Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/698 Thanks!
So for the very last talk of this
evening,
after learning how to break into
intercoms, we're going to learn
a huge number of ways in
which you can break into ATMs.
We go to Olga and Aleksi.
They are part of the penetration testing
team at Kaspersky Lab and
they will tell us more about this.
Thank you.
So most of you use the
bankers to buy something in shops
and malls and other places,
but sometimes you need cash, for
example, when you go to the
lounge and want to buy
some junk and
you need to go to the ATM and
you look around and search for Schamus,
for hidden cameras, for
some fake pin pads or some other
stuff from bad guys.
And the if is everything okay,
you insert one
card into it, enter
your pin, enter amount of
money and
what you can see them
ATM say that there is no money
for a long time from
bank site. It is this ATM
is full of money.
That's because some like you hacker
maybe right now ject
all money from this ATM.
And if he was really like you,
he obtained quarter quarter million
euros, and that's
because ETM,
this is not ideal.
So today we would like to
tell you about the ideal situation
when A.T.M is
secure with several
level of protection.
And the phone to say hello,
I am and he is my colleague
Elizabeth, we are from Kaspersky
Lab.
We get our knowledge from Eckmann
security assessment, penetration testing,
forensic investigation and the other
fornia activities.
But first of all, let me give
you several words about the German
general just for you.
The stage
you might be familiar with various types
of items, for example, Cash-in
or Cash-Out, ATMs
or even recycling systems.
It might be a standalone items
or through the whole items, but
it should be noticed that there
are several
ATM vendors around the world.
They just take
small parts, small hardware units
produced by various manufacturers and
put it together into the box and call the
data. So just telegrapher
big vendors for Big
Macs.
So the box of
gold is on our cabinet,
there are PCM, just the usual PCM
card, reader pot and so on,
the bottom box of a.T.M,
gold safe.
There are some financial devices such as
Dispenser to eject marnia
or not accept or to insert Monya
and so on.
All hardware units connected to
PC through or USB port.
The main main
software is the Microsoft
Windows operating system and
the most case when
it ran on Windows XP,
despite the fact that Microsoft stopped
to support this operating system almost
three years ago.
There are also
a.T.M software, which provides
graphical user interface to interact with
the customers or will serve
service engineers.
Other part of the software
is a piece of software to
communicate with, processing center
to interact with bank networks.
And the last one part is
device control systems.
There are also some security
software, such as antivirus integrity
control systems or video surveillance.
But there are also and
often some
very creepy software and very
new software in the
sometimes the software
gives attacker unlimited control to the
idea.
What about devices?
Devices are unclear.
There are some strange microcontrollers
of realtime operating system
and usually
guys who offer the broad very sad
about it.
On the flight, you can see a small schema
of a.T.M and it is
not complex and very lainer,
it should be easy to implement secure
communication.
Generally, no data from hardware
units needed inside data
and requested by so-called
processing center that
make decision to give or
not give money,
other components.
So just really data rubbing
it in additional
security layers like onion
and that networks
to get to the data or monium.
One should uncover all
layers or be
very near to monium in
Wonderland. All ATMs are secure.
And let's see how.
The lowest level is closest to minyon
and very important to protect.
Money contained in the cassettes
and the length cassettes are
themselves secure.
No one can get money from them without
any special permissions.
There are not only physical, secure, but
also logically secure.
If someone will try to eject Monya,
it will be evident and very hard
nonetheless. If someone will steal
the cassettes, it will be
easy to trace them
and if someone
will try to open the cassette,
the money will be destroyed.
For example, on the light you can see
money destroyed. This could go
in extreme case, even if cassettes is
open and the money are not destroyed.
Bin can trace banknotes by different
means, for example, by using
sequential numbers on
the banknotes and they
can be traced the like in the movies.
And not only cash
is the goal for criminals,
they also hunt for card data.
But in an ideal world, card data
can't be stolen.
There is no data to be copied
and that is what they Namik data.
It uses challenge response schema
that protects against attacks
and in this case, that data
cannot be stolen.
But it was only in Wonderland
because since Beancurd contains
mixed tripe, it can be intercepted
in the movie is not a panacea
until there are places and even
countries that don't use
the tubes.
There is always a possibility to withdraw
money. You know, it only makes tripe.
Even then, there is a possibility for
online relay attack.
You insert the card in some ATMs,
but money is dispensed from another
ATMs.
As for cassettes, there are not so
secure.
Most of cassettes have
all the mechanics to check notes
outside of cassettes.
So it is possible for attackers to get
cash by using only
a screwdriver and
if money was stolen, it is hard to
trace them because it is still
hard to mark them
and to know where they are used.
So let's up to level one, it's
a hardware unit level.
And as I already mentioned,
attacker can get
a quarter million euros from
each ATM.
I think it's enough for
this amount of money is
enough for a couple of junk
for everyone.
And the typical
dispenser consist of four
cash cassettes and the one cassette for
rejected notes.
There are also
many sensors, slates and mechanisms,
which was Dromana, some of them
just from cassettes, other ones
presented to the customer,
other ones circumciser of banknotes and
so on.
So we looked like where
should be very complex.
There are other interesting
devices, country there, which
used to read mag stripe
and also used to communicate is
cheap to conduct financial transactions
and to check biometric data contained
on the on chip regarding car
technologies.
This device also should communicate with
other units, such as being
paid for offline notification and
biometric devices for biometric
litigation.
Pinkerton's used together with
data for clients of education,
it is the most secure element
because of different standards,
BMV and other standards provide
the bottom line that
should comply to.
But not everyone knows that
there are two modes of operation.
Secure and open.
Secure, secure, remote is used
for encode and open what
is used for other inputs.
For example, when you enter amount
of money by
a medical education gains popularity
because of increased security,
there are different kinds of recognition,
such as iris, fingerprint space
and so on.
Such features uniquely identify
a. So it is considered if
they are presented to NATO,
such users consider good
such features can be revoked or changed.
Our only processing center
can send comments to hardware units
and hardware units and the ticket
processing center, but sometimes
under guarantees, integrity
of comments, but data
should be also protected with encryption.
An ideal situation, this data is
only needed in processing center
because firmware controls hardware units,
it should not be easy, modifiable,
but it was another lie.
Unfortunately, only so-called sensitive
moments are dedicated.
For example, dispense but not present.
If you speak about dispenser.
Rumor has it that bad encrypts
all data that comes from it,
but it encrypts
only pin code but not data
and active mechanism that can change.
One common theme is another
good thing is that the PIN code is
encrypted in such a way that data
can be decrypted only in processing
center.
Why it is not done for other hardware
units.
It's a question I don't know
is for firmware modification.
Firmware is often stored
on the a.T.M. Hard drive is
a hex file and actually
it's not that hard to add some piece
of code to existing firmware to
create a hidden backdoor.
It will direct on sequence of
the money dispense if you are speaking
about dispenser.
Standards create a baseline for
data security, but the standards
are not enforced and easily bypassed by
banks.
Also, there are no such standards for
biometric devices.
And I think it's strange because
you can easily change your PIN code or
you your bank cards, but
you cannot change your iris
or your finger.
And additionally, there are many systems
which use biometric litigation such
as passports, visas and so on.
It means that if you lost the
biometric data, you might as
well lost your identity.
And thank you so much this
guys who built this wall.
OK, we have spoken about hardware units,
but all this hardware units should be
somehow connected to the computer,
to the processing center, and so
often is just ordinary components
or USB devices.
But it's often forgotten that USB
is also boss.
And there are different more
searches that you can easily Google
that connect some device to
some part of the USB
USB hub and obtain all the data
that is transmitted over the other lines.
And often banks unfortunately
say, OK, we have USB connections,
no one ever can sniff this
data transmitted and so on.
But unfortunately, that's not the case.
Some older ATMs use
so-called indice, but
it's Araz four eight five
with a common line and
every device on this bus can
send comment to another device.
And often it is used by malicious guys
who understand how it works.
And unfortunately,
ATM vendors and banks weren't prepared
for this breach.
This communication lines are
also should be considered
vulnerable and also should be encrypted
and in ideal situation in Wonderland,
these communications are encrypted.
The data that is transmitted is
encrypted, is actually easier to
know to create.
And there are even some
start ups which protect these
boxes from hardware
attacks that protect communication
between them.
But unfortunately, unfortunately,
they also don't understand how
these devices work.
And sometimes it's
only a security by obscurity
and doesn't create any new
protections and new security to
protect the devices that are connected
to USB bus and so on.
We often heard that tampering with the
cables with the virus is very
hard and no one can do it.
And you will see in the
future slides that the
bad guys are already there.
And here's a small presentation of
what can do, some device
that is connected to the USB
of the dispenser.
So here is our
first bet, our ATMs love.
And here's our attacker,
who might be Motoki
from the Internet or from
from an insider
attack can bypass the first level of
security is a physical level
and
disconnect the USB, cable,
USB dispensers, cable from
the ATM computer and
connect it to specially crafted device.
In our case, it's transmitted by this
piece of code and the Wi-Fi don't go into
the battery.
Now we can see that dispenser
is in the red box and
it's offline, but
it still works.
I take your son to dispense
comments just using their
smartphone to Raspberry
Pi through Wi-Fi and
the Wi-Fi I
send to these comments to
dispenser directly and
it means that bypassed
all security measures which implemented
on the ETM computer.
So only a couple of minutes,
an hour, Thacker gets a portion
of the.
As I can understand, this attack might
be a repeat for many, many times
until it became clear, OK.
We spoke about these devices
and the connections, but obviously
there are operating system that controls
such devices with
different software.
Different software means, as already
mentioned, there are some
Windows based operating system,
often its Windows XP.
And we often heard from the bank that
the I think half
of the year ago, some bank told us
we finally, finally managed to
move from Windows XP to Windows seven.
Come on, guys, it's windows already.
And and you're a bit
late. And
there are service providers that are
generally represent communication with
the devices in the atmosphere.
They are not the drivers.
They're space.
And communication is done by
Lipinsky Library.
And actually, if you connect it,
if you install on the ATM
Linux operating system, all the devices
will be presented as
USB devices with
their their names.
So with what they do and
actually you can send any comments, as
you already seen in the previous
video, and
these service providers are created by
manufacturers.
And it's
illegal that they combine different
devices from different vendors, so
there is some middleware that
communicates from
application that actually
displays information about the
amount of money, this creepy
spam, which is the difference, your
credit cards and so on, on the ATM
machine.
It communicates with its manager.
It provides interpreter.
It provides communication between the
software and the service providers.
So any
any person can create their own
software that doesn't
know anything about ATM machine
but knows the interface of communication.
And Windows applications, just
a graphical user interface, it doesn't do
anything, it just
gathers information from the
user, from the devices and center
and send the processing center.
But unfortunately, it's an ideal station,
an ideal station.
There is are only proxies.
They don't do anything.
They don't understand what is going on.
They just doing what they told from the
processing center, the
secure communication.
But as you have seen in the video,
there is no secure communication with
some devices like Dispenser and and
know of this
application has no interface.
It doesn't provide any
features, any
additional technical information about
the machine, about the communications.
But unfortunately,
all its inventors, all banks
are lazy.
They don't want to spend money to
create different
images of operating system, different
software to use only in
technical means.
They implement everything into one
application and say, OK,
we are now secure on the right
side of the on
the right side of the slide.
You can see to begin that is
with us for many, many years
it was based on offers and
banks or you say, OK, we know
everything about malware.
If we will shift
from the office manager, from the
communication, we will be 100
percent safe.
But unfortunately, on the left hand side,
you can see another malware
that intercepts communication from
service providers that just gathers
all information that are already there
without any communication with the first
manager.
And unfortunately, in Wonderland
terms of secure.
But in real situation, ATMs
are very vulnerable because
every piece of software
in the slide of Windows application
system or express manager
service providers can issue one comment
to
inject money to get the
information about your credit card
to get PIN code by
limiting access to the PIN
pad and so on.
And unfortunately, we have seen such
cases.
There are different bad guys.
Creditex are different banks
of with such target
they install sniffer like Wireshark
or USB picked up,
they intercept all the data that is
transmitted between host computer
and they get get
all information about your credit card,
the very same information that is used
for your transaction into your text
and send it to a
server in the Internet because ATMs
are generally connected to Internet
and unfortunately, it's a problem.
And if you even go to the ATM
machine, watch
for different skimmers, different cameras
and so on, it won't help you
because your data is
transmitted internally in the
trading system to the processing center
and so on. Unfortunately, we've seen
such malware that don't use general
utilities. They use
access to service providers.
And also we'll show you example of such
a malware.
So here is our video again.
This is a backdoor
skimmer which we instigated
with our colleagues from great department
several months ago.
This mother activated by
using our special cards.
Now we can see
the window to
enter the special password.
Also, attacker can
enter a number of
commands, for example, to dispense
manual.
And also, attacker can
enter the number of cashier to dispense
money from.
One more.
It was a real mother,
which is
widely spread around the world,
and every
example was targeted for
various countries.
And if you were
attentive enough that
when I inserted
the cards inside The Fighter, it was
returned immediately.
No data was saved on the
computer. It was intercepted just
before the logging system even
understand that something happened to
the card reader, then intercept
it, intercept all the data that is
inserted in the
pin pad.
And there is no
evidence, no, no
nothing for us to investigate.
And often banks
won't want to understand how
it actually happened.
And unfortunately, in many cases
there's not even video surveillance
to understand what
they did and how it is done.
OK, but we were speaking
about Windows operating system, about
Katrina, about these
devices, but actually
how hard to get into
the ATM machine to access these
interface devices, to
send comments and so on.
Sometimes banks
are very, very protective.
There are even some ATMs inside the
trucks with the
policeman's nearby.
We often hear that in Europe, it's
not the case because all ATMs are through
the wallet, arms and they're physically
secure.
We often hear that they are stealing
concrete sandwich with different
protections against a physical
attacks. There are different alarm
systems and no one can do anything
in five minutes and get
all the money.
Operating systems is just a platform.
It doesn't do anything.
There is always protected by
Windows XP with zero
eight zero six seven
that can be attacked from
anywhere in the network.
It has robust updates
and different security controls.
The last measure to protect the
software on the ATM machine.
To protect that, there's nothing,
nothing more than already
on ATM.
But ATMs are
interconnected with at least processing
center and its management system.
Often it is very easy to
for security, especially for
network specialists, to
connect all ATMs in the single network.
What why not?
They are all in the same broadcast
domain.
They see each other, but
it's completely safe.
Nothing will happen.
They're just sending
customization data to the
processing center and
nothing will happen.
But unfortunately, physical access is
much, much more easier than they
suspect.
This guy with
our drill went to the ATM
machine, made
the word and get
access to the interface cables.
It's surreal footage and
all the money in this ATM was lost
by the bank.
And unfortunately, there is
no alarm because no one actually
opens a machine and they
say, okay,
no one opened it all out,
that's fine.
But in many cases there are even
lazier.
We have modems
near the ATM machines.
We have, for example, on the
left bottom side of the screen,
open ATMs because of
the duct tape is like.
We have we see through the
wall with all the communications
outside of it and easy access
to the inside of the
building was created
and sold USB devices and
all the other stuff because
open ATMs going inside
of it with the keyboards and something
else, it's actually very hard to
do.
On the level five, we have.
People, because
every system is actually communicating
with people and some engineers
should do different stuff with it,
and when we showed you the schema
of ETM, it's actually was Ã©lite
because schema is much
bigger.
We have different computers.
We have administrators, we have
different online banking.
We have our processing center.
We have different databases
from the point of view of contests.
It's a huge system that
can be affected on many,
many levels.
For example, ordinary fishing, we
have administrator accounts
and often these administrators
are not
trusted for managing office computers.
And there are different departments,
for example, for idem machines, for
office computers and so on.
And in this case,
ETM administrators are often
not so competent and don't know
everything about their systems.
As I already said, that there
are different ATMs in different
locations, sometimes they're connected
with 2G network because it's
very cheap and very secure,
because when
some security specialist in bank
opened the specification
on on the GSM network, they
see, OK, there is encryption
in all communications are safe.
But unfortunately, as you
have seen in your mobile phones on the
Congress, you see the network,
the network that you can you can
connect with your device and
send data and goals
and so on.
Actually, your connections
with 2G networks can be intercepted.
And what we've seen
much, much
more often that ATMs are connected
to the small network, that there are all
ATMs are seeing each other.
There are different.
There is the controller for this
particular ATMs that can send updates
to different to
all ATMs in the network.
And it's not a square thing that
when you speak about a couple of
ATMs and so on.
But unfortunately, there are hundreds
of ATMs in some banks
that can be attacked
with just one button, installing
the group policy
to install, for example, malware and
disable antivirus.
And and
it's often forgotten that actually
it's not a box, it's
often an entry point.
And a Tykerb can affect only
one ATM to
get the data inside of the network.
And for example, spoofing, I
don't know.
And the last point from out there,
but I think, ah, discovered
some ATM network with the wrong settings
and got physical
access to Internet cable.
I he connects
is not cable from ATMs
and the connects
Bigham to
ATM Networks network.
This Raspberry Pi consists of
a piece of code with a
local processing center which simulate
the real one.
Now all ATMs in this
network are under control of attackers.
And
friends of this attacker
can come to ATM, to
all ATMs and do something
OK.
It looks like urgent transactions
and
they can use any pins, any
cards, and they
can change
the cashier to withdraw money from.
And, of course, they get
Monya.
And the now attacker
returns to ATMs
to remove this
very important device
and leaves no physical evidence of this
attack.
But please don't use this race
to get money to talk
for other reason,
and actually what you have seen in
this video is it's a
real problem because when we hear,
OK, five minutes and the security
guys will get to a.T.M with
alarm system.
But unfortunately, all those videos are
less than two minutes to install the
hardware, to install software
and to get to ATMs and to
withdraw money.
It's often forgotten that, unfortunately,
computers are real fast and
people are not.
Well, there's
no conclusion from our
presentation because current
security of the items
like this guy, they are trying
to protect some pieces
of the network of
ATMs. They
shift from ATMs to
their items to some third party
and only release
them and so on.
And they hear from the Internet,
a key there is to can then
we'll install the antivirus
on the on the ATMs.
There are black box attacks.
Then we install the hardware inside
of our ATMs.
OK, there are something else and they
install something else actually
to get the mouse game.
And what we shown you, it's
low hanging fruit that
can be easily accessed by
criminals and already accessed by
criminals.
And often we don't hear about
such cases because
banks are very discreet about their
problems and they don't even share
these problems with other banks.
It's often a problem because
in many countries, some bank
is affected, for example, with black
box attacks, it
will say we have no problems
and another bank in
the same country will affect with the
very same attacks.
And they are not prepared for this.
Atim vendors often
not so fast to implement security
mechanisms to implement their their
hardware to protect the banks.
And often they say
we do not have a problem.
We already sold you your
ATM and they
don't want to invest any money
into protection.
And we understand them.
But unfortunately, in many cases,
architecture is bad and you should feel
bad about it.
We know that
many vendors, I think all
of them already tried to
create new versions of the
attempt win with newer
operating system, with newer hardware.
We want to ask them,
please do it
more open, not open source,
do it more open to security specialists,
to banks,
because many times
the vendor create problem.
But often, very often,
banks also create a problem
because they don't want to
implement all features that are already
there. And often there are some
problems can be managed
with updates, with configuration
options, with passwords.
Come on.
And there is smallest,
very easy to understand if
it's just common or thought common
to return anything about
your ATM machine, you're screwed.
If your second comment returns,
anything that looks like
an admin, computer and
other software that you don't know what
what is doing, you are screwed.
Use Wireshark and you pick up
on the ATM machine.
Just install it, press the button,
intercept all the traffic and see
ah. Do you see the card
data in the traffic?
Because it's a real problem.
It's not that hard to
intercept communications,
not only with software on the computer,
but also with hardware means,
for example, biegel
their hardware to intercept data on the
bus costs only
of five hundred euros.
I think dollars and
a quarter million
is in
one ATM machine.
What we want to see it or
not for, obviously,
but only on protection for different
levels of communication,
we have chain of failure
with any
part of the infrastructure
that can send one command to a time
machine and get money
from it to get that, get
the data from it and so on.
We understand that, unfortunately,
security is a process and there is
always a lot of us who
created the security in the
ERTMS or any other device.
We know that you have different
means to create money,
but you always have means to
lose money by allowing the lowest
bidder to create your security.
Actually be excellent to each
other, vendors
should spoke to banks.
Banks should spoke to vendors,
unfortunately for their ordinary
customers.
Are all screwed because
software sniffer is completely
unacceptable from our point
of view. And if you go to an ATM machine,
be aware that your credit card data
can be stolen with all the
security measures and security
mechanisms that you
can do it by yourself.
So it's actually a problem of the bank.
And if you have a problem, for
example, with skimming and some
transaction was get
with your credit card, it's not
always your problem.
This may be a problem with the bank.
We want to thank all different guys,
some of them here, some of them
unfortunately not here, and
helped us with our research, with reverse
engineering, with, I
think, dispenser, for example.
It's a real pain in the ass.
And have fun.
Stay safe.
Thank you.
Questions were raised this signal a few
year ago,
we got that question from the Internet.
Yeah, there are, but it's
quite not quite in your.
Yeah. Can you just go out
quietly?
Thanks.
So first question from
the Internet is you quietly
the Internet wants to know that.
Well, you've said there are some
different open ports on the ATMs.
Which ones would that be?
We don't know yet.
We can't disclose information because
unfortunately, we see
the ATMs in Qadam.
We see ATMs with
mouse scans.
And this information can lead to
a large amount of fraud against
the ATMs. So we can call them
sort of.
So I just
I want to add one note
that it's not
always the problem of the bank
itself, it's more
sometimes it's more really the problem
of the vendor of the ATMs
and the part of like like
as you said it, it's a normal
PC.
What's inside the ATMs?
And
if the bank want to have to upgrade
to Windows seven or Windows 10 or
whatever, that
the hardware does not support it.
So you can
physically change it to off
the shelf PC. But the vendor says
we will no will
don't support that or
would give no warranty if you change it
yourself. And they asked for just
normal PC a lot, a lot of money.
And the bank, of course, will say, no,
it's too much for me and we keep it at
XP.
Yes, unfortunately, we know about this
situation, but
we also understand that
there is 10 years
or 15 years or 12, 20
years that a.T.M was working
and it was working fine.
And banks say, OK, I want
to make it secure without any
additional investment.
Unfortunately, it won't help.
Yes, we know that there are different
problems in the operating system, but
there are also different problems
in the software that is run on this
operating system.
So it's actually a very
fuzzy situation.
And we can say that
someone is more wrong or
more right in this situation.
We should all combine our
expertize, our money actually,
and create much better
ATMs in
course of many, many years
maybe. But I think
the sooner the better.
I
have a question here
on the road.
Why do you think the ATM vendors don't
invest more into Linux based
ATMs?
I mean, they could they could do that.
Yes, they can do that.
But the answer
is legacy code.
They already invest
a large amount of money into the
express because it's not as
if Microsoft is
extension for financial services.
So it actually very
tied to Windows.
But we already know that some
vendors are already shifting from the
Windows to Linux based
operating system. But and
we want to see it.
We will see it in the near future.
So I think the situation
will change sometimes,
maybe because your research is amazing
and I really appreciate the work you're
doing. I would like to know, given
the prevalence of all the rise
in Bitcoin ATMs and the fact that most
of the software for some of the software
for Bitcoin ATMs is open source, have
you done any research on that or
are you planning on doing any research on
them?
Unfortunately, we haven't seen
this with our hands, so
unfortunately, no, we haven't managed
to see them and
we would like to get
in touch with Bitcoin ATMs, but
unfortunately, they're so rare
and are
so not worth it,
unfortunately for now.
Thank you.
Thank you for the
interesting presentation.
Some of the attacks
that you presented require
a lot of internal
knowledge.
For example, the one
where the attack
includes on the network.
Where do the attackers get
all this knowledge about the
architecture and infrastructure?
Unfortunately, it's not that hard
because there are all
windows based again.
And general penetration test
is accessing the domain
controller with the highest privileges
and is actually not the very,
very different from where I take
it in machines.
And obviously there are different
engineers in the bank who
have different technical information,
who have different
software, different test software
that can be stolen.
And sometimes they
even share this information
to the large amount of
people, for example, by
uploading the project onto GitHub.
And you can download software from the.
Just like source and so
I look, yes,
so in terms of the ATM management
systems, I like to ask if you have
a look at like if I serve and
software, that's like big vendors used to
manage, like big ATM
networks if I serve
or even like a trend.
That's some ATM networks you've seen
even in Europe, they start having systems
to manage the advertisements
in the loading screens and so on to
do any sort of research on that as well.
Unfortunately, no, because
there are different systems to
manage ATM machines, but there
are always lazy
people, lazy administrators who install
additional remote control systems
for different devices and even devices.
So I'm fortunate enough
to find Eric.
Thank you.
Thanks again for the amazing
presentation.
I was wondering if you had cases
where the security was better
than what you presented, and
especially when the serial
PCs communication had any
any encryption at all?
Yes, obviously there are
different items and different vendors,
different banks.
And we showed you
extreme cases and
how we can say that any
time actually vulnerable to at
least one vulnerability that we have
shown you from the management system,
from the network, just network without
any internal knowledge, from the physical
access, from the USB
access. But there is no
ETM that has all the vulnerabilities
in it. So we have seen
secure ATMs, but not very secure.
Thank you.
OK, the Internet wants to know
how easy would it be to get an ATM into
a kind of out of service mode
that is not really easy to
fix.
So basically, how hard is it to
just ATM
well, with a
razor or to cut the cable?
It's very easy, but
Denial-of-service, some ATMs, if I
understood the question correctly, it's
a bit out of scope of our presentation
because we we as the attacker,
as the merchant,
we want money from it, but not to
disable it.
Any more questions have
the Internet has another question and
the Internet wants to know how are
specifically connected to the network, if
not by 2G network,
like with VPN or what do they
do to that? Like people
are like IP, Pisek or something.
Do you know how they do this?
Oh yes.
We make presentations about
security here for quite a while.
And I think you can see
that this presentation in our
Twitters, there are different
possibilities like just 2G,
madam 3G and 4G modems
are ordinary ISMAT cables.
We have even seen
twenty five into the phone networks that
are communicating with the processing
center and for which purpose.
Yes, there are different additional
security mechanisms like VPN
clients, hardware,
hardware and software,
for example, some device installed inside
of each machine and connects
from the ATM VPN client
and we've been going to the alternate
alternator.
But the big problem is
this particular device, for example,
hardware device you have seen
in our presentation
that is outside of Ajam and
some hacker can disconnect is on a table
and accessed this ETM machine.
And more important by
this connect to the Internet cable and
connecting to the client, you can
connect to the network of intermissions.
So and many of you maybe
have seen it in machines with
ordinary windows window
that showed all I can
connect to the weapon server.
So they use everything and
there is no
not identical ATMs in different
banks.
OK.
And I have one final question from
the Internet, and that
is, would it be possible to
make the ATM, accept your own
cassette with, like, your cash?
Maybe the question was about
Cash-in device that except
the blanked out inside it.
That is not original.
It's not legitimate.
There are some there are several days.
And obviously you've
answered the question about the consent,
the responsibility to
deal with the security guys who exchanged
cassettes and install, for example,
cassette with just blank
paper.
But it's very rare
and they are
easily forgotten by policemen,
policemen.
Um, there is a question whether or
if there are any different operating
system in solving the Linux, for
example, I
yes, there is
a cost to operating system, for example,
in America
that
does based healthfulness.
I haven't seen any, but I think that
there are
but the most
often case, it's Windows XP,
still still alive.
OK, thank you very much.
Thank you for.