must call another member who can generate the response for them."

Comments

That's what you get

[fisted]

That's what you get from running Windows on ATMs, lol.

Re:That's what you get

[Anonymous Coward]

Mod parent up! Linux machines are impenetrable, even if an expert has physical access. This is why Torvalds gets so aggressive: he keeps locking himself out of his testing machines and has to buy new ones.

Re:That's what you get

[fisted]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun.
Furthermore, you presumably wouldn't get administrative access.

Re:That's what you get

[Spy Handler]

no, this is what you get when you put a USB port on a frigging ATM. Whose bright idea was that anyways?

Re:That's what you get

[dugancent]

My bank still uses os/2 on their ATMs.

Re:That's what you get

[wvmarle]

Making it easy to install upgrades? Or to connect say, a proper keyboard, to do maintenance?

USB stick is better than over network as physical access is needed. And in this case, they indeed had to physically break the ATM to gain access to this USB port.

Re:That's what you get

[DaHat]

Yes, because it's impossible to configure Linux to auto-mount all new devices, check for the presence of a specifically named file and execute commands within.

Re:That's what you get

[asmkm22]

The USB port is pretty well hidden and secure, which is why the article points out the fact that the thieves appear to be familiar with the machines enough to know where and how to best break that part open. Even the best of security measures won't hold up against an inside job.

Re:That's what you get

[Anonymous Coward]

"However, they added that the approach did not extend to the software's filenames - the key one was called hack.bat."

wake me up when it's called hack.sh

Re:That's what you get

[The Grim Reefer]

My bank still uses os/2 on their ATMs.

Do they also wear "Team OS/2" t-shirts?

Re:That's what you get

[lgw]

That's what you get from running Windows on ATMs, lol.

No, it really isn't. I've seen this demo'd at a security conference, and the OS has nothing at all to do with the attack. ATMs have a USB port which can be used to replace the firmware. The port is behind a simple lock, not in the vault with the money.

This attack replaces the OS on the ATM with the image the attacker provides. What the OS was before the attack really isn't all that relevant. The fact that images aren't signed or anything is.

Re:That's what you get

[ericloewe]

Same autorun that is now disabled by default and was always trivially disabled?

Re:That's what you get

[Anonymous Coward]

Uh, no... most run OS2 Warp... plus, in order to do this with most ATMs, you would have to crack the safe to get to the actual computer. This probably refers to the little cheesy ATMs at most gas stations. Their computers are in the upper part, and NOT behind the same safe that protects the money. ...yes, I used to be an ATM tech...

Re:That's what you get

[camperdave]

Color me puzzled, but if you already have already physically broken into the ATM to gain access to the USB port, why not just grab the cash instead?

Re:That's what you get

[ericloewe]

ATMs generally run on commodity hardware and a commodity OS (most I've seen are Windows NT 4.0 and newer).

Re:That's what you get

[cusco]

I'd be very surprised if the "alternative interface" isn't installed by rebooting the machine off the USB stick. The Diebold voting machines were configured to preferably boot off a USB, and Diebold is still the largest manufacturer of ATMs in the US.

Re:That's what you get

[Nkwe]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun. Furthermore, you presumably wouldn't get administrative access.

It doesn't require autorun. A usb device that emulates a keyboard or other input device would do the trick. Send the keystrokes necessary to break in. Think Linux is immune? How about the keystrokes necessary to reboot the machine and start up in single user mode? Even if single user mode has been protected, the usb device could provide both keyboard emulation and cdrom emulation -- during reboot the hack could boot to alternate media. The real fail is a design that allows access to the hardware (physical access is full access) and not the choice of operating system.

Re:That's what you get

[robmv]

It is probably a fake keyboard and mouse device, many of those ATMs run their applications with administrator privileges, so anything can be run with that kind of device

Re:That's what you get

[Anonymous Coward]

I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?...)

(posting as AC due to non-orthodox opinion favoring Windows over Linux.)

Re:That's what you get

[BosstonesOwn]

Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.

Re:That's what you get

[Anonymous Coward]

not impossible to do stupid thing X on OS Y != very hard to get OS W not to do stupid thing X

Re:That's what you get

[Anonymous Coward]

that is like saying "this is what you get when you put currency inside."

Well, yeah. but the machine is supposed to withstand physical assault. the USB interface that was locked away inside is no different from the cash that was locked away inside: secure unless you break in that far.

Re:That's what you get

[Joce640k]

You know how I know you didn't read the article?

Hint: It runs a file called "hack.bat"

Re:That's what you get

[jeffmeden]

I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?...)

(posting as AC due to non-orthodox opinion favoring Windows over Linux.)

Go ahead and take your head out of your ass, and re-read his comment: "Yes, because it's impossible to configure Linux to auto-mount all new devices, check for the presence of a specifically named file and execute commands within.

Emphasis mine. Linux can easily auto-mount thumb drives. Many distros have it enabled out of the box. What you wont find is any that scans the drive for things to run and then does so, with elevated privileges (something present in many recent versions of windows). Having an easy way for an attacker to steal/destroy all the data on a machine might seem like a "Feature" but it sure seems primitive... (if you need examples, confirmed attacks via unwitting use of an infected USB key on windows systems are plentiful.)

Re:That's what you get

[TWX]

I think that it's stupid to allow the USB port to do anything more than provide a Human Interface Device level of access to the OS unless credentials are entered in to the machine to enable those features.

Or, in layman's terms, AT BEST the USB port should only work for a keyboard interface as a prompt for a password until the operator is authenticated.

It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default. It should not give the OS kernel access to media plugged into it. It should CERTAINLY not automatically engage media plugged into it to read it. Arguably, it shouldn't do ANYTHING even with a keyboard plugged in until the technician servicing the machine has otherwise entered passwords, like on an internal keypad.

Re:That's what you get

[MBGMorden]

I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?

Um - I plug a USB stick into my Linux computer and an icon pops up on the desktop named "USB Drive" (or whatever name it has) that I can double click and do whatever I need.

I'm guessing that if you were actually trying to read an honest to goodness floppy disk it was more than a "few years ago". Linux has come a long way. The "year of Linux on the desktop" was 5 years ago for me.

Of course my parents called me to come look at their (Windows) computer a while back because it wasn't acting quite right, and I was reminded of the headache of spyware and malware. I had forgotten such things existed while using Linux.

Re:That's what you get

[TangoMargarine]

Yeah, but you don't have to give it up to the first male USB connector that comes by.

Re:That's what you get

[fisted]

Sure, but then, you wouldn't do that on an ATM. Much like you apparently wouldn't bother to disable autoplay for Windows based ATMs...

Re:That's what you get

[jeffmeden]

Because that part of the atm is heavily protected, whereas the usb port is behind a plastic panel.

All of the flames about windows vs linux are a red herring. This is the real design flaw. Any design that assumes the USB interface to the software is not just as important to protect as the cash itself completely ignores why they would ever put the USB port on there in the first place (to make material changes to the ATM software).

Re:That's what you get

[TWX]

You mean, the trick I use on the computers I support, by password-protecting the BIOSes and restricting boot to the fixed disk only, a trick that I've used for about twenty years, was ignored on commercial-grade equipment that's responsible for the basic security of our form of government and of our financial system?

Say it ain't so...

Re:That's what you get

[TangoMargarine]

I'm pretty sure Ubuntu (and derivatives) have add the "auto detect plugged USB, put icon on desktop, double-click to mount" practically since I started futzing with it back in 2007...and if you're going to say "Year of the Linux Desktop," you pretty much mean Ubuntu.

QED.

And even Windows machines don't generally have floppy drives anymore, right?

Re:That's what you get

[Anonymous Coward]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun.
Furthermore, you presumably wouldn't get administrative access.

I hear you can plug keyboards in through USB now.

Re:That's what you get

[AK Marc]

So it's impossible to set up a Linux system to mount a USB stick and run a specific file, if present? Sounds like a lame OS.

Based on the limited information, it looks like it was setup as a recovery/maintenance feature that required physical security, and physical security was compromised. Sure, for "security" you could program all ATMs to self destruct on any OS halt, but I'm not sure that would be in the best financial interests of the owning company.

Re:That's what you get

[Skiron]

Yes, and I have seen many a BSOD on a few in my time - and once one that had dropped to the desktop with a message (and mouse cursor) 'Reboot Now? [Ok] [Cancel]'. Bloody joke whoever put MS stuff on them.

Re:That's what you get

[Anonymous Coward]

most bank of america atms use windows, this is due to some worm virus that shut them down,

if they cared they would use linux, which many gambling machines use

Re:That's what you get

[bickerdyke]

Which really begs the question which idiot designed the machine with a USB port for updates and NOT protecting it properly!

Re:That's what you get

[Anonymous Coward]

Have a look at BadBIOS http://blog.erratasec.com/2013/10/badbios-features-explained.html, which infects BIOS by merely inserting a reprogrammed USB flash drive. It works on OS X, which is a certified Unix. And to know how easy it is to reprogram the firmware of a managed flash (SD card, USB flash drives), check this post from few days ago http://www.bunniestudios.com/blog/?p=3554

Re:That's what you get

[Anonymous Coward]

I know one bank in the UK that ran Windows XP ATM's a few years ago, as indicated by the boot sequence after I got a Microsoft C++ runtime error, caused by entering an amount it could not deliver using the available note dominations.

It would not give my card back until I pressed [OK], which was not possible with the physical buttons I had available.
The bank did not open for more than an hour, and it took another hour for someone to arrive who knew how/where to power-cycle the ATM.

An USB-port where I could plug in a mouse would have been very helpful :-)

Re:That's what you get

[durrr]

I guess this was a...
STICK-up.

Re:That's what you get

[cusco]

You should read up on what a security nightmare the voting machines are, it's appalling. Doesn't help that there are a dozen or more manufacturers, all of them being sold on the basis of friendly back slaps with local politicians rather than actual analysis of the hardware and software (which is always closed source). Testing procedures are a joke, by design, and even systems that fail testing get sold on the promise of an update in future firmware versions. Don't overlook punch card counters either, they put out by far the largest deviations from exit polls of any of the machines.

Re:That's what you get

[mlts]

CentOS will automount removable flash drives under the /media directory. Similar with optical media. One can disable this so media will need manually mounted to be used. It won't run or execute anything on the drives though... just mount it and have it usable for the user.

Re:That's what you get

[Archangel Michael]

With properly managed devices, USB is disabled. This is an option, even in windows. And it is even an option at the BIOS/UEFI level on some systems. However, I wonder why they aren't using some soft of VDI for protecting the ATMS. This would prevent any direct access to the hardware running windows.

Re:That's what you get

[cr_nucleus]

No directly related but that reminds me of the time i saw an EJB error displayed on a credit card terminal :-)

Re:That's what you get

[wvmarle]

That'd mean a lot more destruction to the ATM, and as a result instant detection of the crime. Instead of days or weeks later when the number of notes in the machine was compared with the ledger (no idea how frequently that's done).

Re:That's what you get

[mlts]

eCS/2 (eComStation, the company that is maintaining OS/2) still is used in some ATMs. If the OS works, is well maintained, and has earned its bones, why change? ATMs have not changed much in 10-20 years, other than maybe display a news blurb or the daily weather on the demo screens. Might as well keep with what works.

Re:That's what you get

[Penguinisto]

Err, not really. If we're building a *nix ATM, then you can fix it in one go: If the USB port requires elevated privs just to mount/use anything plugged into it (say, a long numbered sequence entered from the ATM keypad, unique to that machine, that would translate to a variation of "sudo /bin/mount"), the whole USB stick trick falls flat.

Not sure if there would even be a feasible analog for that in embedded XP/CE/WE

Re:That's what you get

[mlts]

The ironic thing is that even the cheapest, no-name Android phone has better protection than ATMs against this avenue of attack, assuming a bootloader with a signing process.

Re:That's what you get

[i kan reed]

Windows doesn't do that anymore either. It gives the user an option to invoke autoruns, but doesn't trigger them.

Attacks on USB tend to target the drivers these days, not the OS.

Re:That's what you get

[Anonymous Coward]

They could use a different connector, one maybe less commonplace than USB. Also, it is possible to obtain ATMs and reverse engineer them.

Re:That's what you get

[Anonymous Coward]

The question to ask is not under whether every connection to the USB port should allow such access, but whether any such connection to the USB port.

Personally, I think it's criminally stupid to give potential ATM technicians passwords to enter, but hey, you do things your way.

Re:That's what you get

[Jah-Wren Ryel]

It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default. It should not give the OS kernel access to media plugged into it. It should CERTAINLY not automatically engage media plugged into it to read it.

There is at least one exploit out there that relies on fragility in the USB firmware - the code that auto-negotiates with a USB device when it gets plugged in, sets up the bus, etc. The exploit works by sending unexpected data (buffer overflow, out-of-range values, etc).

That kind of exploit works even if the OS does not autoplay or even automount.

Re:That's what you get

[TWX]

I have read on them, actually. I figured the "Say it ain't so" would have conveyed the sarcasm of the previous paragraph.

I like optical scan, where the voter draws a line between arrowheads next to the name of the candidate or their position on the question. I like it because it can be machine-counted for speed, and can be human-counted when there's a dispute or an automatic-recount based on the closeness of an election. It is, by default, its own paper trail.

Re:That's what you get

[Joce640k]

It's CRIMINALLY STUPID for the USB port to provide any other kind of access by default.

Remember: This feature was brought to you by the same company who thought it was a good idea to execute .exe files attached to emails without even asking you.

Re:That's what you get

[ottothecow]

Also, since some of the peripherals are USB, you might be able to hijack a connection there.

Crack open the keypad area, cut the wires and connect them to your device (also defeats anything that tries to use a non-standard connector). Twist the wires back together when you are done (it isn't like you are trying to reconstruct the wires from a parallel port...usb is easy). If the keypad is still needed, then you hijack the receipt printer or you add a USB hub to your device and hook the keypad up to that.

Re:That's what you get

[cusco]

Running *nix on ATMs would go against the banks' standard practice of 'low bid always gets the job.' Keep in mind that these are the same organizations who allowed access to any account configured for online banking simply by changing the account number in the address bar of the browser (and then left it that way for years). Had an instructor who did pen tests for financial institutions, the stories he told were depressing.

Re:That's what you get

[Joce640k]

They're federally insured so they don't care...

Re:That's what you get

[Anonymous Coward]

If they'd been really, really clever they would've made the no. of notes match the ledger by adding amounts to normal withdrawals to match the stolen total. Then it would've taken even longer to detect since how many people look at their accounts and recall with certainty how much they withdrew and when? With such certainty that they call the bank and ask WTF?

Re:That's what you get

[Anonymous Coward]

The USB port is enabled to write the Electronic Journal when Brinks or whoever comes by to refill the ATM. The copy of the journal is then given to the institution responsible for the ATM.

Re:That's what you get

[jandrese]

I would like to say that I'm shocked that they don't use Trusted Computing principles to build ATMs, but I'm not. This stuff is built by the lowest bidder and designed to be installed and maintained by low end wage slaves.

This isn't necessarily an inside job either. These guys could have stolen an ATM whole at any point and taken as long as they needed to reverse engineer the thing, dumping the old firmware directly from its internal storage and everything. A quick patch to the dumped firmware and they're off to the races. Of course if this thing were properly built all of the firmware would be encrypted and signed, but again, lowest bidder.

The scary thing is that electronic voting machines are built by the same companies, to the same level of security, and it's literally impossible to know if they have been compromised because we use secret ballots. Worse, the machines were designed not to be auditable after the fact. If you were trying to design a system that let an insider steal the vote, you would have a tough time coming up with something better.

Re:That's what you get

[Obfuscant]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick.

My Acer netbook reflashes the BIOS if it is turned on with a USB stick containing a file of a certain name in place. If you control the BIOS, you control the computer.

This feature truly is a good thing, since turning the netbook off improperly while running some linux versions bricks it.

Re:That's what you get

[Anonymous Coward]

no, this is what you get when you put a USB port on a frigging ATM. Whose bright idea was that anyways?

Whoever came up with the cheapest design for an ATM?

Besides, if we consider all the factors that affect the security of an ATM, the physical design of the maintenance port is the least important consideration. The port shouldn't be any more easily accessible than the cash inside and the flaw is not the design of the port but that it was accessible. Furthermore, if they knew enough about the design to do this, they would probably have had access to enough information about whatever proprietary alternative port would've been used instead.

However, if I engage in speculation about how this was done, I wonder if they got information from some inside sources or if an ATM has been physically hauled away at some point and studied in detail. I recall that a couple of decades ago in my country, Finland, there was a gang of brothers that stole an ATM by putting a chain around it and pulling it out with a tractor. They were complete idiots but these criminals are clearly smarter and that would be an alternative way to get technical information about an ATM.

Re:That's what you get

[Obfuscant]

Color me puzzled, but if you already have already physically broken into the ATM to gain access to the USB port, why not just grab the cash instead?

Because that would be easily detected and would be a one-shot win. By grabbing account data from every person who uses the machine you can clean out accounts -- which would be a lot more than the cash in the machine.

Re:That's what you get

[sconeu]

One of the few situations where Treacherous Computing actually makes sense.

An ATM should only boot a properly signed OS, and only run signed executables. In this situation, the computer is more of an embedded system, and should not be treated as a general purpose computer.

Re:That's what you get

[Anonymous Coward]

Other than HID, the purpose of the USB port is to support flash drives to write a copy of the Electronic Journal, not updates. Most ATMs still have optical drives. In general, ATMs aren't updated, they're rebuilt or reimaged, sometimes with newer software. The ATM manufacturers and support companies don't like updating "working' systems. To the best of my knowledge, only multi-billion dollar asset financial institutions maintain their own ATMs while everyone else either outsources the servicing and the entire ATM. All of which means, you're unlikely to find any ATMs with updated Windows patches, much less something like a supported WSUS installation.

AFAIK, all OSs have issues with USB because it supports DMA. Some OSs can probably do a better job mitigating any damage but USB is still a weak spot.

Re:That's what you get

[robmv]

so? an executable name tells you it was an autorun? it could have been a USB subsystem buffer overflow or any other vulnerability, or a USB HID device that injected Win_Key+R and typed d:\hack.bat. Many options

Re:That's what you get

[TWX]

Yeah, I forgot about that. I had ducked 100% into Linux for about five years and hadn't had to contend with that era of stupidity.

Had that new laptop not had problems with Linux (the clock would advance strangely and inconsistently, which broke just about everything attempting to run eventually) I probably wouldn't have fallen back into the MS path of least resistance.

Re:That's what you get

[Anonymous Coward]

I've seen Windows 95. And it wasn't that long ago considering. ATM flaked out rebooted and hung at the 95 logo screen. Wells Fargo kiosk, Monrovia, CA around 2005 .

Re:That's what you get

[cusco]

Of course when you can't access the actual ballots except with a court order, and you can't get a court order without some proof that wrongdoing has occurred, the paper trail is kind of moot.

Re:That's what you get

[JeffAtl]

ATMs don't store meaningful account data. That data is held by the banks and transmitted via the processors. That is why ATMs don't work when they aren't connected to the network during a communication outage.

Re:That's what you get

[Anonymous Coward]

and everyone is missing the most important point of TFS: They've got physical Access - Reading Comprehension Failure/Game Over.

I call BS on TFS as physically damaging most ATM's is going to leave fucking traces. Instead, what I suspect is happening is that a few replenishment/repair techs have decided to compromise a whole series of machines over a period of time, which is why TFS states to "Prevent one of them from Going Rogue". BS right there and link bait to boot. How many units have been compromised? Maybe it's just been discovered after folks have already drained the money from the machines.

Another and far more insidious method would be to craft a card that activates the programming (looks like normal ATM usage) that once the alternate programming is active, does not record the transaction and overrides the normal withdrawl limits.

Fast Turtle

Re:That's what you get

[Anonymous Coward]

So, in the future, put the USB port INSIDE the safe.

Disabling autorun is great, but won't stop a usb keyboard emulator (such as the Teensy line of devices). Also, it would appear that these thieves did need to enter some information to get the code to run, so it may not have been a simple matter of relying on autorun anyway:

To activate the code at the time of their choosing the thieves typed in a 12-digit code that launched a special interface.

[http://www.bbc.co.uk/news/technology-25550512]

Locking Single User mode is also good, but as others have pointed out, you can get the device to reboot from the usb stick presumably, making that a moot measure.

BIOS locking...well, that frankly should have worked, as I would hope they didn't have access to the on-moitherboard lithium battery which, when removed, resets CMOS settings. But apparently, they didn't go this route for some reason or other (lacking more knowledge of the hardware involved leaves me unable to comment on whether this was an egregious oversight or merely an unfortunate restriction of the hardware in use).

In all cases, however, if the USB port were inside the cash safe, there'd be no feasible way for anyone to hack the ATM without FIRST having access to the cash to begin with. Is it a matter of not trusting the folks doing maintenance? If that were the case, then software shouldn't be able to dispense cash to begin with (kind of an unlikely luxury, given that the whole point of the ATM is to use software to dispense cash...).

On a completely separate note, I have to be left wondering if they were using the same usb interface ATM exploit that I heard about a solid year and a half ago or more that was covered at DEFCON...

Re:That's what you get

[fisted]

Ehhhh, what? Plug in the the pretend-to-be keyboard and then? Bruteforce the root password?
You do realize unix is a multiuser system right? Well, of course you don't.

Re:That's what you get

[fisted]

And i don't think you realize that the keyboard will talk to login(1), initially. Have fun convincing it to grant you access.

Re:That's what you get

[fisted]

Obviously it's easy to do so, given it's an open system. There are probably 5 different ways of doing so.
You're missing the point, though -- the point is, windows does it *by default*, while unix doesn't. (I'm sure linux will, some day)

Re:That's what you get

[Anonymous Coward]

you mean from the FRONT?

Re:That's what you get

[Anonymous Coward]

Maybe he was planning for his retirement?

Re:That's what you get

[LifesABeach]

Also, I would strongly suggest to not refer to females close by as a "Skankaty Skank Skank."

Re:That's what you get

[Nkwe]

Ehhhh, what? Plug in the the pretend-to-be keyboard and then? Bruteforce the root password? You do realize unix is a multiuser system right? Well, of course you don't.

I absolutely realize that unix is multiuser. I also know that on multiuser systems the physical console of the machine typically has special access. As mentioned above, one could send a keyboard sequence that reboots the machine -- say maybe Magic SysRq or maybe even a simple CTL-ALT-DEL. Sure, the configuration may have disabled these things, but probably not. When the system reboots, keystrokes can be sent to the BIOS directing it to boot off of your USB device (before the OS reloads.) Since presumably the attackers have intimate knowledge of the hardware (they know where to find the USB port), they could likely figure out the timing involved in driving the system through a reboot and alternate startup.

Re:That's what you get

[Anonymous Coward]

Really? What product was this?

Re:That's what you get

[whoever57]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun.

I recall a study that showed that vunerabilites in the programs that create thumbnail images could be exploited if a sufficient number of malicious images were on a thumb drive that was plugged in (the exploit required multiple attempts, which could be delivered via a large number of files to be processed for thumbnails). However, this requires a destop system to be running and monitoring for new media being plugged in.

Furthermore, you presumably wouldn't get administrative access.

If the kernel isn't kept up to date, it probably has a local root expoit.

Of course this assumes that a desktop system is running on a embedded Linux system, which seems unlikely.

Re:That's what you get

[Anonymous Coward]

Flaw? Since when is intentional design a flaw?

Re: That's what you get

[Anonymous Coward]

USB doesn't support DMA, you might be thinking of Firewire.

Re:That's what you get

[Khyber]

So.... you did read the part that says these thieves have intimate knowledge of the ATM, and thus know your entire tirade is pretty much pointless and void in light of this fact, right?

Re:That's what you get

[cusco]

The lowest bidder, of course.

Re:That's what you get

[Obfuscant]

ATMs don't store meaningful account data. That data is held by the banks and transmitted via the processors.

I didn't say the ATM stored the data. I said "By grabbing account data from every person who uses the machine". When you stick your card in the face of the ATM and enter your pin code, the COMPUTER processes that and sends it over the net. Oh, look, the BIOS has been hacked so that it sends your account data and pin out over that network to someone in China. They're getting everything that appears on your magstripe, not just the account number. From that they can duplicate your card.

If I get your account data, I can clean out your account. If I get a hundred people's data, I can clean out 100 people's accounts. You probably won't notice I've done that until your next statement comes out, or if you try to make a withdrawal the next day and cannot. I might not even make the first illicit transaction for a month so nobody will know for a month.

If I pull all the cash from the machine the bank will know that as soon as it happens. The machine will report back to mama "I'm empty, come feed me." They won't even have to send anyone out to see the pry marks, they'll know there is a problem because the record of withdrawals won't cover the amount of cash missing.

So THAT'S the answer to the question "why not just steal the cash".

Re:That's what you get

[Anonymous Coward]

Yes but without interaction (by a user or admin) it isn't going to mount and run by default.

Re:That's what you get

[TangoMargarine]

Yes, which is a good thing.

Re:That's what you get

[icebike]

Every transaction is video recorded, so why would there be any mystery about how they got at the USB port?
It seem most likely that servicing agents (people who refill the cash machines) have, or had someone on their staff that slipped these sticks in place as part of routine refills, and left them there, probably for days before putting them to use.

Someone who worked for cash machine manufacturers would be the most likely authors of this software, and masterminds. I'd
be looking for anyone who quit recently.

Re:That's what you get

[Anonymous Coward]

Works fine. It's a single-color (Hercules?) yellow text screen and have worked just fine for 10-15 years.

Re:That's what you get

[Kalriath]

So... noone? Well that clears that up.

Re:That's what you get

[Kalriath]

It also wont run with elevated privileges unless the specified executable is a setup program, and the user agrees to the UAC prompt.

Re:That's what you get

[icebike]

There is at least one exploit out there that relies on fragility in the USB firmware - the code that auto-negotiates with a USB device when it gets plugged in, sets up the bus, etc. The exploit works by sending unexpected data (buffer overflow, out-of-range values, etc).

Sounds apocryphal.
But it sounds like a way to hack a usb device, rather than the computer that hosts it.
After all, USB sticks don't have much in the way computing power.
Buffer overruns from an input device are trivial to prevent. And even windows does that these days.

No autorun, no exploit.

Re: That's what you get

[Anonymous Coward]

Well... Except that was almost as long ago as that OS was old at the time. This anecdote isn't really any worse than all the machines that undoubtedly run XP today...

Re:That's what you get

[Anonymous Coward]

Even the best of security measures won't hold up against an inside job.

Arguably, the best security measures are designed specifically to hold up against an inside job.

Re:That's what you get

[Anonymous Coward]

don't worry linux go down shitter so quick soon it will worse than window auto run and all else linux very bad program

Re:That's what you get

[Anonymous Coward]

Actually Tomato USB firmware (linux based) does exactly that. My setup specifically automount an external HDD and execute a script file on it to run squid.

Re:That's what you get

[Anonymous Coward]

Running *nix on ATMs would go against the banks' standard practice of 'low bid always gets the job.'

How so? Linux is free.

Re:That's what you get

[Jah-Wren Ryel]

Sounds apocryphal.
But it sounds like a way to hack a usb device, rather than the computer that hosts it.

It is that precise mechanism by which the PS3 was fully jailbreaked

http://thexploit.com/secnews/ps3-heap-overflow-exploit-explained/

After all, USB sticks don't have much in the way computing power.

Lol, who can take you seriously after such a statement? People are putting entire PC's on usb stick form factors. Dell's got their "thumb PC" google has their chromecast, and there are plenty no-name chinese units too.

Buffer overruns from an input device are trivial to prevent. And even windows does that these days.

That's what we in the security biz call "famous last words."

Re:That's what you get

[cusco]

*nix programmers are expensive. Windows programmers are a dime a dozen, especially in India and the Philippines. Remember, these are the organizations that hosted web sites where changing the account number in the URL would give complete control over someone else's account. They've eliminated everyone on their IT staff they could, and contracted everything possible out to the lowest bidder.

Re:That's what you get

[sootman]

Currently at +4 for that; I hope you make it to +5. But next time, don't forget the "Puts On Sunglasses" and the "YEEEEAAAHHH". :-)

Re:That's what you get

[Anonymous Coward]

I don't know any Linux or unix machine which would be compromised merely by plugging a memory stick. Hint, hint: autorun.

Hint, hint: BIOS option- Boot From USB.

Re:That's what you get

[icebike]

Lol, who can take you seriously after such a statement? People are putting entire PC's on usb stick form factors. Dell's got their "thumb PC" google has their chromecast, and there are plenty no-name chinese units too.

These are not USB devices. They don't work in USB sockets. They plug into your television.

Even if you find something that only requires power from the USB socket, it can't hack the host.
The processing has to be done on the host side, and the only way that happens automatically is
if you can get the host to run software installed on the USB drive , (or boot from it).

Even the PS3 jailbreak required the PS3 to hack itself, due to poor programming. The processing wasn't
done on the usb stick.

Re:That's what you get

[thunderclap]

So it's impossible to set up a Linux system to mount a USB stick and run a specific file, if present? Sounds like a lame OS. snip.

No, its a OS designed by IT professionals to be used by the same. Windows is designed for people clueless about computing. ATMs need to be simple to maintain just like anything else. Simple to maintain in computers is easy to hack by any person who well skilled in Computers. Most of us are ethical enough to not compromise the system.

Re:That's what you get

[thunderclap]

That would be my question. Why is the a USB port the face of the machine. IF it really needs one, shouldn't it be inside near where the money is?

Re:That's what you get

[jones_supa]

It's flawed design!

Re:That's what you get

[jones_supa]

Can the ATM just freely connect to any IP in China?

Re:That's what you get

[jones_supa]

There was also a recent event in Finland where some wankers pulled out an ATM with a large front loader.

Re:That's what you get

[AK Marc]

Windows doesn't do it by default, not anymore. Perhaps you should learn about modern OSs before you lecture others on them.

Re:That's what you get

[AK Marc]

I know they can. I've done it. Someone complaining about your system automatically doing what you programmed it to would be as stupid as the comment I was replying to. The file run wasn't "autorun" so it was a manually configured run, not an automatic one. So complaints about "automatic" are mostly red herrings by anti-windows fanatics.

Re:That's what you get

[RealGene]

After all, USB sticks don't have much in the way computing power.

I guess you haven't read this article yet.

Re:That's what you get

[Anonymous Coward]

Just don't go shouting those things around too much, it's a security risk...

Re:That's what you get

[Jah-Wren Ryel]

These are not USB devices. They don't work in USB sockets. They plug into your television.

So, your contention is that a computer in the form-factor of a usb stick can not be a full-fledged computer if you add a usb port to the design? You realize that doesn't pass the laugh-test right? Nor does it pass the existence test of the Dell thumb PC which does have a USB port.

Even the PS3 jailbreak required the PS3 to hack itself, due to poor programming. The processing wasn't done on the usb stick.

At this point I am now convinced you don't have a fuckin clue how security exploits work. Enjoy your ignorance. It's all you've got.

Re:That's what you get

[myowntrueself]

I suppose that's a "feature", but Linux sure seemed primitive to me a few years ago when I discovered what an ordeal it was to read a floppy disk: with Windows, you just put it into the drive and it worked. I assume the same ordeal holds true today for USB sticks on Linux. (Ever wonder why "The Year of the Linux Desktop" always seems to be in the future, Linus?...)

(posting as AC due to non-orthodox opinion favoring Windows over Linux.)

Hah! When I first used Linux, if you mounted a floppy and then removed it without unmounting it you got a kernel panic!

Re:That's what you get

[AssholeMcGee]

This is the stupid part of the story... ""This indicates that the crew is highly familiar with the ATMs in question. Once the ATM is infected, the thieves use a 12 digit code to bring up the alternate interface"" Give me a few days to report back after an INTERNET SERACH....

Re:That's what you get

[Anonymous Coward]

Well, at least that sounds about right. See, in a big corporation nobody een know who the heck configured the machines. It might well be that the first prototypes were ok, and the the actual configuration work got done by some cheap trainee or something, who had poor instructions, and even poorer understanding., and things just failed. It's nobodys fault, really. You can blame the execs and managers ofcourse, but it can't reallybe their fault, because they weren't even there. The first group was having a vacation on hawaii, and the second was playing golf at the time. So, it was the trainees fault. He has beed sacked. Also the one who sacked him was sacked, for a good measure. Golf time now, some government buyers are coming also, so big sales ahead..

Re:That's what you get

[Anonymous Coward]

Yeah, your "inside" is only some tens or hundreds of thousands of people who have at some point seen some of these machines. Or millions, if you count worldwide. Security through secrets only holds if the number of people who know the secrets is very close to zero.

Re:That's what you get

[danomac]

and the user agrees to the UAC prompt.

Which the user just blindly clicks now. Seen it happen, normal users don't even look to see what is requesting admin access.

Re:That's what you get

[icebike]

At this point I am now convinced you don't have a fuckin clue how security exploits work. Enjoy your ignorance. It's all you've got.

Apparent I have a better Idea of it than you do. You seem to think walking by a USB socket with a thumb drive and it roots what ever operating system happens to be installed on said computer.

That is bullshit of the highest order. You've been watching too much TV.

Re:That's what you get

[Jane Q. Public]

Mod parent Z.

Seriously, default autorun was a fine idea BEFORE the advent of viruses. Ever since, Bad Idea.

Re:That's what you get

[AmiMoJo]

Problem is that it makes firmware updates by field technicians difficult. They would rather it were easy and just blame the shop/bank for not securing physical access.

Re:That's what you get

[Jah-Wren Ryel]

Apparent I have a better Idea of it than you do. You seem to think walking by a USB socket with a thumb drive and it roots what ever operating system happens to be installed on said computer.

Yes, that is exactly what I think! Only an idiot would think otherwise!

Re:That's what you get

[Anonymous Coward]

Not if your USB drive is partitioned and is emulating a CD/DVD drive.

Besides why would a USB port on an ATM be in the front and not accessible by only opening a hardened-steel security door and be buried in the back and require an authorization account? (admin user vs the restricted user account the ATM GUI 'should' be running)

Re:That's what you get

[Anonymous Coward]

You only need One programmer, but you need a Windows license for each machine.

Re:That's what you get

[DrPBacon]

So they'll need a USB mouse as well as a USB stick. I guess that's something.

Re:That's what you get

[davester666]

nevermind this is just theft, as robbery is "The taking of money or goods in the possession of another, from his or her person or immediate presence, by force or intimidation"

Re:That's what you get

[Patch86]

Pro-tip- most ATMs (I work for a financial, so have seen a few) have only a single locked front panel that is opened up to gain access to the internals (with only the cash in a more secure safe box inside that). ATMs in busy areas will be serviced pretty much every day. If you want a good look at where the various internals are (including any USB ports), all you'd need to do is hang around the ATM until someone comes to service it- everything you need to see will be right there on display. Take a snap with your smartphone and study it at leisure.

Not that I'd disregard an "inside job"- servicing ATMs is hardly highly skilled work, and most normal branch cashiers at most banks will be trained in it. Certainly possible that the thieves are former (or current) bank employees.

Re:That's what you get

[Patch86]

I would presume that you wouldn't want to put the USB in the cash safe so that someone could perform maintenance on the machine without having access to the cash. Making the assumption that the cash is the most important thing in the machine (and bearing in mind that ATMs are in exposed public places, where maintenance staff are vulnerable to mugging), you'd want to minimise the number of times the cash box is opened.

You could make a good argument for locking the USBs in a separate lock box. However the front panel of the machine would undoubtedly already be locked with a key, so the designer might have considered that overkill. The real issue, in that case, is that the ATM's front panel is too easily damaged.

Well, no- I suppose the real issue is that the software was so vulnerable to a malware-infected USB. One can only assume the damned thing was "auto-run" enabled. It doesn't get more stupid than that.

Re:That's what you get

[Patch86]

Why is the USB "auto-running", rather than waiting for the user to log in with secure verification (maybe a hard-token) and prompting the USB to load? Why is the OS willing to run a firmware update which isn't signed with some sort of trusted protocol?

You're right that it isn't the OS's fault per se, but it is the fault of the software/OS as it was set up. There should be no reason why Windows can't be set up sensibly to prevent these issues, and there's definitely no reason why Linux couldn't be. Someone who wrote or set up that software cocked it up, pure and simple.

Re:That's what you get

[TWX]

If the bank still has network access to the ATM, then the bank could configure the machine to have no access until such access is authorized, remotely, for a given time window, with an expiring password that the service technician could even write on the top of their workorder form, as once it's entered, it's gone. That would prohibit illicit crews from gaining access without having someone inside the company assisting.

Alternately, require the sensors indicating that the machine has been properly opened into service configuration before releasing control. Since such a configuration would probably give the in-person attacker direct access to the money stored in the machine, there would be little reason to continue with an electronic attack, as opposed to drilling through or breaking through a panel now to get at a port, which doesn't expose the money.

Re:That's what you get

[ericloewe]

Every so often I see ATMs that either failed to boot (displaying your typical BIOS message) or crashed with a BSoD (typically with those really obscure errors that point at a hardware failure). For some reason, it's less common now, even though most ATMs have been the same ones that have always been there (down to ancient, burned-in CRTs and internals so slow they struggle with the current software they run).

Re:That's what you get

[Anonymous Coward]

However, you are aware that the BIOS password can by bypassed trivially by removing the BIOS battery for a few minutes? How much work that entails depends on the hardware, usually it's a breeze.

Re:That's what you get

[fisted]

How is it even relevant that recent versions of Windows don't do it? Obviously they didn't run a recent version, and honestly, that'd be just as bad.

Perhaps you should learn about modern OSs

I have quite in-depth knowledge about modern OSs.

before you lecture others on them.

However this is about Windows, so i don't see how modern OSs are relevant here.
Besides, even if you're very proficient in using Windows, you don't know shit about OS concepts. Feel free to prove me wrong.

Re:That's what you get

[Anonymous Coward]

These are ATMs. That means a version of Windows between NT4 and XP. Older ones use OS2 or OS2/Warp

Re:That's what you get

[Anonymous Coward]

Someone did that in England about 15 minutes after ATMs were invented. They were smart enough to use a stolen JCB.

So much for you're gun laws, UK subjects.

--
( roman_mir, blocked by liberal mod mobs again )

Re:That's what you get

[Chaz12]

LOL! - Beats me why the USB port isn't hidden safely inside with secure bank access only! That would be BASIC common sense!

Re:That's what you get

[Anonymous Coward]

probably used a stripped down version of windows 3.1 which most companies and gaming platforms use.

Re:That's what you get

[AK Marc]

How is it even relevant that recent versions of Windows don't do it? Obviously they didn't run a recent version, and honestly, that'd be just as bad.

You condemned an OS, not a version. That makes you wrong. You might as well be condemning Ford quality, not for current or recent problems, but because the 1940's Flatheads were problem prone.

Plus, given that the listed file run isn't one that has ever been a default for the OS indicates it is a configuration issue, not an OS issue.

But then, you seem more interested in spreading lies to insult an OS you don't like than looking at the actual issue and evaluating it.

Besides, even if you're very proficient in using Windows, you don't know shit about OS concepts. Feel free to prove me wrong.

You say that like there is some way I could "prove you wrong". I can't. You hold an incorrect opinion. And those are the ones that never change. I can't prove your opinion wrong. If I were to try, you'd pull out confirmation bias and such to ignore anything you don't like, just as you did when I pointed out that Windows does not act in the manner you describe (though at least one previous version did, your tense did not lend itself to that meaning), so the fact you have contradicted yourself already in respect to "Windows does it" rather than "windows did it" *by default* is proof you are wrong.

Now that I've proven you wrong, what do I win? An apology? Or abuse where you insult me further because I state a truth you don't like, rather than agreeing with your (trivially provable and proven) false opinion? I'm guessing abuse, as that's what you have done so far, so why should I prove I know shit about OS concepts, when you've proven yourself unable to acknowledge a correction of your incorrect opinion?

Re:That's what you get

[Hognoxious]

ATMs are in exposed public places, where maintenance staff are vulnerable to mugging)

I've never actually seen anyone loading or doing maintenance on an ATM.

This makes me think that either they do it when the great unwashed are locked out, or they do it from the back.

Next time I go to the bank I'll take a look whether the inside wall matches up with where the premises end. Blah blah secret passage blah blah enemy agent blah blah submarine.

Re:That's what you get

[fisted]

You say that like there is some way I could "prove you wrong". I can't.
[...]
Now that I've proven you wrong

Ehm. I don't feel like there was much left to say here.

Re:That's what you get

[AK Marc]

So you accept that I proved you wrong? I proved you wrong, and I predicted you wouldn't concede. Oh look. I was right. So what was your point again? That you are wrong, so you change the subject every chance you get?

Re:That's what you get

[fisted]

Eh, no? Can you try to gibber even less coherently? I stopped bothering because you keep contradicting yourself horribly. There's no point in continuing this. Besides, we seem to have nothing in commong, you being a Windows user and stuff.

Re:That's what you get

[Anonymous Coward]

You should read up on what a security nightmare the voting machines are, it's appalling. Doesn't help that there are a dozen or more manufacturers, all of them being sold on the basis of friendly back slaps with local politicians rather than actual analysis of the hardware and software (which is always closed source).

Except for military applications, for the US government (applies to state and local governments as well) to buy closed source software or hardware for any government operation is clearly a violation of fundamental rights, since it denies the public right to long term oversight over government. The public has a right to know, in whatever detail is desired, what its money is being spent on.

In any jurisdiction that respects the Bill of Rights, this is appropriately viewed as an illegal act violating rights retained by the people under the 9th Amendment, and reserved to the people under the 10th Amendment.

There can be no trade secrets when doing business with the public through the government.

Rights retained by the people being retained by the people, no entity of government can take them away. Accordingly, no entity of government can authorize these illegal practices.

Re:That's what you get

[AK Marc]

When you deliberately read for the least probable and least useful reading of everything, it won't make much sense. I explained it, and you refuse to listen.

And someone that understands Windows (as it is the most common in the world), is a bad thing, but someone who is deliberately ignorant is a better authority on that which they avoid? You are the only incoherent one here. You lied about Windows features, then get all grumpy when called on it.

Re:That's what you get

[RockDoctor]

Every transaction is video recorded, so why would there be any mystery about how they got at the USB port?

I've heard of video-recording ATMs but I've never actually noticed a camera in one. Not that I've gone looking for cameras as such, but I do regularly give the fascia of a machine a tug and a shove to check that it's not a fake card skimmer/ reader.

Someone who worked for cash machine manufacturers would be the most likely authors of this software, and masterminds. I'd be looking for anyone who quit recently.

Like, in the last several years? What's the lifetime of these machines "in the field"? Several years I can be certain of (one that I use regularly was subject to an ineffective hammer attack several years ago ; the chipped glass is still the same as it was in 2010) ; and I wouldn't be surprised if it were as high as 8 or 10 years. ISTR seeing OS/2 boot messages on an ATM not too long ago. Sic foncionnatit, nil copulatum. If it works, don't copulatum with it.

Re:That's what you get

[RockDoctor]

They're federally insured so they don't care...

So, you didn't RTFA then, did you?

Details of the attacks on an unnamed European bank's cash dispensers were presented

(My emphasis.)

Re:That's what you get

[RockDoctor]

and Diebold is still the largest manufacturer of ATMs in the US.

And? Does this have some relevance to the story under discussion, which states :

Details of the attacks on an unnamed European bank's cash dispensers were presented

Who are Diebold, and why should I care about them? They're just another bunch of people who sell shit to foreigners.

Re:That's what you get

[fisted]

You lied about Windows features

Yawn. Where?

Also can you please keep in mind what this story is about?

Re:That's what you get

[AK Marc]

"windows does it *by default*"

liar. Windoes did, but doesn't anymore. The story is irrelevant to calling little liars on their little lies. Stop lying, and I'll stop pointing them out,.

Re:That's what you get

[fisted]

You're cute. Obviously the Windows on the ATM in question did it by default, so i guess your claims about me lying are nothing but lies.
Or you could be trolling, you're not doing it well in that case, though.

Re:That's what you get

[AK Marc]

Obviously, because the file run was not the default autorun file, the default autorun was not utilized. Some mechanism was enabled that deliberately (not by default) loaded that file.

Again, just because you don't understand the truth doesn't make reality wrong.

Re:That's what you get

[fisted]

there is no "default autorun file to be executed", the program or batch file to run is specified in a file called autorun.inf.
 
Heck why do i even know that crap, i haven't been using windows in a decade.

Re:That's what you get

[fisted]

oh just for clarity, said file will be displayed as "Autorun" on your idiotic windows machines, because a difficult and complicated concept as filename extensions apparently is considered too hard to grasp for the average dumb windows user, by microsoft.

Re:That's what you get

[AK Marc]

autorun.inf *is* executed. Usually, the point of it is to call other files, but you can run it without calling any other files at all. The file "run" in this case was *not* autorun, but may have been mis-stated by someone else as a file called by autorun.

It's common to set up systems to call other files via some method other than autorun. That lets the system be in charge of what's run. autorun is untrusted, but if you only run "atm_service.exe" upon detecting a new device, then you have appropriately abused security by obsurity, which is how the description of this hack was done. It was also stated that the defeating of the physical security required inside information, so that matches with a defeating of the obscuring factor.

autorun was not enabled. That makes your entire line of posts on here wrong, worthless and useless. That was the only point of correction I was trying to offer, as you kept insisting facts contradicting the reports.

Interestingly the dropping of autorun (as being on by default) wasn't too far off the dropping of extensions (as being on by default), so interesting that you pick the worst of both, and not the 2000 or 2010 versions of both. That lack of consistency tends to indicate a deliberate and irrational bias, not a genuine complaint.

Re:That's what you get

[fisted]

autorun.inf *is* executed.

No, it is parsed. Of course, computer illiterate people couldn't tell the difference.

autorun was not enabled.

Source?
 
And in any case, regardless or version or enabled/disabled whatever, ATMs should not run a proprietary garbage consumer OS Why on earth are you defending this utterly stupid practice? Could you really be this dumbed down? Pathetic.

Re:That's what you get

[AK Marc]

No, it is parsed. Of course, computer illiterate people couldn't tell the difference.

Oh, so all the people who say "execute that script" or "execute that cron job" are all illiterate? After all, a batch file (what autorun is based off) is a script file, is it not?

When you can address the issues, rather than trying to twist them into insults, let me know. Though I have no doubt, you'll reply until the end of time, and if I ever stop replying, you'll dance around in your mom's basement whispering "I won" (whispering because Mom doesn't like when you shout).

ATMs should not run a proprietary garbage consumer OS Why on earth are you defending this utterly stupid practice?

I'm not defending the practice. I denounced it 15 years ago when most ATMs (as far as I could tell) used OS/2, and I have multiple photos on my phone of MS OS failures on industrial machines, some of which I upload to places to poke fun of people that use them. Such as Wells Fargo's ATM at Minnesota and Benson that was blue-screened once, and WinCE on the entertainment systems on an airline, rebooting the 200+ entertainment terminals when the system crashed. It's a stupid practice, and I would join you in denouncing it, if I weren't distracted by correcting your lies about the OSs. They are bad enough if you tell the truth, so why must you lie about them? It distracts from your message. This is your 30th (or so) post on this, and the first time you mentioned it. Why? Too busy defending your obvious lies? Just stop being an unethical ignorant liar, and people might listen to you Or was your change of topic as close to "You are right, I'm a liar, please accept my apology" as you can ever come, and I should have just ignored your reply, rather than taking your words seriously?

Re:That's what you get

[Anonymous Coward]

This whole argument thread is moot. If you watch the video about how this works, the problem isn't autorun; it's that it's configured to boot from USB before HD. They boot a copy of Hirens, which then is able to inject into the filesystem. This same techique would work against Linux. It's a configuration problem.

Re:That's what you get

[Patch86]

For the record, I work for a bank and there is a branch on site at our head office (and I've spent time in and around other branches too, over the years); I can assure you that they service them throughout the day as and when they need servicing (as a disabled ATM is disuptive to business). When they access the machine other than to access the cash box they seem to do so in pairs- one person to complete the work, the other to keep a beedy eye on them and the public. The cash box is only opened when the Securicor (or whoever) guards are around, as far as I can tell.

The machines we use (that I've seen serviced) are front-accessed- the whole front panel of the machine is hinged and opened with a key, to expose the inner-workings (except for the cash).

Moral of the story

[schneidafunk]

Video cameras to prevent drilling of the outer shell was never considered?

Re:Moral of the story

[Anonymous Coward]

How exactly would a video camera prevent a masked marauder from drilling?

Re:Moral of the story

[bleh-of-the-huns]

There is no need to drill the outer shell, apparently it is not difficult to buy keys for ATM machines online, dress as a repair man and no one thinks twice. Failure by some institutions to utilize maintenance logs and scheduling for ATM repairs.

Re:Moral of the story

[alexander_686]

Well, there is nothing to indicate anything is wrong. The ATM machines still look like they are functioning normally from the operations center and the tapes are (normally) only reviewed if they suspect something has gone wrong. It’s not like they have a bank of rent a cops monitoring these things 24/7.

Re:Moral of the story

[bleh-of-the-huns]

My bad, I posted before I read the article. I was thinking that they used keys.

Re:Moral of the story

[Crudely_Indecent]

When has a video camera ever stopped someone from doing exactly what they intend to do? Youtube is full of examples of people behaving badly in front of a video camera (sometimes - because of the video camera)

Sure, video cameras may cause people to reconsider their behavior - but a criminal intent on committing a crime will just wear a mask or disable the camera with some high-tech sticky tape. If the group is repairing the machines so their modification can't be detected - nobody would be the wiser. They might consider the tape to be the work of a prankster and peel it off.

Maybe if the video camera was attached to a flame-thrower - that might do the trick.

Re:Moral of the story

[Richard_at_work]

In the UK you cannot access the internals of the ATM unit without either accessing the rear of the machine, which is locked away in the safe that they mention, or by cutting into the fascia of the external face, which is what they did here.

You cannot gain access to the ATM simply by using a key bought off of the internet.

And yes, most ATMs in the UK have a video camera on them to help identify fraudsters, but that does NOT help prevent the fraud from occurring because someone would have to watch it in real time and intervene. Infact they identified just how this hack was occurring by watching the CCTV footage to see just how the money was going missing, because it wasn't triggering any other alarms.

Re:Moral of the story

[Rob the Bold]

Video cameras to prevent drilling of the outer shell was never considered?

Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it. Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and made your getaway. Also, having someone else do the dirty work is always a good idea, like the POS tamperers/vandals/thieves/skimmers that hit Michaels stores using Armenian LA street gang members or something like that as contractors to collect the cash with forged debit cards. I'm probably mixing up several stories there, but the concept is the important thing, not the specific details of any one specific crime.

Re:Moral of the story

[Anonymous Coward]

Mod parent up! Cameras create impenetrable force fields. At no point in history has any ne'er-do-well covered their faces before engaging in shenanigans.

captcha: stocking. I love you, context-sensitive captcha generator.

Re:Moral of the story

[znrt]

Video cameras to prevent drilling of the outer shell was never considered?

unfortunately all available video cameras are busy pointing at random public places. we're trying to run a surveillance state here, you insensitive clod!

Re:Moral of the story

[wvmarle]

Security cameras are only to record what happens, for later viewing. They don't help prevent crime, they only help solving it (they might prevent some because of the higher risk of getting caught).

These thieves did their best to not have their work detected. They drilled the hole, installed the software, then patched up the hole. Later they came back to get the money out of the machine - basically by nicely asking the machine to give it to them. And that again was detected only much later when the notes in the machine were counted and the numbers were found to be off, which in turn triggered an investigation, taking even more time before the bank finally found out what was going on.

Those security cameras did nothing. A smart thieve will wear a cap or so, inconspicuous (wearing a mask would make you stand out of course) but it hides your face from the overhead camera, so even seeing them do it won't give many clues.

Re:Moral of the story

[lgw]

In most countries it depends on the ATM - there are many different kinds of ATMs installed in many different ways. Is there really some standard in the UK? Are there not cheap ATMs in convenience stores that are very different from the big ATMs next to banks?

Pretty much all ATMs these days have a camera, sure, but it typically records images on storage in the ATM. After the attack, it's going to have whatever comical pictures the attackers want it to have.

Re:Moral of the story

[Groghunter]

you have ten seconds to comply.

Re:Moral of the story

[Anonymous Coward]

How exactly would a video camera prevent a masked marauder from drilling?

Robo ATM Cop, that's how.
Bang! Bang!! Stop or I'll shoot ... again.

Re:Moral of the story

[jeffmeden]

Video cameras to prevent drilling of the outer shell was never considered?

Right. Every bank I've ever been in in the last . . . many . . . years has cameras all around, including pointed at the 24-hour ATMs. So I guess you'd do it as surreptitiously as possible so it wouldn't necessarily get noticed on the footage without carefully watching it.

To add to the complexity, there are plenty of ATMs (more than enough for a gang to live off of) that are nowhere near a bank. Since the plan was well thought out (the software they hacked in was particularly brilliant to have two-factor auth) they probably also cased ATMs that had a minimum of video surveillance and "hit" them when there were few people around.

Then don't do anything for a while, preferably long enough that the footage with the tampering has been overwritten -- or at least long enough that it's tedious and time-consuming to look through everything and you've got the money and made your getaway.

What is apparently necessary is a software tool to match up physical presence with a lack of ATM transaction activity, since these guys no doubt left no electronic trail in the logs of the machine. Therefore you need to find the spots in the tape where someone was at the machine but not performing a (recorded) transaction.

Re:Moral of the story

[jandrese]

Even if the CCTV images aren't tampered, all you are going to know is that a guy in a mask broke into the machine a week ago. At best you can limit the number of people you have to issue new cards to. Ok, you can stop laughing. I know the company is just going to offer a few months of "credit monitoring" and not reissue the compromised cards or even tell the people affected. But it could happen. Someday. Maybe.

Re:Moral of the story

[lgw]

The scary thought is that all these ATMs are just as vulnerable to remote attacks. I don't know any details about that side, other than they're mostly on dial-up so you can just call them and hack them, but apparently they are very vulnerable (I would guess there's a default password that's rarely changed, or something equally inane). If the attacker wants magstripes and PINs instead of the cash in the machines, there's no reason to ever be near one.

Re:Moral of the story

[Anonymous Coward]

In the UK, the PIRA and UVF and so forth use JCB's to drag out the ATM from the wall and down the street.

That is how you attack an ATM in the UK.

Just ask the Northern Bank (now Danskebank), Ulster Bank etc.

Re:Moral of the story

[roc97007]

How exactly would a video camera prevent a masked marauder from drilling?

I dunno, another panel opens and a white gloved hand on one of those scissors-like extensions comes out and slaps the thief silly? I'm pretty sure I saw that on a Bugs Bunny cartoon. Or maybe it was one of the Star Wars prequels, I forget.

Sounds like the FBI.

[Anonymous Coward]

Sounds like the NSA. FBI. CIA. US Government.
 
Trust, but verify... and we're gonna take all that you value.

Barnaby jack jackpotting ATMS

[bleh-of-the-huns]

Google the subject, he performed this attack live at both Blackhat and Defcon 18. It was definately an eye opener, and one of the reasons I tend to avoid those rental ATM's you see in mom and pop stores, and restaurants/bars...

yes I realize that even the major Bank ATM's are susceptible, but at least with a major bank you have some recourse if you have issues.

Re:Barnaby jack jackpotting ATMS

[retroworks]

http://www.wired.com/threatlevel/2010/07/atms-jackpotted/ Thanks for the tip

Re:Barnaby jack jackpotting ATMS

[Anonymous Coward]

Really? That's how you're going to layout your comment? By putting the relevant part of the comment in the subject, which is a link, it's difficult to highlight with the mouse so we can copy/paste which inconveniences anyone else who might have an inkling of interest in your, well, subject.

Since you're too "clever" (or lazy) to properly edit your post in the first place, and as a courtesy to everyone else who might be interested, here is the google results link for "barnaby jack jackpotting atms"

HTH HAND et. al.

Re:Barnaby jack jackpotting ATMS

[Anonymous Coward]

Barnaby Jack was a great hacker. Too bad he made enemies who knows when it is possible to determine cause of death and when it is not.

Re:Barnaby jack jackpotting ATMS

[mlts]

I've wondered why ATMs are not designed with some defense in depth. Yes, the cash pile and outer case tend to be well armored, but I wonder about having the core computer be in a tamper resistant case, similar to a HSM, with software for copying signed updates [2]. There wouldn't be a USB port, but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that) and a restricted interface for updates might help things. If the case holding the core CPU is opened, the module with the core keys for PIN encoding/decoding would fry itself automatically, similar to how physical tampering on a HSM will cause it to zero itself.

[1]: Always amuses me (except if I have to get cash out) to see a WGA piracy warning, or (if the ATM doesn't get updates) a demand for activation. That is a failure on the part of the ATM maker because they really should have specced XPe, not XP. As an added bonus, XPe can redirect all writes to a different area so the OS can be on a read-only SSD.

[2]: Could be just a simple bootable BSD partition with netpgp that copies the OS image to a temporary directory, checks to see if the signature is valid, then if so, uses dd to write do the final writing.

Re:Barnaby jack jackpotting ATMS

[Anonymous Coward]

In Canada most of the small ATM machines belong to organized crime. They're not ripping you off (well, except for the $3 fee). What they are doing is making dirty money clean.

You would be stupid to tangle with those groups.

http://www.cbc.ca/news/canada/private-atms-vulnerable-to-money-laundering-1.2288659

Re:Barnaby jack jackpotting ATMS

[AK Marc]

, but just a port for a SD card (a USB card can register as more than just a drive, so having just a SD card prevents that)

Are you sure about that? http://nz.transcend-info.com/products/CatList.asp?FldNo=24&Func2No=203

That one runs a disconnected Wi-Fi to share the photos using the power supplied, but no connection back to the host, but I've also used networking cards in PCMCIA slots. You do know what the MC stands for in that, right? memory cards have been used for more than just flash memory, since as soon as they were invented.

Re:Barnaby jack jackpotting ATMS

[Anonymous Coward]

Take your tissues and wipe your tears. For once.

Re:Barnaby jack jackpotting ATMS

[mlts]

One can use storage with a parallel port. However, the host must have specific drivers for it ready to go. So, plugging in a Wi-Fi card into a SD slot will physically work, but it is an unlikely attack avenue, just because the machine isn't likely to load drivers for it, configure an IP stack, fire up DHCP and turn that adapter on.

USB is a different animal. Plug in a device, and most USB stacks already have HID drivers, mass storage drivers, printer drivers, and other items ready to go. Unless it was explicitly pared down to only allow mass storage devices to be presented, a USB port can have unintended consequences.

Re:Barnaby jack jackpotting ATMS

[AK Marc]

Yes, you are much more likely to have a non-storage activity enabled on USB, but this attack only needed storage that's mounted and run, and SD can do that just fine, so SD wouldn't protect from anything. And I'm just pointing out that SD doesn't prevent network connection or other types of expansion cards. Nearly all I/O connections have been turned into a network port. Maybe not all Ethernet-based TCP/IP, but most. I've used CF and PCMCIA 10/100 cards, both were originally memory only, and I've already posted an SD WiFi card.

Re:Barnaby jack jackpotting ATMS

[myowntrueself]

In Canada most of the small ATM machines belong to organized crime. They're not ripping you off (well, except for the $3 fee). What they are doing is making dirty money clean.

You would be stupid to tangle with those groups.

http://www.cbc.ca/news/canada/private-atms-vulnerable-to-money-laundering-1.2288659

Canadian. Gangsters. ?

Ok I've watched Trailer Park Boys but... wow. I guess they are the most polite gangsters in the world? "Nice place you got here eh. Shame if something were to 'appen to it. Sorry 'boot that. Sorry."

well...

[Anonymous Coward]

I am selling USB sticks on EBay if anyone wants them.

Why did we get rid of OS2 on the ATM's?

[Joe_Dragon]

that one was hard to hack

Re: Why did we get rid of OS2 on the ATM's?

[Anonymous Coward]

Because the new kids only know .NET

Re: Why did we get rid of OS2 on the ATM's?

[Anonymous Coward]

Is it really that hard to teach them COBOL.

Re:Why did we get rid of OS2 on the ATM's?

[Anonymous Coward]

Any insight into why it was hard to hack? Say... the surrounding hardware didn't allow for any USB stick firmware upgrade procedure for lack of USB ports?

Two-factor authentication

[Anonymous Coward]

Well, it's nice to see that someone in the, uh.. banking industry.. has managed to figure out two-factor authentication to stop people from taking off with money.

Tech is perfect

[Catbeller]

Remember to contract private companies to build machines and systems to count votes as well. Nothing could possibly go wrong, and those companies will be as assiduous in detecting flaws in voting systems and their front ends as they are in counting vast quantities of cash. Because, you know, they will. 'Cause. Perfect.

Re:Tech is perfect

[DaHat]

Yes, because seeking solutions from government is so much better... they never deceive and only have the most purist intentions at heart.

Re:Tech is perfect

[Anonymous Coward]

Fighting straw with straw doesn't work, kid.

It's not the USB drives, it's the USB ports

[WOOFYGOOFY]

USB ports will take literally any instruction at face value and execute it. In the eyes of a USB port, there is no such thing as malware.

touch screen and other parts are USB. new SLOT MAC

[Joe_Dragon]

Well the touch screen, printer and maybe even the link to the cash system may be USB.

Even new SLOT MACHINES use USB and the Incredible Technologies games are ALL USB and load code from USB drives.

How do we prevent this?

[EMG at MU]

I feel like I might know how something like this happened.

Dev: "Hey we need to spend some time on security, for example the USB ports are not disabled, if we wan't to use them for service we should put authentication on them."
Project Manager: "Well, you have a point but none of our competitors focus on security either and were also behind on the project. It will be fine and we can fix it next time"

As a embedded dev I have had that conversation.

Re:How do we prevent this?

[Anonymous Coward]

Why didn't you just do it in the first place, you know, as part of your job? Yeah boss, I've installed LAMP, and left all the passwords set to 12345. We're ready to release. Profit!

Re:How do we prevent this?

[NatasRevol]

Why?

Deadlines.

Costs.

Salaries.

Re:How do we prevent this?

[Anonymous Coward]

Dev: "Hey we need to spend some time on security, for example the USB ports are not disabled, if we wan't to use them for service we should put authentication on them."

Wayward apostrophe.

Project Manager: "Well, you have a point but none of our competitors focus on security either and were also behind on the project. It will be fine and we can fix it next time"

If the competitors were also behind on the project, why not just put in the authentication? Or did you mean "we're", which completely changes the meaning of the sentence?

If you want to get your point across, say what you mean. Don't make your readers guess what you meant to say.

Re:How do we prevent this?

[SleazyRidr]

This is the perfect example of why people need to pay attention to what they're writing. The first one just makes her look stupid, but the second one changes the whole outlook. Pay attention people, put your punctuation where it's supposed to be.

Oh, ffs.

[ledow]

Fail #1: A port that can be accessed without triggering an alarm.
Fail #2: A USB port.
Fail #3: Software running that looks at, and allows unsigned executable code to be executed from, a USB storage device without explicit authorisation.
Fail #4: No intrusion detection whatsoever to notice that this USB device has been inserted, has had code taken from it, that that code has been made executable and executed, or that that code is running with privilege enough to dispense cash.

I stopped caring at #2, if I'm honest.

You can state for all the world that the ATM's need software updates, etc. but there's just no excuse for a commodity device to be able to run arbitrary code without at least BOTHERING to check the authenticity of the code it runs first and ALERTING someone somewhere that that's what's happening (i.e. alert the branch, alert the central bank, etc.).

There's nothing stopping you issuing your updates over the local banking network, even, if that's what you want to do. Just make sure they are signed, verified, encrypted and secured. Honestly, you can't download a fecking game or movie nowadays without requiring DRM... and this is where DRM, code-signing and all that other stuff we do is supposed to be being used the most.

General purpose computers SHOULD NOT BE USED in security-conscious situations.

If your ATM isn't a SecureBoot machine (at a minimum), with code-signing explicitly required for any and all updates, and ALL WAYS to execute external code disabled, you're just a fecking idiot.

Re:Oh, ffs.

[Anonymous Coward]

Dude, the money is safe, as long as they don't know the money is in there. DUH!

Re:Oh, ffs.

[Anonymous Coward]

I would imagine that the FAILs you refer to, are all addressed in electronic slot machines and other gambling devices. It would be a sick fact if the armless bandits have less security than the ATMs used to feed them.

Re:Oh, ffs.

[fermion]

this is simply a case of not caring. Here are three simple cheap things that can be done to insure that the effects of these attacks are minimal and tampering evident. 1) log USB port use in a secure memory space, uploading it periodically. 2) Place a validation on the USB port dating the last access. 3) Secure the USB port separately with some lock box, tiggering an alarm in the box is broken. 4) have a switch elsewhere is energize the USB port.

One issue pointed out in the article is that same machines were attacked repeatedly. A tamper evident security program would prevent that. This is often the case with computers. There is no way to determine if a box has been tampered with.

Re:Oh, ffs.

[sootman]

> Software running that looks at, and allows unsigned
> executable code to be executed from, a USB storage
> device without explicit authorisation.

They need to start making ATMs with Android or iOS.

The application 'ATPwn' wants access to your:
- Contacts
- Photos
- Money
 
Allow? Yes/No

Inside Job

[Princeofcups]

When I worked at ABN/AMRO, I would pass the locked ATM machine engineering room, and wonder what could happen if one of these people was fired. Now we know.

Re:Inside Job

[Anonymous Coward]

Obligatory https://www.youtube.com/watch?v=MKEUujz12S4

Floppy disk?

[Anonymous Coward]

You're taking a decade-ago experience with a floppy disk and guessing that the same problem applies today to a USB stick?

Here's a tip: Linux has thousands of new features since the time you last glanced at it. Including detection of whenever a USB stick is inserted, and it's easy as anything to click on the little USB icon and look at the file manager and do whatever you want.

Re:Floppy disk?

[Anonymous Coward]

Sorry - again, I thought that was supposed to be a "feature", like all things that are difficult in Linux.

BTW, did Linux ever get anything like "plug and play"? To me, that's always been a killer feature that Windows has supported since Windows 95 that Linux doesn't have -or at least didn't the last time I checked, a couple of years ago. For example, I once tried - and failed - to get basic audio to come out. So, I went to the Alsa howto, failed at that, then went back to Windows.

I've done this sort of thing several times over the years. (I keep giving Linux a chance hoping it has improved, and then going back to Windows.) For example, I once gave up on it because I couldn't get WPA to work on wi-fi on Ubuntu on a laptop. Again, go to the howto, again fail, again, go back to Windows.

Similar story on getting Java to run in Firebird on Linux. Why was that so hard?

Maybe these things are easy for some of you folks, but for me (and most of the rest of the human species), they aren't. (Hint: anything that needs a howto shouldn't.) I keep hoping that one day things will "just work" on Linux but that has never been my experience.

(BTW, this isn't a troll, it's just my honest experience and opinion, which I can only post here as "AC", of course. YMMV - feel free to ignore it.)

Re:Floppy disk?

[fisted]

here's why
Not a troll either, it's a very interesting read (and you're demonstrating quite a lot of the misconceptions cleared in that article -- read it.

Re:Floppy disk?

[Anonymous Coward]

But my Linux desktop is a CLI and doesn't use a Mouse. So How can I click on that USB Thingy to get access?

In all seriousness, many of us that use Linux don't have a GUI installed or even need one.

Re:Floppy disk?

[Anonymous Coward]

One thing- "Subproblem #5a: Familiar is friendly" talks about "Cut and Paste by using Ctrl-X and Ctrl-V. Totally unintuitive".

Which is bull. "X" looks like a pair of scissors, which you use to... cut! And "V" looks like the proofreading mark used to indicate something needs to be inserted. "C" stands for Copy. All very logical.

Also: "With the Ctrl-X approach, how do you cut a word from the document you're currently in? (No using the mouse!)" ... um, why NOT use the mouse??

Re:Floppy disk?

[Anonymous Coward]

Good link, very interesting. However, by likening Linux to a set of Legos with which you are invited to build your own toy, the article seems to suggest that "The Year of the Linux Desktop" will never arrive - and maybe is never even supposed to. (The latter is an insight I never had before: I thought that making it user friendly [e.g. via GUIs like Gnome and KDE] was at least a goal, even if we aren't really there yet.)

I have been consistently disappointed in Linux when I've tried it over the years that it's so difficult to administer, and that it doesn't "just work". To be fair, part of the difficulty of administering it is my own lack of knowledge and experience with it. Beyond that, though, if one needs to recompile the kernel just to add a driver, I don't think "The Year of the Linux Desktop" will ever come. At best, Linux will continue to be used as it currently is, by either hackers who like to do that kind of stuff, by students and IT professionals who aren't bothered by that, or in curated systems like Android where there isn't much in the way of administration for the user to do.

Did we mention they're thieves?

[TangoMargarine]

If we used that word any less than 4 times in the 6-sentence summary, people might forget who we're talking about!

Software security in finance is surprisingly low

[quietwalker]

I used to write financial software for a living, including ATM driving software.

I realized, after a while, that I had certain preconceived notions about the sort of software and hardware that is running on these sorts of high profile, high risk systems. Obviously, the software will have been made highly secure; redundant checks on every action, code signing, etc. It'd likely be running a custom operating system that was built from the ground up and booted off a (P)ROM. The case would be just as impenetrable, with a separate compartment for the computer itself, requiring specialty equipment so that could only really be opened at the point of origin or in a manner certain to destroy the innards - and certainly not in the field.

Right? I mean, any of us can think up a set of reasonably secure basic premises from which we could build a system like this out of.

Imagine my surprise when I found out that half of the ATMs out there are just running off the shelf windows desktops, with the original demo software still installed. There's no real optimization, no cleanup, no limited boot, nothing; it's just a desktop machine jammed in a vending machine with a custom card & cable for driving the mechanics of the ATM. Sometimes they're even in the original manufacturer's case (though usually they're just the board). I've also done some work on vending machines, and I can tell you that they're often better made!

As a software developer, one of the things I was shocked to see was that security for ATMs was almost entirely focused on the physical. There's little to stop someone from hooking up an external line and sending approvals or just do basic proxying - most of the data is sent in the clear, just skim it, or to update the system with a cd or usb if you pull the front cover of the ATM off. Many times, you'll find someone left a keyboard and mouse behind in the unit because it's a pain to always carry your own when doing updates or what have you.

This follows the same basic trend in the rest of the financial systems I've seen; physical security is very high, software security is relatively low. When it comes down to it, most companies place a focus on tracking transactions rather than securing them, and rely on constant manual review by staff to detect problems (that's why banks close so early - the folks who don't run the registers are in the back doing the day's reconciliation.

Not robbery

[Dan East]

Robbery as defined as taking something from a person through threat of force or violence. You cannot rob an inanimate object. Theft is the correct term, or perhaps burglary (which also includes illegally entering a place to commit theft). I'm rather surprised to see the BBC misusing the term as well, but I notice they refer to it as "theft" in the story, and only use "rob" in the title. Sounds like an overzealous editor tried to make headline more catchy when posting the article.

Re:Not robbery

[Dan East]

As an addendum, it would seem burglary is the most accurate legal term in this case, as the criminals had to physically break into an authorized area of the ATM in order to commit the theft. But "robbery" is definitely the wrong terminology regardless.

Re:Not robbery

[Anonymous Coward]

SEO? On the Internet? Hold the phones!

Interesting

[lapm]

Hmm why rob the bank when you can empty ATM with much less risk of cops catching you. Somehow i would have expected ATM to use something else then Windows or Dos system.

Crooks are better at security than the banks!!

[cs668]

At least they built a challenge response system into their hack, that's just f*'ing funny to me!!

Re:Crooks are better at security than the banks!!

[Registered Coward v2]

Yes, because you just can't trust crooks.

Re:Crooks are better at security than the banks!!

[chispito]

At least they built a challenge response system into their hack, that's just f*'ing funny to me!!

Alternative explanation: The outfit that developed the malware is selling it as a service to independent thieves.

Re:Crooks are better at security than the banks!!

[socz]

So this is like, Redhat selling a service contract to support its installation on servers? "So you need help to get into the system? No problem, just send me the code it shows on the screen."

Re:Crooks are better at security than the banks!!

[cs668]

Nice, I didn't think of that!! But, I still love the thought that went into it.

Re:Crooks are better at security than the banks!!

[Anonymous Coward]

Addon: The ATM company is selling the hack.

Quack!

[freeze128]

Even HID-Only access isn't going to save you. See the USB rubber ducky.

http://hakshop.myshopify.com/products/usb-rubber-ducky

Re:Quack!

[TWX]

Like I said, AT BEST, and why I suggested the internal keypad.

in other news...

[buddyglass]

USB Sticks Used in Robbery of a Convenience Store

Who left autorun turned on?

[Animats]

Plugging something into a USB port is only effective as an attack if autorun is turned on in Windows. You can turn it off for all pluggable devices. A file system device is still recognized as having a file system, but something has to go to the device and get a file before anything happens.

Running Windows on an ATM is lame, but common. Running a desktop version of windows, instead of Windows Embedded (which allows removing all the stuff that shouldn't be there) is just stupid.

Re:Who left autorun turned on?

[Anonymous Coward]

You clearly haven't read any of the comments or the actual article. Has nothing to do with windows ... the device was booted off the USB image.

Re:Who left autorun turned on?

[Anonymous Coward]

Untrue.
The USB stick could be behaving like a some device (like a printer) and then exploit a vulnerability in the driver that is loaded to handle that device.

Sure, this a lot more work then exploiting autorun, but still....

Re:Who left autorun turned on?

[p.g.king]

Autorun being on would merely be a convenience, no reason a simple emulation of keyboard and mouse couldn't be plugged in to execute the requisite commands. An arduino micro could do that for you in a small form factor for a few $

Re:Who left autorun turned on?

[Anonymous Coward]

and that's why a file called hack.bat was involved? sure you read TFA?

So, these dudes are sailors?

[Anonymous Coward]

This indicates that the crew is highly familiar with the ATMs in question.

Or is it just that the submitter and editor have watched way too many bad movies and TV shows?

Take your fad words and shove them up your ass.

From the 30c3 Electronic Bank Robberies talk

[ampmouse]

Details of the exploit were presented Friday durning the "Electronic Bank Robberies" talk at Chaos Communication Congress, yet some how the slashdot article completely misses that. You can watch the talk on Youtube or download the MP4 Video(172M) if you want to watch the original talk.

Barnaby Jack

[skoby]

If Barnaby Jack was still with us, he'd be proud. :)

Too convenient

[imatter]

It seems too convenient to leave a file called hack.bat on the system. Probably just a cover because the actually back door was created by the developer of the ATM system/software. The USB sticks simply unlocked the machine and the codes were used to prevent the individual perp from hitting too many ATMs, too frequently. The code doesn't stop the individual perp from walking away with the cash at that time but it does let someone know exactly when he's doing it.

I know of a gambling device that was similarly hacked by the developer... He was too greedy and used his hack twice in one weekend. He was also on the security video and he rented a car in his own name which makes him not only greedy but stupid as well.

As a side note the gambling device used proprietary hardware/OS and the system software is examined and certified by a third party. The back door was well hidden and because it was an inside job, the technical security of the device was irrelevant. I am guessing the same is true for the ATMs.

No honor among thieves...

[Anonymous Coward]

"...must call another member who can generate the response for them."

All within sight of a camera.

[Anonymous Coward]

Brilliant.

Joanna Rutkowska covered USB exploits

[Burz]

Here in this blog post: http://theinvisiblethings.blogspot.com/2011/06/usb-security-challenges.html

Is definitely a concern to her Qubes OS project.

OS/2 Still Hanging On.

[Anonymous Coward]

While most of the ATMs I lord over are now Windows 2000/XP based, there are still a few running OS/2!

just reset root password

[Anonymous Coward]

Any time you have physical access you can gain root access simple as starting a VM from the thumb drive and chrooting to the system (assuming you have drivers and the drives arn't encrypted) and wango, you can change the root password or install a root kit.

Have you ever read about kernel compile options?

[Anonymous Coward]

Ah yes, the "keystrokes" that you can just disable (or actually not enable) when you build the kernel? Of course, you could also not enable usb and service the device using ssh.

What happend to the Cameras?

[Anonymous Coward]

I thought these things were under the watchful eye of cameras. If they were able to break the machine to get to the USB and then patch it, then those camera's arn't worth shit.

Re:Software security in finance is surprisingly lo

[Anonymous Coward]

Vending machines are, historically, installed in more hostile locations and are more portable and accessible. These assumptions have changed a bit but generally hold true. Banks see theft like this as a financial loss to insure against, vending machine owners see it as a loss of business and reputation. The base mindset is different although the results show that the banks are wrong.

Stuff gets left out

[Anonymous Coward]

So; what was the go-code for the US's atomic arsenal for nearly the entire Cold War?