Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Hackers Cash In On ATMs
Newest First  |  Oldest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/31/2014 | 5:47:36 PM
Re: Root Default of ATM
Randy, 

You bring up a good point. How come ATM's aren't secured Linux shops? I would imagine that it would be more secure and cost effective. Not to say that Linux is a cure all, just I know it has a large percentage of effective security tools and safeguards. Is it the level of support? I don't know how thorough that component would be. If someone could, please clue me in on why this hasn't come to pass?
Randy Naramore
50%
50%
Randy Naramore,
User Rank: Ninja
3/31/2014 | 11:47:11 AM
Re: Root Default of ATM
You would think that a more robust and updated OS would be used instead for ATMs of XP. XP was a great desktop system but with support being phased out and other options being available such as a locked down version of linux (take your pick) the ATMs would be less susceptable to some of the attacks than windows would be. Just a thought..
securityaffairs
50%
50%
securityaffairs,
User Rank: Ninja
3/30/2014 | 2:16:13 PM
Re: Root Default of ATM
Ryan raises an interesting issues, the security level for many ATM is not acceptable.

Banks cannot think to continue to use phase out OSs like XP while cyber threats are even more sophisticated.

Physical protection is another serious problem, why are we surprised if the computers behind ATM is easily accessible? I'm not surprised by news regarding similar hacks ... the problem is elsewhere.

Why Does BIOS of the ATM machines allow booting from external and unauthorized media (e.g. CD ROMs , USB sticks)?

What's about disk encryption to prevent disk tampering?

This hack is the result of many errors!

This is not security

Thanks

Pierluigi
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
3/28/2014 | 4:38:37 PM
Root Default of ATM
I have read a few reports about Ploutus and yes it poses a very large risk, but I think the risk lies in the machines architecture and not too much in the "malware" being transferred via the device, USB, phone, etc.

Correct me if I am mistaken but it seems that these machines are in an administrative state for routine/emergency maintenance and its only the physical barrier that truly denies access to the kingdom. But as knights circumvent a moat, people have gotten past this safeguard and are tasking the machine with minimal intrusion.

One comment I saw on a forum regarding Ploutus, though cynical, carried some truth. You can't leave a machine in root status and expect it not to perform root tasks. 

As delineated in your article, banks are now undergoing expensive counter procedures to smooth out this issue. But that is more of a reactive approach and therefore a huge security flaw. It needs to be realized that security is most effective when handled pre-emptively. For whatever reason, these machines were left in a vulnerable state with only a thin physical layer to keep people out. What are other peoples thoughts regarding the ATM "hacks"?

 


Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.