Risk
7/28/2010
11:27 PM
50%
50%

ATMs At Risk, Researcher Warns At Black Hat

Barnaby Jack demonstrates remote and local exploits that work on popular bank machines

LAS VEGAS, NEVADA -- Black Hat USA 2010 -- A security researcher today gave notice to companies that make automated teller machines (ATMs).

Click here for more of Dark Reading's Black Hat articles.

Here on the first day of the Black Hat conference, Barnaby Jack, director of research at IOActive, demonstrated attacks that would allow a criminal to compromise ATMs, allowing hypothetical thieves to steal cash, copy customers' ATM card data, or learn the master passwords of the machines. While one of the attacks required a few seconds to open the ATM and insert a USB drive with code to overwrite the system, the other attack used a remote management feature commonly found on standalone ATMs.

Jack's presentation targeted machines made by Tranax and Triton, but other ATMs likely have similar security issues, he said.

"I found specific vulnerabilities in the ATM machines," Jack said during a press conference following the presentation. "But the attack surface is [similar] across the ATM industry as a whole ... In every ATM system I've looked at, I've been able to find flaws."

Jack said he used fairly simple analyses of the operating system and software commonly found on ATMs to create the exploits he demonstrated on stage. "We are back to 1999 in terms of code quality," he said.

Other security experts who watched the presentation agreed that ATM software would likely be a gold mine for security researchers.

"The presentation shows that the security of these machines need to be revisited because they were never architected with [online] security in mind," says Jamie Butler, director of research for security firm Mandiant.

In the past, cybercriminal attacks on cash machines have generally focused on physical attacks, such as adding skimmers to steal users' ATM card data -- or even stealing the whole machine. Instead, IOActive's Jack focused on the software, creating a remote administration tool, dubbed Dillinger, and rootkit, known as Scrooge. Dillinger allows a person to easily select known ATMs and retrieve data or send payloads, while Scrooge, which can be sent to an ATM as a payload, overwrites the system's programming to allow a person to control the machine.

Most standalone ATMs, such as those frequently found in convenience stores and bars, run on Windows CE. But Jack stressed that the vulnerabilities he found were in the proprietary cash management software, not in the operating system.

A compromised cash machine can be controlled by a person who inserts a card with special codes stored on the magstripe or who types a code on the ATM's keys, Jack said. He demonstrated Scrooge's ability to make the ATM dispense 50 bills -- all novelty cash in his demonstration -- and to store the details of any card inserted into the machine.

Triton, the maker of one of the ATMs, has required that all code running on its system be signed. It offers its customers special tamper-resistant keys for preventing access to the internal components of a cash machine, said Bob Douglas, vice president of engineering for the firm.

Slideshow: Barnaby Jack Hits The Jackpot With ATM Hack
Barnaby Jack Hits The Jackpot With ATM Hack
(view slideshow)
"We have developed a defense against attacks of this nature," Douglas said.

This is not the first time ATMs have been targeted with rogue code.

In 2009, Diebold, the No. 2 maker of ATMs, warned customers that more than 20 cash machines in Eastern Europe had been found to contain malicious code. The software had features similar to those demonstrated by IOActive's Jack, allowing criminals to steal and retrieve ATM card data and dispense cash from the cartridges. At the time, security researchers claimed the attack was an inside job, but Jack said his research has convinced him otherwise.

"Based on what I have seen, I think there is a possibility that the attacks were software-based," Jack said.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-0750
Published: 2015-05-22
The administrative web interface in Cisco Hosted Collaboration Solution (HCS) 10.6(1) and earlier allows remote authenticated users to execute arbitrary commands via crafted input to unspecified fields, aka Bug ID CSCut02786.

CVE-2012-1978
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Simple PHP Agenda 2.2.8 and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) add an administrator via a request to auth/process.php, (2) delete an administrator via a request to auth/admi...

CVE-2015-0741
Published: 2015-05-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Cisco Prime Central for Hosted Collaboration Solution (PC4HCS) 10.6(1) and earlier allow remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCut04596.

CVE-2015-0742
Published: 2015-05-21
The Protocol Independent Multicast (PIM) application in Cisco Adaptive Security Appliance (ASA) Software 9.2(0.0), 9.2(0.104), 9.2(3.1), 9.2(3.4), 9.3(1.105), 9.3(2.100), 9.4(0.115), 100.13(0.21), 100.13(20.3), 100.13(21.9), and 100.14(1.1) does not properly implement multicast-forwarding registrati...

CVE-2015-0746
Published: 2015-05-21
The REST API in Cisco Access Control Server (ACS) 5.5(0.46.2) allows remote attackers to cause a denial of service (API outage) by sending many requests, aka Bug ID CSCut62022.

Dark Reading Radio
Archived Dark Reading Radio
Join security and risk expert John Pironti and Dark Reading Editor-in-Chief Tim Wilson for a live online discussion of the sea-changing shift in security strategy and the many ways it is affecting IT and business.