ATM flashes a port or two for the enterprising hacker Behold an ATM crying out for a man-in-the-middle attack. An obsolete Microsoft operating system cannot be blamed here. This is all about the hardware. When we talk about installation, we're usually referring to Windows 2000 turning up on a ticket machine, Windows 7 showing its face where it isn't welcome, or even Windows 10 …
...it might be in a secure location, not out on the street. Still a bit ugly though.
Unrelated anecdote. In Before Times, we used to have a cash machine in our access-controlled office. One night there was a break-in, but the dumb scrotes were more interested in the shiny (but pretty crap) large plasma screen in reception to walk 5 meters further and grab some easy cash.
Same here...
If it's not nailed down...
If it is nailed down, an extra locking bar or two helps delay the inevitable disappearance...
One thing that didn't disappear were the batteries that operated the early warning/flood warning speakers that they used to have in police stations. A colleague gave a replacement battery to the desk sergeant... who promptly filed it away under the counter will all the previous unused batteries
(an odd size/voltage possibly saved them, but they could repurpose just about anything)
"Secure locations" have robust physical protection, fences, unobscurable observation areas, lights, movement sensors, alarms (doors, windows, checkpoints, zones, tamper), user ID/access control, movement tracking, CCTV, 24-hour monitoring, human guard presence and a credible response force, all with regular auditing and testing. Less than that is some degree of "open access".
That's overkill for a router and ATM but then I wouldn't describe anything vulnerable to passers-by or a quick ram-raid as "secure". And ATM's are, by definition, installed where the users (public) can get to them.
ATM traffic is encrypted/secured inside the safe and there're other measures to detect/resist attack, any external networking boxes are just for connectivity.
Outside of a secure branch environment, most ATMs are likely to have exposed connections, i.e. in convenience stores, supermarkets etc., it's ok as they're designed to be secure in the real world.
If there were viable MITM attacks, things would've fallen apart long ago, aside from ATMs, card payment terminals wouldn't be viable, yet pretty much every shop has them these days, and they survive just fine with insecure/exposed connections.
A denial of service attack seems to be the easiest option to compromise the InfoSec. The availability of the system components doesn't really seem to have been part of the design considerations. It's possible the C and I elements have been overlooked as well, but as Empire of the Pussycat has suggested, maybe there are controls in place to cover these.
I'm pretty sure there'll be people operating ATMs without keeping them up to date, leaving out recommended security features, sweating old devices that don't support modern protection, etc., likely skimping on cost at the expense of security.
Or not being careful about physical security, then the criminals get away with using cameras to peek at PINs/cards, fitting fake keyboard overlays, or skimmers/shimmers.
Long ago I did some security consultancy for a bank, they'd been plagued with gas attacks, in the end they decided to accept the attacks as it was far cheaper than a program to retrofit the estate with detection/mitigation.
These days, running ATMs will be an unwanted cost for banks in many countries, with less cash being withdrawn the interchange fees are lower, and the pay-to-use operators targeting the desperate will be on thin margins, might be less money to spend on security than ever.
On Wednesday afternoons, I play an acoustic gig in a local coffee shop. It's called "The Bank House", because, unsurprisingly, it used to be a bank. There's still an ATM in the wall outside, and I guess that the back of the machine was accessible from within the bank. But when the bank was decommissioned, they built a concrete block wall around that corner of the room, and cut a hole for an armoured door in the outside wall. That's security!
The connectivity medium should always be considered hostile when the machine is connecting from an uncontrolled environment.
It would be cost prohibitive to put enough controls in place around the router/cpe/‘physical connection to isp’ so is cheaper & more effective to build it into the atm machine so it can reliably & securely connect via an unsecured network.
Sniff as much as you want it should be safe.
If not the atm owner should find out soon enough & learn about a new hacking method which is likely cheaper discovery than the amount of cash in the machine.
Won’t be as secure once government ban vpn’s though but I suspect there will be many exemptions for things like this forming encrypted tunnels to authorised end points.
Will get tricky when those end points are in the cloud on IP’s shared with other services but that will likely be an edge case because who would build a von to a domain name instead of fixed IP’s (probably a norm nowadays to use fqdn’s instead of IP’s your business owns for p2p vpn’s but I’m old school)
I'm really not sure what the excitement is here - how do you think remote ATMs are deployed in supermarkets and other places? It's always over the public internet now, that's how they're so prevalent.
The biggest security risk here is "someone might nick the cat5 cable or VDSL/4G modem". Or someone might unplug it so it stops working. Or plug in their laptop and nick some free internet access (assuming it's not locked down).
Look at any ATM in your local coop. It's literally plugged into a wall socket. It's possibly even connected via wifi to the shop's network rather than its own access point, I wouldn't expect anyone to be taking photos and worrying about someone running wireshark on their laptop..
More like 100% certain. That's how those things connect, via those dual connective routers. Frankly I'm surprised they've bothered with both vdsl and SIM.
In ye olden days when a line like that was expensive, they used to have dial-up modems instead - you could even hear some of them dialling when you made the request for cash if they had an internal speaker. I'm guessing the person reporting this security breach would have had kittens at the wire tapping opportunities there of picking up another extension and listening in..
They also operated differently - normally an ATM will ask for pin and validate it immediately, then ask how much cash you wanted. The shop-standing dial-up ones used to ask for your pin, how much cash you wanted, *then* validated it, just so they could do one dial-up request instead of two.
Yes, its a naff installation. Yes, I'd be worried about someone lifting the router "just because its there". But seriously, if the ATM is designed properly you can MoM it until the cows come home and it will at best ignore you, at worst just shut down.
We spend far too much time focusing on the user interface aspect of an application's design. Yes, its important to have a reliable,understandable and visually pleasing design but this is really just the paint job. The internals need to be bulletproof, immune to anyone doing anything untoward on any interface. All too often when someone writes about a new distribution or device all they talk about is the interface which unwittingly promotes a 'if all you have is a hammer everything's a nail' mindset that always seems to be surprised when the system exhibits operational quirks (bugs) and generally misbehaves.
I remember when ATMs sang the 1200baud song, was maybe 5 years ago that my local quickiemart moved to cable(?) internet. As for interruptable power: nobody around here expects that an ATM will *always* work; and if the store has gone dark no business will be done. (I do think the local electric company prioritizes such as Caroll's Market so their line workers can get coffee and buns.)
