January 19, 2015

Hacking ATM with Raspberry Pi


First days of new year came with the warning about a new class of ATM fraud named "black box attack". The crooks gain physical access to the top of the cash machine, connect their own computer to the the cash dispenser and force it to spit out cash, Krebs OnSecurity reports. In fact, this technics isn't so new. The Positive Technologies experts Olga Kochetova and Alexey Osipov showed similar attacks on ATM at Black Hat Europe 2014 in Amsterdam.



For the experiment, the researchers used a cash machine and a popular controller Raspberry Pi. The small device can be easily hidden inside an ATM enclosure. Due to its size, it doesn’t draw attention of service engineers who, say, replace paper in built-in printers.

It is not much of a challenge to find ATM interface documentation. Regardless of the vendor, cash machines and payment terminals share the same API for accessing and manipulating various modules and use the Windows platform in accordance with the Extensions for Financial Services (XFS).

Knowing the API, one may easily gain access to an ATM host and directly manage multiple peripheral devices installed inside the money machine, e.g. a card reader, PIN pad, touchscreen display, dispenser unit, etc. Do not forget about ATM OS vulnerabilities — Windows has a lot of those in stock for many years to come.


Detecting Vulnerabilities

Before Raspberry Pi can be installed inside an ATM and connected to Ethernet, USB, or RS-232 ports, an attacker needs to open up an ATM enclosure. At the machine’s upper part, there is a service area where the host that manages the ATM’s devices and network hardware, including poorly protected GSM/GPRS modems, are located. Unlike the safe located at the bottom, the upper part is quite easy to access — there is hardly any supervision over it if any. Attackers may open the service area using easy-to-make keys and simple materials at hands.


Yet it is not enough just to make it open — you need to be swift, and your manipulations must remain undetected.

At Black Hat, the Positive Technologies experts timed how long it took them to install the tiny computer inside the ATM service area for use as a sniffer to intercept PIN code and credit card info or as a skimmer that is virtually impossible to detect from the outside. The researchers were able to unlock the ATM enclosure, install, disguise, and bring their computer online in just two minutes.

When preparing for the presentation, the experts programmed Raspberry Pi to manage ATM peripheral modules. The computer connected to a Wi-Fi adapter, which you might access from any device like, say, your smartphone. A special web interface was designed to instruct the cash dispenser to empty the cassettes. The experts demonstrated how to make an ATM dispense several banknotes and, after some code adjustments, give out all the money. By the way, a typical ATM cassette holds two or three thousand banknotes, and there are usually four of those for different denominations inside a regular ATM.


It is needless to say that, as a result of the researchers’ proof-of-concept attack, the ATM dispensed all cash leaving no trace on the host; and though the camera was on, it was controlled by Raspberry Pi as well as any other devices on the hacked ATM.

How to Secure ATMs

It is not an easy feat to provide sufficient security protection for ATMs. A lot depends on an attack scenario. For example the UK’s LINK specialists advise replacing default locks for the service area and monitoring ATMs with cameras.

Meantime, the Positive Technologies experts are convinced that the main security problem lies in the possibility of installing any device or program (including Angry Birds) on ATMs exploiting OS and devices vulnerabilities. The tables may be turned if ATM vendors collaborate on a new, open specification for the components inside a cash machine to interact and authenticate securely. This would help to prevent anyone with a service area key from easily connecting whatever he or she wishes to the system.

1,274 comments:

  1. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
    3. This comment has been removed by a blog administrator.

      Delete
    4. This comment has been removed by a blog administrator.

      Delete
    5. This comment has been removed by a blog administrator.

      Delete
    6. This comment has been removed by a blog administrator.

      Delete
    7. This comment has been removed by a blog administrator.

      Delete
    8. This comment has been removed by a blog administrator.

      Delete
    9. This comment has been removed by a blog administrator.

      Delete
    10. This comment has been removed by a blog administrator.

      Delete
  2. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
    3. This comment has been removed by a blog administrator.

      Delete
    4. This comment has been removed by a blog administrator.

      Delete
    5. This comment has been removed by a blog administrator.

      Delete
  3. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
    3. This comment has been removed by a blog administrator.

      Delete
  4. This comment has been removed by a blog administrator.

    ReplyDelete
  5. This comment has been removed by a blog administrator.

    ReplyDelete
  6. This comment has been removed by a blog administrator.

    ReplyDelete
  7. This comment has been removed by a blog administrator.

    ReplyDelete
  8. This comment has been removed by a blog administrator.

    ReplyDelete
  9. This comment has been removed by a blog administrator.

    ReplyDelete
  10. This comment has been removed by a blog administrator.

    ReplyDelete
  11. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
  12. This comment has been removed by a blog administrator.

    ReplyDelete
  13. This comment has been removed by a blog administrator.

    ReplyDelete
  14. This comment has been removed by a blog administrator.

    ReplyDelete
  15. This comment has been removed by a blog administrator.

    ReplyDelete
  16. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  17. This comment has been removed by a blog administrator.

    ReplyDelete
  18. This comment has been removed by a blog administrator.

    ReplyDelete
  19. This comment has been removed by a blog administrator.

    ReplyDelete
  20. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  21. This comment has been removed by a blog administrator.

    ReplyDelete
  22. This comment has been removed by a blog administrator.

    ReplyDelete
  23. This comment has been removed by a blog administrator.

    ReplyDelete
  24. This comment has been removed by a blog administrator.

    ReplyDelete
  25. This comment has been removed by a blog administrator.

    ReplyDelete
  26. This comment has been removed by a blog administrator.

    ReplyDelete
  27. This comment has been removed by a blog administrator.

    ReplyDelete
  28. This comment has been removed by a blog administrator.

    ReplyDelete
  29. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  30. This comment has been removed by a blog administrator.

    ReplyDelete
  31. This comment has been removed by a blog administrator.

    ReplyDelete
  32. This comment has been removed by a blog administrator.

    ReplyDelete
  33. This comment has been removed by a blog administrator.

    ReplyDelete
  34. This comment has been removed by a blog administrator.

    ReplyDelete
  35. This comment has been removed by a blog administrator.

    ReplyDelete
  36. This comment has been removed by a blog administrator.

    ReplyDelete
  37. This comment has been removed by a blog administrator.

    ReplyDelete
  38. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
  39. This comment has been removed by a blog administrator.

    ReplyDelete
  40. This comment has been removed by a blog administrator.

    ReplyDelete
  41. This comment has been removed by a blog administrator.

    ReplyDelete
  42. This comment has been removed by a blog administrator.

    ReplyDelete
  43. This comment has been removed by a blog administrator.

    ReplyDelete
  44. This comment has been removed by a blog administrator.

    ReplyDelete
  45. This comment has been removed by a blog administrator.

    ReplyDelete
  46. This comment has been removed by a blog administrator.

    ReplyDelete
  47. This comment has been removed by a blog administrator.

    ReplyDelete
  48. This comment has been removed by a blog administrator.

    ReplyDelete
  49. This comment has been removed by a blog administrator.

    ReplyDelete
  50. This comment has been removed by a blog administrator.

    ReplyDelete
  51. This comment has been removed by a blog administrator.

    ReplyDelete
  52. This comment has been removed by a blog administrator.

    ReplyDelete
  53. This comment has been removed by a blog administrator.

    ReplyDelete
  54. This comment has been removed by a blog administrator.

    ReplyDelete
  55. This comment has been removed by a blog administrator.

    ReplyDelete
  56. This comment has been removed by a blog administrator.

    ReplyDelete
  57. This comment has been removed by a blog administrator.

    ReplyDelete
  58. This comment has been removed by a blog administrator.

    ReplyDelete
  59. This comment has been removed by a blog administrator.

    ReplyDelete
  60. This comment has been removed by a blog administrator.

    ReplyDelete
  61. This comment has been removed by a blog administrator.

    ReplyDelete
  62. This comment has been removed by a blog administrator.

    ReplyDelete
  63. This comment has been removed by a blog administrator.

    ReplyDelete
  64. This comment has been removed by a blog administrator.

    ReplyDelete
  65. This comment has been removed by a blog administrator.

    ReplyDelete
  66. This comment has been removed by a blog administrator.

    ReplyDelete
  67. This comment has been removed by a blog administrator.

    ReplyDelete
  68. This comment has been removed by a blog administrator.

    ReplyDelete
  69. This comment has been removed by a blog administrator.

    ReplyDelete
  70. This comment has been removed by a blog administrator.

    ReplyDelete
  71. This comment has been removed by a blog administrator.

    ReplyDelete
  72. This comment has been removed by a blog administrator.

    ReplyDelete
  73. This comment has been removed by a blog administrator.

    ReplyDelete
  74. This comment has been removed by a blog administrator.

    ReplyDelete
  75. This comment has been removed by a blog administrator.

    ReplyDelete
  76. This comment has been removed by a blog administrator.

    ReplyDelete
  77. This comment has been removed by a blog administrator.

    ReplyDelete
  78. This comment has been removed by a blog administrator.

    ReplyDelete
  79. This comment has been removed by a blog administrator.

    ReplyDelete
  80. This comment has been removed by a blog administrator.

    ReplyDelete
  81. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  82. This comment has been removed by a blog administrator.

    ReplyDelete
  83. This comment has been removed by a blog administrator.

    ReplyDelete
  84. This comment has been removed by a blog administrator.

    ReplyDelete
  85. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
    2. This comment has been removed by a blog administrator.

      Delete
  86. This comment has been removed by a blog administrator.

    ReplyDelete
  87. This comment has been removed by a blog administrator.

    ReplyDelete
  88. This comment has been removed by a blog administrator.

    ReplyDelete
  89. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  90. This comment has been removed by a blog administrator.

    ReplyDelete
  91. This comment has been removed by a blog administrator.

    ReplyDelete
  92. This comment has been removed by a blog administrator.

    ReplyDelete
  93. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  94. This comment has been removed by a blog administrator.

    ReplyDelete
  95. This comment has been removed by a blog administrator.

    ReplyDelete
  96. This comment has been removed by a blog administrator.

    ReplyDelete
  97. This comment has been removed by a blog administrator.

    ReplyDelete
  98. This comment has been removed by a blog administrator.

    ReplyDelete
    Replies
    1. This comment has been removed by a blog administrator.

      Delete
  99. This comment has been removed by a blog administrator.

    ReplyDelete
  100. This comment has been removed by a blog administrator.

    ReplyDelete
  101. This comment has been removed by a blog administrator.

    ReplyDelete
  102. This comment has been removed by a blog administrator.

    ReplyDelete
  103. This comment has been removed by a blog administrator.

    ReplyDelete
  104. This comment has been removed by a blog administrator.

    ReplyDelete
  105. This comment has been removed by a blog administrator.

    ReplyDelete
  106. This comment has been removed by a blog administrator.

    ReplyDelete
  107. This comment has been removed by a blog administrator.

    ReplyDelete
  108. This comment has been removed by a blog administrator.

    ReplyDelete
  109. This comment has been removed by a blog administrator.

    ReplyDelete
  110. This comment has been removed by a blog administrator.

    ReplyDelete
  111. This comment has been removed by a blog administrator.

    ReplyDelete
  112. This comment has been removed by a blog administrator.

    ReplyDelete
  113. This comment has been removed by a blog administrator.

    ReplyDelete
  114. This comment has been removed by a blog administrator.

    ReplyDelete
  115. This comment has been removed by a blog administrator.

    ReplyDelete
  116. This comment has been removed by a blog administrator.

    ReplyDelete
  117. This comment has been removed by a blog administrator.

    ReplyDelete
  118. This comment has been removed by a blog administrator.

    ReplyDelete
  119. This comment has been removed by a blog administrator.

    ReplyDelete
  120. This comment has been removed by a blog administrator.

    ReplyDelete
  121. This comment has been removed by a blog administrator.

    ReplyDelete
  122. This comment has been removed by a blog administrator.

    ReplyDelete
  123. This comment has been removed by a blog administrator.

    ReplyDelete
  124. This comment has been removed by a blog administrator.

    ReplyDelete
  125. This comment has been removed by a blog administrator.

    ReplyDelete
  126. This comment has been removed by a blog administrator.

    ReplyDelete
  127. This comment has been removed by a blog administrator.

    ReplyDelete
  128. This comment has been removed by a blog administrator.

    ReplyDelete
  129. This comment has been removed by a blog administrator.

    ReplyDelete
  130. This comment has been removed by a blog administrator.

    ReplyDelete
  131. This comment has been removed by a blog administrator.

    ReplyDelete
  132. This comment has been removed by a blog administrator.

    ReplyDelete
  133. This comment has been removed by a blog administrator.

    ReplyDelete
  134. This comment has been removed by a blog administrator.

    ReplyDelete
  135. This comment has been removed by a blog administrator.

    ReplyDelete
  136. This comment has been removed by a blog administrator.

    ReplyDelete
  137. This comment has been removed by a blog administrator.

    ReplyDelete
  138. This comment has been removed by a blog administrator.

    ReplyDelete
  139. This comment has been removed by a blog administrator.

    ReplyDelete
  140. This comment has been removed by a blog administrator.

    ReplyDelete
  141. This comment has been removed by a blog administrator.

    ReplyDelete
  142. This comment has been removed by a blog administrator.

    ReplyDelete
  143. This comment has been removed by a blog administrator.

    ReplyDelete
  144. This comment has been removed by a blog administrator.

    ReplyDelete
  145. This comment has been removed by a blog administrator.

    ReplyDelete
  146. This comment has been removed by a blog administrator.

    ReplyDelete
  147. This comment has been removed by a blog administrator.

    ReplyDelete
  148. This comment has been removed by a blog administrator.

    ReplyDelete
  149. This comment has been removed by a blog administrator.

    ReplyDelete
  150. This comment has been removed by a blog administrator.

    ReplyDelete
  151. This comment has been removed by a blog administrator.

    ReplyDelete
  152. This comment has been removed by a blog administrator.

    ReplyDelete
  153. This comment has been removed by a blog administrator.

    ReplyDelete
  154. This comment has been removed by a blog administrator.

    ReplyDelete
  155. This comment has been removed by a blog administrator.

    ReplyDelete
  156. This comment has been removed by a blog administrator.

    ReplyDelete
  157. This comment has been removed by a blog administrator.

    ReplyDelete
  158. This comment has been removed by a blog administrator.

    ReplyDelete
  159. This comment has been removed by a blog administrator.

    ReplyDelete
  160. This comment has been removed by a blog administrator.

    ReplyDelete
  161. This comment has been removed by a blog administrator.

    ReplyDelete
  162. This comment has been removed by a blog administrator.

    ReplyDelete
  163. This comment has been removed by a blog administrator.

    ReplyDelete
  164. This comment has been removed by a blog administrator.

    ReplyDelete
  165. This comment has been removed by a blog administrator.

    ReplyDelete
  166. This comment has been removed by a blog administrator.

    ReplyDelete
  167. This comment has been removed by a blog administrator.

    ReplyDelete
  168. This comment has been removed by a blog administrator.

    ReplyDelete
  169. This comment has been removed by a blog administrator.

    ReplyDelete