Blackhat, ATMs, and Money Fountains, Oh My!

Security blogs and websites are all buzzing with the news of Barnaby Jack's Blackhat demonstration of ATM insecurity. Wired has coverage, our favorite security monkey has a video, and others including Tony Bradley from PC World covers the important lessons from the talk.

So does the hack tell us something truly new? I don't really think so. For years, many ATMs have been poorly embedded systems, often running commodity operating systems that rely more on physical security provided by locked boxes than on heavily secured operating systems with appropriate security controls. I've written about the insecurity of some ATM uplinks before, and accessing their network connection is often very simple in public locations.

What the exploit does do is serve to point out vulnerabilities in the specific ATMs, both of which were running Windows CE. It also serves as a reminder that any operating system that can be remotely accessed, or that allows its filesystem to be written, or to mount USB devices is vulnerable. Since many ATMs run Windows XP, or even Windows NT, they make attractive targets to those who have pre-written malware that works on Windows systems.

It should also remind us to review what devices we rely on that have embedded PC platforms in them. Windows CE, NT, XP, and various flavors of Linux appear throughout our IT infrastructure, and while we're used to locking down network access, often embedded devices don't provide strong local security. I've run into everything from AV controllers and music players to embedded systems running animal feeding systems for research. Most of the time, my only ability to secure them is to lock them away, limit access to the room they live in, and to ensure that they're on a secured network.

How do you secure your embedded systems? Have you gone so far as to modify appliances that manufacturers don't want changed?

ATM Skimmers - Brian Krebs on advances in skimmers

Brian Krebs' Krebs on Security blog has a great slideshow of some of the more advanced ATM skimmers that have been found recently - well worth a look if you're interested in ATM security.

We've talked about ATM security before:

• ATM Physical Security Humor
  
• Self Defending South African ATMs
• Brazilian ATM Skimmer Installation Video
• ATM skimmer SMS capabilities

Self Defending ATMs: South African ATM Security

The Guardian describes South African ATMs designed to help combat the high incidence of ATM theft and destruction - over 500 in a single year. The article describes a variety of methods used to break into ATMs including explosives.

Pepper spray seems like a poor deterrent for thieves willing to use explosives to break into an ATM - but it may at least deter more casual criminals. Of course, the article notes that technicians have been amongst those who have suffered from the pepper spray, which they inadvertently activated. This also creates a hazard to those in the surrounding area, as pepper spray can spread and effect customers or others downwind.

In a highly hostile environment, self defending ATMs seem like an obvious step - but pepper spray may not be the best solution for others in the area. For now, law enforcement can look for the ATM using customers wearing gas masks.

How Does Your ATM Uplink? Or "Physical Security Humor As An Installation Art Form"

A recent trip to the ATM resulted in an interesting receipt as the ATM crashed. Note the debugging information providing connectivity details for the ATM. In and of itself, this wasn't a real issue, but it was interesting to see, as the ATM appeared to be working properly.

Once this three foot long error receipt printed however, we noticed something more interesting about the ATM.


That deep dark space to the left of the ATM contained networking devices, including the network uplink. Since this is a third party ATM on private property, it was not connected to the building's network.


The devices appear to include some form of serial or parallel device, an ethernet to PCMCIA bridge with an AT&T wireless cell card, and an antenna with a magnet to provide reception from the top of the ATM. Sadly, the strongest physical security control here is the sheer amount of dirt present. Nothing would prevent a malicious (or curious) person from placing a hub between the bridge device and the ATM's link to capture traffic. The cell network card could even be taken and used quite easily. Best of all, the ATM has no coverage with a camera system, and is in an area that is open at all hours of the day.

A number of very simple actions could be taken to greatly improve the security of this ATM and its operations.

• Secure the connectivity devices and network connections.
• Install a security camera, either in the ATM or, better, with a vantage point to watch the ATM itself.
• Prevent the device from providing debugging or error messages without entry of an administrative code or key.