Risk
7/28/2010
11:27 PM
50%
50%

ATMs At Risk, Researcher Warns At Black Hat

Barnaby Jack demonstrates remote and local exploits that work on popular bank machines

LAS VEGAS, NEVADA -- Black Hat USA 2010 -- A security researcher today gave notice to companies that make automated teller machines (ATMs).

Click here for more of Dark Reading's Black Hat articles.

Here on the first day of the Black Hat conference, Barnaby Jack, director of research at IOActive, demonstrated attacks that would allow a criminal to compromise ATMs, allowing hypothetical thieves to steal cash, copy customers' ATM card data, or learn the master passwords of the machines. While one of the attacks required a few seconds to open the ATM and insert a USB drive with code to overwrite the system, the other attack used a remote management feature commonly found on standalone ATMs.

Jack's presentation targeted machines made by Tranax and Triton, but other ATMs likely have similar security issues, he said.

"I found specific vulnerabilities in the ATM machines," Jack said during a press conference following the presentation. "But the attack surface is [similar] across the ATM industry as a whole ... In every ATM system I've looked at, I've been able to find flaws."

Jack said he used fairly simple analyses of the operating system and software commonly found on ATMs to create the exploits he demonstrated on stage. "We are back to 1999 in terms of code quality," he said.

Other security experts who watched the presentation agreed that ATM software would likely be a gold mine for security researchers.

"The presentation shows that the security of these machines need to be revisited because they were never architected with [online] security in mind," says Jamie Butler, director of research for security firm Mandiant.

In the past, cybercriminal attacks on cash machines have generally focused on physical attacks, such as adding skimmers to steal users' ATM card data -- or even stealing the whole machine. Instead, IOActive's Jack focused on the software, creating a remote administration tool, dubbed Dillinger, and rootkit, known as Scrooge. Dillinger allows a person to easily select known ATMs and retrieve data or send payloads, while Scrooge, which can be sent to an ATM as a payload, overwrites the system's programming to allow a person to control the machine.

Most standalone ATMs, such as those frequently found in convenience stores and bars, run on Windows CE. But Jack stressed that the vulnerabilities he found were in the proprietary cash management software, not in the operating system.

A compromised cash machine can be controlled by a person who inserts a card with special codes stored on the magstripe or who types a code on the ATM's keys, Jack said. He demonstrated Scrooge's ability to make the ATM dispense 50 bills -- all novelty cash in his demonstration -- and to store the details of any card inserted into the machine.

Triton, the maker of one of the ATMs, has required that all code running on its system be signed. It offers its customers special tamper-resistant keys for preventing access to the internal components of a cash machine, said Bob Douglas, vice president of engineering for the firm.

Slideshow: Barnaby Jack Hits The Jackpot With ATM Hack
Barnaby Jack Hits The Jackpot With ATM Hack
(view slideshow)
"We have developed a defense against attacks of this nature," Douglas said.

This is not the first time ATMs have been targeted with rogue code.

In 2009, Diebold, the No. 2 maker of ATMs, warned customers that more than 20 cash machines in Eastern Europe had been found to contain malicious code. The software had features similar to those demonstrated by IOActive's Jack, allowing criminals to steal and retrieve ATM card data and dispense cash from the cartridges. At the time, security researchers claimed the attack was an inside job, but Jack said his research has convinced him otherwise.

"Based on what I have seen, I think there is a possibility that the attacks were software-based," Jack said.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.