The most common story that we hear: something happens with ATM that makes it empty, leaving no forensic evidence. No money and no logs. We have collected huge number of cases on how ATMs could be hacked during our researches, incidents responses and security assessments. A lot of malware infects ATM through the network or locally. There are black boxes, which connect to communications port of devices directly. There are also network attacks, such as rogue processing center or MiTM. How to stop the ATMs fraud? How to protect ATMs from attacks such as black box jackpotting? How to prevent network hijacking such as rogue processing center or MiTM? Some of these issues can be fixed by configuration means, some fixed by compensation measures, but many only by vendor. We will tell you about what bank can do now and what we as a community of security specialists should force to vendors. Before we spoke about vulnerabilities and fraud methods used by criminals. Now we would like to combine our expertise to help financial and security society with more direct advices how to implement security measures or approaches to make ATMs more secure. --- Olga Kochetova Olga is interested in how various devices interact with cash or plastic cards. She is a senior specialist for the penetration testing team at Kaspersky Lab. Olga has authored multiple articles and webinars about ATM security. She is also the author of advisories about various vulnerabilities for major ATM vendors and has been a speaker at international conferences, including Black Hat Europe, Hack in Paris, Positive Hack Days, Security Analyst Summit, Nuit Du Hack, Hack In The Box Singapore and others. --- Alexey Osipov Lead Expert on a Penetration Testing Team at Kaspersky Lab. An author of variety of techniques and utilities exploiting vulnerabilities in XML protocols and telecom equipment security. Author of advisories for various vulnerabilities for major ATM vendors. A speaker at international security conferences: Black Hat, Hack in Paris (presenting the paper on ATM vulnerabilities), NoSuchCon Paris, Nuit du Hack, Hack In The Box Singapore, Positive Hack Days, Chaos Communication Congress.

1. ATMs how to break
them to stop the fraud
Olga Kochetova, Alexey Osipov
Kaspersky Lab

2. root@root:~# whoami
Penetration Testing Department, Kaspersky Lab
• @_Endless_Quest_, @GiftsUngiven
• ATM and POS security assessment
• Penetration Testing
• Forensic Investigation
Speakers at many IT events
Authors of multiple articles, researches and
advisories

3. What is ATM

4. Lego

5. About hardware

6. About software
• Host (computer)
• MS Windows (Windows XP!!1)
• GUI and device control
• Antivirus/Integrity control software
• Video surveillance
• Radmin/TeamViewer and other crap
• Devices
• Some microcontrollers with RTOS

7. About logic

8. Level 0

9. Cassettes
• Secure casing
• Tamper proof
• Tamper evident

10. Cassettes
• Tracking system
• Cash spoiling devices
• Alarms

11. Cash
• Easily traceable
• Can’t be extracted from
cassettes with force

12. Cards
• No static data
• Dynamic data can’t be
relayed
• Secrets, that dynamic
data is based upon
can’t be extracted

13. Level 0

14. Level 1

15. Dispenser
• Contains cassettes
• Cash cassettes
• Reject cassette
• Manages mechanics
• Sends statuses
• Receives commands

16. Card reader
• Identifies user and his
account
• Can provide
authentication
capabilities
• EMV
• Match-on-card for
biometric data

17. PIN pad
• Commonly used to
enter authentication
data
• Also used to insert
amount of money
• Sometimes can be
combined with
keyboard

18. Biometric authentication devices
• Grabs physical
properties of user for
authentication
• Multiple flavors
• Iris
• Fingerprint
• Voice
• Face
• Vein
• etc.

19. Dispenser/Card reader/PIN pad
• Commands are
authenticated
• Communications are
encrypted
• Firmware is
modification proof
• Sensitive data is
separately protected

20. Level 1 - Dispenser/Card
reader/PIN pad
• Minimal amount of
command are
authenticated
• Communications are
NOT encrypted
• Firmware can be
modified
• Sensitive data is
separately protected

21. Level 2

22. Communication lines
• Buses
• USB
• SDC (RS485)
• CAN
• Lines
• COM (RS232)
• GPIO

23. Communication lines
• Data in transit is
encrypted separately
from data
• Tampering with cables
will disable device with
need of physical
manipulation

24. Level 2 - Communication lines
• Data in transit is NOT
additionally encrypted
• Tampering with cables
will disable device with
need of physical
manipulation. Only
additional modules or
firmware update on
some models

25. Video
Black box

26. Level 3

27. Service providers
• User-space software
communicating with
hardware units
• Created by device
manufacturers
• No single standard for
communication

28. XFS
• eXtension for Financial
Services
• Provide interoperability
between different
vendors of hardware
and different producers
of software

29. “Windows application”
• Graphical user interface
• Network client
• Service mode
• Technical
• Money exchange
• Configuration of
security features

30. XFS/Service providers
• Can be considered as proxies
• Has no knowledge of data, that he
transmits
• Starts secure communication with
device

31. “Windows application”
• Minimal interface
• Password protection for
all service options
• Secure network
communications

32. Level 3 – Malware

33. Level 3 – Malware

34. Video
Win32.Skimmer

35. Level 4

36. Physical
• Steel-concrete cover
• Tamper proof
• Tamper evident
• Alarm systems

37. Operating system
• Platform to launch GUI
• Role based access to
system
• Password protection
• Integrity control
• Robust updates

38. Network
• Communication with
processing center
• Remote system
management
• Customization
information

39. Level 4 - Physical

40. Level 5 - Network

41. Level 5

42. Processing

43. Processing

44. Processing

45. Video
Rogue Processing

46. Not a conclusion

47. Current state of ATM security

48. Screwed?
• netstat -an | findstr
LISTEN
• tasklist
• nmap -sU -sS -p-
ATM_IP
• wireshark
• usbpcap

49. Choose wisely

50. Security is a process

51. Have fun
Stay safe
Olga Kochetova, Olga.Kochetova@kaspersky.com,
@_Endless_Quest_
Alexey Osipov, Alexey.Osipov@kaspersky.com,
@GiftsUngiven