Slashdot Mirror
Most ATMs Can Be Hacked in Under 20 Minutes (zdnet.com)
An extensive testing session carried out by bank security experts at Positive Technologies has revealed that most ATMs can be hacked in under 20 minutes, and even less, in certain types of attacks. From a report: Experts tested ATMs from NCR, Diebold Nixdorf, and GRGBanking, and detailed their findings in a 22-page report published this week. The attacks they tried are the typical types of exploits and tricks used by cyber-criminals seeking to obtain money from the ATM safe or to copy the details of users' bank cards (also known as skimming). Experts said that 85 percent of the ATMs they tested allowed an attacker access to the network. The research team did this by either unplugging and tapping into Ethernet cables, or by spoofing wireless connections or devices to which the ATM usually connected to. Researchers said that 27 percent of the tested ATMs were vulnerable to having their processing center communications spoofed, while 58 percent of tested ATMs had vulnerabilities in their network components or services that could be exploited to control the ATM remotely.
Who buys these shitty things? Why are banks so fucking stupid about their core competency?
with a hacksaw?
In my country with 15-20k you're set for many many years to come.
The elderly people in line always take that long
This will be fixed... when the loss caused by hackers exceeds the cost of implementing proper security.
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
The majority of people in the US don't even have enough liquid money to afford a $1000 emergency and you think 15-20k is a small amount?
The only thing necessary for evil to triumph is for it to be pitted against a slightly greater evil
Is that the same as even less than under 20 minutes?
X509 is hard.
Good thing they got rid of those banks with safes and armed guards.
Might take some real risks to rob a bank.
Diebold made voting machines.
Everyone else in that industry is just as bad. No threat models, at all. That's why I'm getting into the industry.
Support my political activism on Patreon.
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
[British Accent]Quite right you are my man. Unless Foofy needs a new rolls I try to limit my personal cashier boy to a similar small fund which they may withdraw from these mechanical money boxes. Least the less trustworthy boys have been known to drain a persons account to the point that one must take a public jet to the Alps instead our families private whirly birds.[/British Accent]
These attacks seem to require you to be alone with the machine, while having access to its backside where the cables come out.
Yeah... veeery realistic. --.--
Try again with a vandalism-hardened ATM in a brick wall with cameras and security personnel looking at them. Then and only then do you get to write sensationalist headlines like this.
Why do you think the PIN only has 4 digits most of the time? Not because that's so hard to crack. It's only a token. The security is provided by what's around it.
(And yeah, they should still improve these things anyway, because it's always good to have multiple layers of security. Then again, if we'd think this though, we'd get rid of banks altogether, as they are untrustworthy thieves by their very definition. [Actually worse than thieves, as thieves usually don't make up money on the spot [$92 for every $8] and get the government to side *with* their imaginary money being real.])
What constitutes "hacking" these machines? Root access? Money shooting out? Transfer of funds from accountA to accountB?
Politics; n. : A religion whereby man is god.
These guys did it in 36 seconds. Granted, network hacks and elegant solutions need to be addressed. But what's the point if you cant keep a couple of guys with a pickup truck and a chain from driving off with it. It always reminds me of this xkcd.
Anyone with sense limits the amount of money in their ATM / online banking accessible account to a small amount, like 15-20k, unless a large purchase is coming. This is a simple way to protect yourself.
The majority of people in the US don't even have enough liquid money to afford a $1000 emergency and you think 15-20k is a small amount?
Gosh, I have foolishly been keeping a billion and a half dollars in my checking account connected to my ATM card... I should probably reduce that to 15 to 20 times the maximum amount I’ve ever HEARD of an ATM allowing someone to take out, (or more like about 40 times, for most ATMs I’ve ever used).
What I was going to suggest though, is that it’s okay for most ATMs to be hackable in under twenty minutes, as long as they alert the police when someone starts trying to hack them, and the time it takes for the police to arrive, and shoot the thief in the head averages, say... 10 minutes or less. As long as trying to steal from an ATM more often than not results in a dead thief, I’m not really sure how that’s a problem.
See, I’m normally pretty sympathetic to the poor, and someone who steals a loaf of bread to feed his starving family and has no other way, or someone who breaks some law by accident... but when you HACK into an ATM, that’s... yeah, I’m pretty sure you can’t, WOOPS, ACCIDENTALLY hack into an ATM, and if you’re stealing thousands or tens of thousands of dollars at a time, yeah-no.
You might even say you’re okay with theft from a bank or an ATM because banks, which own the ATMs, are rich. But that’s just the problem. You can’t steal from the rich. They find ways to turn around and make it so that when you try to steal from them, you really end up having stolen from their customers, most of whom are NOT rich. Same goes for petty theft from any place where I shop. You’re not stealing from MalWart, let’s say, you’re stealing from ME if I shop there, because to cover the loss, they have to raise prices... because they’ll be DAMNED before they cut profits or executive salaries. As for common worker salaries, they’ve already cut those to the bone. There’s no fat there left to cut. Hell, they’ve already half-way to done away with cashiers. I wonder how they’ll get us, the customers to stock their shelves for them.
I’m sure they’re working on it.
Found the trust fund kid.
It's not banks being rich...it's that they get bailed out every time. And there is no such protection for anyone else.
He's probably talking about 15-20k rupees. ($300)
Spare some pocket change?
'Trust fund kids' are the ones that the parents know are too incompetent to handle money (e.g. Jerry Brown, CA governor).
If they had 150k, they'd spend it on hookers and blow. That's why the trust has to dribble out a monthly allowance.
Someone claiming 150k$ in a checking account, is either a moron or a troll, depending on if it's true or not.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
The usual method is gas. No, not petrol, bottled cooking gas. Or some heavy vehicle for a battering ram. Shades of the 5$ wrench.
What could I do with say a few million?
20 minute hack is easy. How long does it take to strap a convenience store ATM to the back of a pickup truck and floor it?
I mean, are banks actually running across a regular problem where they go to refill an ATM machine and verify all the transactions, and discover somebody emptied out a few hundred or thousand bucks that they can't account for?
Seeing the attitude they seem to take with credit card fraud (just cancel the card, refund the fraudulent transactions and move on) ... I guess nothing would surprise me. But I have to think the number of folks with the expertise to pull these hacks off who ALSO would risk jail time to do them is really small, vs. the number of common criminals who try the brute force methods we see on the TV news all the time. (Attach tow hook to machine and try to yank it out of the wall with a big truck, etc.)
- Bruce Schneinerdoodle.
If someone can stand at an ATM for that long without being brought to a backroom and interrogated, then there's already a problem--and it has nothing to do with the machine being at risk of being hacked.
20 minutes to hack an ATM seems pretty crazy, right? Don't worry, I have a solution.
Let's start an ATM Thieves Guild. It's unacceptable that in today's busy world that it takes so long to commit crimes. We promise to make Moore's Law work for you, and get that time down to 10 minutes or less.
How's the return on that checking account?
Yeah, I thought so.
In most of Europe, they are nearly exclusively in banks or in a wall next to a bank.
Only rarely do you see free-standing ones. And they are kinda a joke, since anyone can presumably just drive off with them.
Or do you mean card payment terminals?
Those are usually rather secure too. Since they are nothing more than a router for encrypted packets between the card's chip and the bank server, and serving a keypad and display to that chip too, in a physically tamper-detecting and usually tamper-resistant case. Sure, you could theoretically make the keypad and display show something else, but you can't get more than nabbing somebody's PIN via one of the countless other means that you can use in any case. Don't put your "something you know" secret into anything whose trustworthiness you haven't checked. *No* amount of technology can help you otherwise.
Every one of the methods involved opening/unlocking the physical casing! Obviously, being able to remove the HDD or insert a USB drive is going to make the hack a lot easier.
Ignore the article above.
Your door locks, microwave, door bell, and baby monitor will all be quite safe, we assure you!
What are you talking about. Why would an ATM have wifi-anything and why would you have an ATM with an ethernet cable accessible in a timeframe that less than what it takes for cops to arrive?
The tamper sensors are usually little piezoelectric pucks. Under pressure these complete a circuit. If the circuit broke that triggers the tamper detection. Salt water with a bit of soap will also complete the circuit allowing many of these devices to be opened. There were other simple physical hacks against these devices. I was always frustrated because I couldn't publish the attacks so that the manufacturers could prevent them. It got to the point where a device passed if it took me more than 4 hours to compromise it. There were a few companies that made good machines but their machines were significantly more expensive than the other crap.
Software was terrible. Banks didn't want good software security they wanted the security that everyone else had. That way if they were hacked they could claim they were doing industry standard practices.
If it makes people feel better, it is worse in England. If anyone finds an exploit there the banks and vendors harass you to the point were it really isn't worth your while.
Don't you have the colouring anti theft measures in the ATMs in the US?
You didn't read the article. They are literately talking about jackpotting the ATM's by telling the ATM's OS to dispense money at will, or intercepting data to the ATM network. The latter is likely easier to catch by the ATM network, but if someone jackpots an ATM nobody will know unless the ATM has been physically damaged in the process.
Here's a theoretical example. Someone installs the malware on the Windows XP ATM, Someone comes by and withdraws or deposits 20$, the crook then waits for them to go away and then tells the ATM to dispense $2000, and snatch it without the camera seeing them. So the person who just withdrew will look like they somehow withdrew $2020, and since there's no crook on camera, guess who gets accused of it?
But that's not the only theoretical example. There's also the possibility of using malware on the ATM to digitally skim the cards and then replay the transaction over and over again until the ATM is empty.
... here in Oz.
I've never seen them in ATMs I've worked on. Mostly hollywood. Also, most convenience store ATMs don't have cameras, another hollywoodism. (Fancier huge Bank ATMs like diebold are sure to have die packs and cameras.)
"...The research team did this by either unplugging and tapping into Ethernet cables..."
Oh please. For Such scams you need to get inside (perhaps as a fake technician) and behind the said machines to physically unplug the ethernet cables. That kind of access goes far beyond typical client-bank relationship whom usually only have access to said ATM-terminal.
Unless US ATM's have their ethernet cables routed outside the cabinet into the street?
Some of these supposedly security breach reports are so ridiculous. Sure driving a car into the bank is a security threat, so why don't you just ditch the doors and windows altogether.
'Trust fund kids' are the ones that the parents know are too incompetent to handle money (e.g. Jerry Brown, CA governor).
If they had 150k, they'd spend it on hookers and blow. That's why the trust has to dribble out a monthly allowance.
Someone claiming 150k$ in a checking account, is either a moron or a troll, depending on if it's true or not.
Or someone who assumes that the stock market will crash quickly, which will force the Fed to lower interest rates again, which will mean almost all asset classes will lose value over the coming month.
which will force the Fed to lower interest rates again, which will mean almost all asset classes will lose value over the coming month
No.... the Fed has been doing the opposite of Quantitative Easing they were aggressively doing during Obama's administration: attempting to trim their balance sheet, in addition to the aggressive interest rate increases --- the reverse QE will mean they could lower interest rates to 0 and still potentially make a catastrophe;
But leaders in the Fed have been looking disdainfully at the high stock market prices for a while now, and planning on how to take those prices down to what they personally feel they should be --- also, even though the Fed is supposed to be politically independent - I suspect some are political and upset with how well the economy appear to be doing during a Trump presidency; since appearance is everything, there are people in the Fed who would like to try and quietly use fed influence to cut back on liquidity at an excessive rate to make the economy appear to be a disaster for the next 2 years or so, in the hopes their result by Fed tampering is they get a democrat into office next.
They are not done yet by far... and they intend to accelerate the rate of reverse QE over the course of the next couple of years until they eliminate the excess reserves (electronic fictional cash they created).
Reverse QE reduces the size of the base money supply and will be evaporating 1.5 Trillion of $$ in deposits/lendable money out of the banking system.
Regardless of what they do with interest rates; the Uncertain affects of the reverse QE likely stand to have a high chance of causing not merely some loss in value but to crash nearly ALL asset prices
including precious metals, and there will be some more bank insolvencies that may make 2008 or the last time the Fed tried something like this.... 1937.. look tame.
https://www.ptsecurity.com/ww-...
over here they all have die packs and cameras
How does the camera in the ATM - that takes photos of every person pushing ATM buttons - not see the culprit?
How does the camera filming the area the ATM/s are in not see someone at an ATM?
If you are invisible, there are easier and safer ways to get rich.
You don't know what a trust is. It has nothing to do with the assets, only putting an adult in charge of the assets so the 'Trust fund kid' can't blow it all.
Jerry Brown's parents knew him better than the voters of CA. Like most true morons, he has only gotten dumber with age.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
No you shut up.
i'm the best noober hacker there is,
i even make APK host file engine.
i'm so noob.
APK.
i'm such a noober hacker.
APK
i'm the biggest noober hacker there is,
apk.