Hacker News Reader

Comment by bastawhiz | Hacker News Reader

So a lot of things clearly came together here:

1. The attackers knew there was a USB port on these devices that would auto-play, or at least trigger the auto-play dialog. 2. The attackers knew all of the software internals of the machines before they started. You don't just write code that works with any old ATM software. 3. The article stated that 'the organisers displayed "profound knowledge of the target ATMs"'. "Profound knowledge" seems to be an understatement. That's the kind of knowledge that you get when you work for a company that designs and builds ATMs.

Really, I don't see this as anything more than something to chuckle at. It's like if a restaurant was robbed by someone that knew the code for the back door and that a spare key to the safe was taped to the underside of the desk in the back room. If you know what you're doing, of course you can break in.

View on HN

"That's the kind of knowledge that you get when you work for a company that designs and builds ATMs."

Or you just buy your own:

http://www.ebay.com/sch/Business-Industrial-/12576/i.html?_f...

Just ban civilian ownership of ATM's make them like Machine Guns and require end user certificates for sale.

So ATMs would enter the same class as the Kinder Surprise treat, at least in the US?

:->, of course.

EDIT: Originally tried to raise a smiley to the Nth degree, but HN appears to dislike consecutive asterisks and kept munging them to nothingness.

Text surrounded by asterisks becomes italicized.

Oh, yeah. And the first character after the first * wasn't whitespace, it was another *, so HN ate them both and inserted an italicized zero length string.

Or put the USB port on the other end.

Or, do not do that.

Why not its always private atm's (you know the ones with ripoff charges) at mom and pop stores that seem to be the ones getting hacked not ones embedded in the walls of a bank.

Making ATM's only available to organizations with a full banking license might help and some body define proper security standards Bruce Schenier's looking for a new job maybe he might want to take this on?

I find it much more likely they'd skimp on hardening, the bad guys would still find ways to get them but white hats would have an extremely hard time working on the problem, and we'd be in an even worse situation.

Sort of like the problems we have right now with locks.

Well skimp on the hardening and the regulator shuts your atm network down - only have to do it the once.

Autoplay isn't required for these kinds of attacks. I'll confess that I did not watch the actual talk (linked elsewhere), so I don't know if that route was used in this case. I do know, however, that autoplay is not actually required.

Here's a video of a demonstration given back in November of a system (Crossing Guard) being developed at Dartmouth (under the Trustworthy Cyber Infrastructure for the Power Grid). The attack takes advantage of lower level USB operation and does not rely on autoplay.

http://youtu.be/NIlmDpUDudo

[Edit: missing 'not']

The attack in the video, AIUI, doesn't use autoplay: they plug the USB drive in and then restart the machine so it boots off the drive.

1. You can find both pictures of the machines and the ATMs themselves on the internet.

2. Most likely it's (and old) windows. You don't need to write special code for any old ATM software. They could even just use autoplay once to test the grounds and copy anything they could back to the USB for analysis.

3. Ok, I'm not saying the profound knowledge / inside job was not involved... but people have done much more crazy and advanced attacks on black boxes with next to no knowledge. Once they knew they have access to software inside with auto-play they could do anything. Even connect the box to wifi via usb and do everything else remotely.

So why in the name of "bruce" was an ATM ever shipped with a USB port in the firstplace. The firmware update process should be locked down.

what needs to happen is that all the executives of the ATM company and the bank concerned (going back 15 years or so) need to be banned for life from ever being directors and b from ever working in the finance industry

USB port or no, once you have physical access to the internal electronics then the game is over. It seems to me the failure was using materials that could be quickly breached and then patched.

Do you have unique experience to justify up your vitriol?

"once you have physical access to the internal electronics then the game is over"

Common... Someone used an X-acto knife to plug in an USB stick on a PC configured to auto-play it and we should take it as a proof that "physical access to the internal electronics then the game is over"?

Companies like Brinks are using special sprays that renders bills unusable in case someone tries to break in the safes if I'm not mistaken.

What about an ATM where any tentative of opening it to physically access the internal electronics would result in the ATM bricking and all the bills getting instantly sprayed as to render them unusable?

What about spraying the bills and rendering them unusable in case the ATM is powered down and making it impossible to install new software without powering the machine down? (so that when you come with your new harddisk and access the internal to plug it in, you're SOL). This would even have the benefit of rendering attacks of the type: "I come with a truck and steal the part of the wall that contains the ATM" impractical (yes, people have done these).

And where the only way to prevent that, for example during legitimate maintenance, would be to first enter a token generated by the ATM company and communicated to the (legit) employee doing the maintenance when he's working on the machine?

I've never worked on ATMs and I'm sure it shows, but that's not the point.

Honestly I find it quite sad that simply plugging in an USB stick allows to steal money from the machine.

I find it also very sad that several people here consider that "nothing can be done against a rogue employee" or that "nothing can be done if you have physical access to the internal electronics".

And I do honestly hope that people working on ATMs will start thinking about how to better secure their ATMs and which kind of trust systems can be put in place so that rogue employees (and other thieves) have a much harder time attacking ATMs.

"It seems to me the failure was using materials that could be quickly breached and then patched."

That is just one failure. The attacker exploited several holes and the answer from ATM companies should be more complex than just putting duct tape on one of the holes.

With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). But I do agree that when a machine is breached it should halt immediately. Having said that, financial institutions are not going to take this route for a variety of reasons, one of which is just general maintenance. If the case is breached, do you suspect that the intruders had access to everything? If so you want need to brick the entire device, to prevent any data from leaking back to the intruders.

Your suggestion with regards to maintenance is indeed a valid one, but again the increase in cost is simply to big. Most financial institutions in my country and region (western europe) actually see ATM purely as a cost, and install them simply because they want customers to get a hold of their money. It is that simple. So why would they increase the costs?

I think, and I don't want to start any flamewars or anything, that reconsidering the use of Windows in its current form is a valid route. If you were to start from an extremely limited & stripped down version sure, but not in the way companies are currently using it (for those that might wonder, yes full installs of windows happen all the time).

Anyway, I'm glad this is in the open. The more people talk about it, the more things will change.

> With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals).

I used to work in a supermarket with the 'self service' checkouts. The cash dispenser internals looks to be exactly the same as that in basic ATMs [0]. Without going into too many details, in our case the security was minimal and there was no tamper proofing. If you really wanted to get inside it wouldn't have been particularly hard. ATMs may by different as they are slightly more portable than a checkout though :)

[0] http://gadgets.boingboing.net/2009/05/11/this-picture-of-an-...

Basic ATMs found in gas stations and liquor stores are different. All the ATMs in big banks have a safe at the bottom that houses the case made of 1/4 inch or so steel plates.

Yep looked at doing secure paperless direct debit back in 2000 or so it is quite practical to build ATM's securely and to have atm update procedures that are much much more secure requiring a two man approach for edxample.

for physical access Having ATM'S that self destruct on tampering woudl be another possibility like the iron key USB sticks and bank grade key stores

They're shipped with a USB port because they just have a standard computer motherboard. Everything in the ATM that makes it different from the computer you're sitting at right now is just a peripheral.

The point is that ATMs shouldn't be proverbially taping the proverbial spare key to the underside of the proverbial desk.

A well-designed system can withstand the attacker knowing all of its details aside from the secret key chosen by the owner. That's the whole point of avoiding "security through obscurity".

Reply on news.ycombinator.com