SlideShare a Scribd company logo
1 of 35
Download to read offline
Hacking ATM Machines For Fun & Profit!
By Ebrahim Hegazy
Not this type of security guys!
Agenda
 ATM Providers overview
 How ATM's Works?
 ATM Components
 How ATM recognize you?
 ATM Skimmers
 Demo Video
 ATM Penetration Testing
 ATM Physical Pentesting
 Logical Penetration Testing
 Disclosed Routers
 ATM Pentesting Story.
 Conclusion
 References
Ignite Your Mind
ATM Providers overview
Ignite Your Mind
How ATM's Works?
Ignite Your Mind
ATM Components
Computer Case
Ignite Your Mind
Ignite Your Mind
ATM Components
Operating System
ATM Components
Startup Scripts
Ignite Your Mind
ATM Components
ATM (Asynchronous Transfer Mode) Switch
Ignite Your Mind
How ATM recognize you
Ignite Your Mind
How ATM recognize you
Ignite Your Mind
ATM Skimmers
Ignite Your Mind
ATM Skimmers
Ignite Your Mind
ATM Skimmers
Ignite Your Mind
Stay Safe
Ignite Your Mind
ATM Penetration Testing
Ignite Your Mind
Different ATM Hacking Techniques
ATM Forking
Different ATM Hacking Techniques
Tyupkin
ATM Physical Pentesting
 Surveillance Cameras
 Light buttons
 Lock-Picking
 Disclosed Operating System
 Disclosed Router
 Misconfigured Internet Ports
 Guards Around
 ATM Ground Position
 Old lady scenario?
Ignite Your Mind
Logical Penetration Testing
 Operating System Auditing & Pentesting
 Memory Analysis
 Network Penetration Testing
Ignite Your Mind
Logical Penetration Testing
 Operating System Auditing & Pentesting
 Booting other Operating System
 BIOS Security
 USB Ports & CD
 Current user privileges
 Easy guessable administrator user password
 Hard coded passwords
 Unprotected private keys
 Outdated softwares
 Etc etc
Ignite Your Mind
Logical Penetration Testing
 Lan Turtle
Ignite Your Mind
Logical Penetration Testing
 Lan Turtle
Ignite Your Mind
Logical Penetration Testing
Ignite Your Mind
 Lan Turtle
Logical Penetration Testing
 Memory Analysis
Ignite Your Mind
Logical Penetration Testing
 Network Penetration Testing
 Bypassing Port Security
 Network Isolation
 Data Encryption at transit & at rest
 Scanning Network Services
 Misconfigurations
 Un-patched Systems
 Services with guessable passwords
 Common Network Attacks (ARP Spoofing, DNS Poisoning)
 Etc etc …..
Ignite Your Mind
Disclosed Routers
Ignite Your Mind
Disclosed Routers
Ignite Your Mind
Demo Time
Disclosed Routers
 What could go wrong?
 DOS Attack
 Plug the Ethernet cable
into your Laptop
 Hmm! Port Security?
 Physical Security?
Ignite Your Mind
Real ATM Pentesting Scenario
Ignite Your Mind
Ignite Your Mind
References
 Networking Concepts
https://www.cybrary.it/course/cisco-ccna/
 Network Attacks
https://www.cybrary.it/course/advanced-penetration-testing/
 ATM Skimmers
http://krebsonsecurity.com/all-about-skimmers/
Ignite Your Mind
MACchanger Lock-Picking Cisco ISE SNMP
Kali Linux Volatility OSI Model Domain Controller
Active Directory Lan Turtle Enum4Linux SMB Null Session
Ignite Your Mind
Ignite Your Mind
 Ebrahim Hegazy
 www.sec-down.com
 Twitter.com/zigoo0
 Zigoo.blog@gmail.com

More Related Content

What's hot

Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023
PECB
 

What's hot (20)

SOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations CenterSOC presentation- Building a Security Operations Center
SOC presentation- Building a Security Operations Center
 
Introduction to Malware Analysis
Introduction to Malware AnalysisIntroduction to Malware Analysis
Introduction to Malware Analysis
 
An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)An introduction to SOC (Security Operation Center)
An introduction to SOC (Security Operation Center)
 
Reverse proxies & Inconsistency
Reverse proxies & InconsistencyReverse proxies & Inconsistency
Reverse proxies & Inconsistency
 
Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023
 
Firewall, Router and Switch Configuration Review
Firewall, Router and Switch Configuration ReviewFirewall, Router and Switch Configuration Review
Firewall, Router and Switch Configuration Review
 
CISSP Cheatsheet.pdf
CISSP Cheatsheet.pdfCISSP Cheatsheet.pdf
CISSP Cheatsheet.pdf
 
HITCON GIRLS_惡意程式分析介紹_in 成功大學_by Turkey_2016.04.28
HITCON GIRLS_惡意程式分析介紹_in 成功大學_by Turkey_2016.04.28HITCON GIRLS_惡意程式分析介紹_in 成功大學_by Turkey_2016.04.28
HITCON GIRLS_惡意程式分析介紹_in 成功大學_by Turkey_2016.04.28
 
Ceh v5 module 19 evading ids firewall and honeypot
Ceh v5 module 19 evading ids firewall and honeypotCeh v5 module 19 evading ids firewall and honeypot
Ceh v5 module 19 evading ids firewall and honeypot
 
Windows Threat Hunting
Windows Threat HuntingWindows Threat Hunting
Windows Threat Hunting
 
Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh Présentation et démo ELK/SIEM/Wazuh
Présentation et démo ELK/SIEM/Wazuh
 
Governance of security operation centers
Governance of security operation centersGovernance of security operation centers
Governance of security operation centers
 
Developing High-Impact Malware with Minimal Effort.pptx
Developing High-Impact Malware with Minimal Effort.pptxDeveloping High-Impact Malware with Minimal Effort.pptx
Developing High-Impact Malware with Minimal Effort.pptx
 
Threat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-onThreat Hunting with Splunk Hands-on
Threat Hunting with Splunk Hands-on
 
Malware Static Analysis
Malware Static AnalysisMalware Static Analysis
Malware Static Analysis
 
Malware Analysis Made Simple
Malware Analysis Made SimpleMalware Analysis Made Simple
Malware Analysis Made Simple
 
SIEM in NIST Cyber Security Framework
SIEM in NIST Cyber Security FrameworkSIEM in NIST Cyber Security Framework
SIEM in NIST Cyber Security Framework
 
DEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICSDEF CON 23 - NSM 101 for ICS
DEF CON 23 - NSM 101 for ICS
 
Next-Gen security operation center
Next-Gen security operation centerNext-Gen security operation center
Next-Gen security operation center
 
Thick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptxThick client pentesting_the-hackers_meetup_version1.0pptx
Thick client pentesting_the-hackers_meetup_version1.0pptx
 

Similar to Hacking ATM machines for fun and profit!

Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy toolGattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
Slawomir Jasek
 
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
Cristofaro Mune
 
Threat stack aws
Threat stack awsThreat stack aws
Threat stack aws
Jen Andre
 
Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"
Jeremiah Grossman
 

Similar to Hacking ATM machines for fun and profit! (20)

Old Linux Security Talk
Old Linux Security TalkOld Linux Security Talk
Old Linux Security Talk
 
Information security & ethical hacking
Information security & ethical hackingInformation security & ethical hacking
Information security & ethical hacking
 
Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy toolGattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
Gattacking Bluetooth Smart devices - introducing new BLE MITM proxy tool
 
Securing Underprotected APIs - Deja vu Security
Securing Underprotected APIs - Deja vu SecuritySecuring Underprotected APIs - Deja vu Security
Securing Underprotected APIs - Deja vu Security
 
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
DEF CON 27 - DANIEL ROMERO and MARIO RIVAS - why you should fear your mundane...
 
Root via sms. 4G security assessment
Root via sms. 4G security assessment Root via sms. 4G security assessment
Root via sms. 4G security assessment
 
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
Blue Hat IL 2019 - Hardening Secure Boot on Embedded Devices for Hostile Envi...
 
Cybercrime & Business. Jak wygrać tę wojnę?
Cybercrime & Business. Jak wygrać tę wojnę? Cybercrime & Business. Jak wygrać tę wojnę?
Cybercrime & Business. Jak wygrać tę wojnę?
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
Ethical hacking
Ethical hackingEthical hacking
Ethical hacking
 
The Good The Bad The Virtual
The Good The Bad The VirtualThe Good The Bad The Virtual
The Good The Bad The Virtual
 
Key logger,Why? and How to prevent Them?
Key logger,Why? and  How to prevent Them?Key logger,Why? and  How to prevent Them?
Key logger,Why? and How to prevent Them?
 
Threat stack aws
Threat stack awsThreat stack aws
Threat stack aws
 
Messing around avs
Messing around avsMessing around avs
Messing around avs
 
The A and the P of the T
The A and the P of the TThe A and the P of the T
The A and the P of the T
 
The A and the P of the T
The A and the P of the TThe A and the P of the T
The A and the P of the T
 
Chapter 4 access control fundamental ii
Chapter 4   access control fundamental iiChapter 4   access control fundamental ii
Chapter 4 access control fundamental ii
 
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
Don't Tell Joanna the Virtualized Rootkit is Dead (Blackhat 2007)
 
Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"Web Application Security and Release of "WhiteHat Arsenal"
Web Application Security and Release of "WhiteHat Arsenal"
 
HKUST Security Lab Opening Ceremony
HKUST Security Lab Opening CeremonyHKUST Security Lab Opening Ceremony
HKUST Security Lab Opening Ceremony
 

Recently uploaded

Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Victor Rentea
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Safe Software
 

Recently uploaded (20)

FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024FWD Group - Insurer Innovation Award 2024
FWD Group - Insurer Innovation Award 2024
 
AWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of TerraformAWS Community Day CPH - Three problems of Terraform
AWS Community Day CPH - Three problems of Terraform
 
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024Finding Java's Hidden Performance Traps @ DevoxxUK 2024
Finding Java's Hidden Performance Traps @ DevoxxUK 2024
 
Platformless Horizons for Digital Adaptability
Platformless Horizons for Digital AdaptabilityPlatformless Horizons for Digital Adaptability
Platformless Horizons for Digital Adaptability
 
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
Connector Corner: Accelerate revenue generation using UiPath API-centric busi...
 
Six Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal OntologySix Myths about Ontologies: The Basics of Formal Ontology
Six Myths about Ontologies: The Basics of Formal Ontology
 
Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..Understanding the FAA Part 107 License ..
Understanding the FAA Part 107 License ..
 
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ..."I see eyes in my soup": How Delivery Hero implemented the safety system for ...
"I see eyes in my soup": How Delivery Hero implemented the safety system for ...
 
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 AmsterdamDEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
DEV meet-up UiPath Document Understanding May 7 2024 Amsterdam
 
ICT role in 21st century education and its challenges
ICT role in 21st century education and its challengesICT role in 21st century education and its challenges
ICT role in 21st century education and its challenges
 
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers:  A Deep Dive into Serverless Spatial Data and FMECloud Frontiers:  A Deep Dive into Serverless Spatial Data and FME
Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
 
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
Apidays New York 2024 - Accelerating FinTech Innovation by Vasa Krishnan, Fin...
 
[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf[BuildWithAI] Introduction to Gemini.pdf
[BuildWithAI] Introduction to Gemini.pdf
 
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemkeProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
ProductAnonymous-April2024-WinProductDiscovery-MelissaKlemke
 
presentation ICT roal in 21st century education
presentation ICT roal in 21st century educationpresentation ICT roal in 21st century education
presentation ICT roal in 21st century education
 
Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...Apidays New York 2024 - The value of a flexible API Management solution for O...
Apidays New York 2024 - The value of a flexible API Management solution for O...
 
Artificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : UncertaintyArtificial Intelligence Chap.5 : Uncertainty
Artificial Intelligence Chap.5 : Uncertainty
 
MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024MINDCTI Revenue Release Quarter One 2024
MINDCTI Revenue Release Quarter One 2024
 
Strategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a FresherStrategies for Landing an Oracle DBA Job as a Fresher
Strategies for Landing an Oracle DBA Job as a Fresher
 
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
Web Form Automation for Bonterra Impact Management (fka Social Solutions Apri...
 

Hacking ATM machines for fun and profit!