Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1056 Thanks!
[Music]
the talk is entitled truly cardless
jackpotting an ATM using auxiliary
devices by Olga kosova and alexe
oov
uh good my herin hello everyone thanks
uh for waiting the Chun uh right here in
biggest place in in my life not in some
other places uh today we are going to
describe some new ways to uh that allows
you not you bad guys to eject money from
native
uh without touching them for example
let's say uh just from through the air
uh I am previously but now I changed my
uh family name and he is Alex oov uh we
are the part of security assessment uh
Team of kaspar clab and uh all of things
that we um provide uh provide you today
and that we uh usually put in our
presentations uh we collect the our
everyday work our um during our ATM
security assessment penetration testing
forensic investigation and of course if
we have enough time uh we do some
researches and uh we try to uh to
improve ATM security uh around the world
but sometimes we are not successful
unfortunately uh so um let's uh
refresh your memories about
[Music]
ATM uh you should remember from pre from
previous talks that uh ATM is just
ordinary computer uh looks like your uh
home computer but uh this particular uh
box consists of various devices that
interact with uh consumers such as
keyboard uh sorry pin pad um uh
touchcreen uh some buttons card reader
and um devices to interact with cach
such as dispenser uh cash recycler cach
in module and so on etc etc and let's
concentrate on interfaces that are using
uh inside the ATM there are plenty of
various connectors and ports uh
sometimes we are uh pretty surprising
when we uh discovered some uh unusual uh
interface inside the ATM but the most
common is rs232 or RS uh 485 and of
course
USB and uh the problem with USB is
uh that that this uh connectors this uh
bus is pretty uh common around the world
and um devices connected to the PC
through the US B and of course
technicians also use uh free USB to put
um uh flash drive to install some new
malware or some new software doesn't
matter uh some antennas GSM modeles uh
can also um connected to ATM PC through
USB ports and sometimes these uh uh USB
uh cables might be discovered outside
the USB
um you might know that uh USB classes
are
pretty uh pretty familiar with uh um
every guys who are developers or who are
um reverse engineers and um uh there are
plenty of various classes described in
um libraries and the most common for ATM
is uh human interface device and weend
specific uh human interface device it's
usually pin pad card reader uh let's say
input output devices and um speaking
about vendor specific uh uh
communication uh
description uh vendor might um develop
some strange things and us it to use the
description to communicate for example
with dispenser or with uh other uh
devices inside the
ATM but uh let's uh continue with uh
human interface device you might
understand that human interface device
it's just a keyboard or Mouse and uh
it's typically it's plug and place
device you just uh put something with
USB and dri uh driver
will automatically installed and uh this
device uh will ready for use um when we
uh discovered that uh
pretty um small devices like tin might
uh might be used as a keyboard uh it was
five or six years ago uh we uh created a
proof of concept video and came to some
uh big companies uh that are related to
ATM in Russia and they was um they were
pretty upset about what we discovered
and um asked us to not disclose this
information for the public uh until this
year um but we uh can discuss this in
some let's say private conversation or
private
uh some private meetings uh but now we
are going to show you finally how uh
what we can do with the tinia uh using
it in the
ATM here is our demo uh that we
reproduced in our test beted but uh it's
emulate or real cases in some banks and
some in the wild uh some devices that
are interconnected through USB might be
um in um deinstalled for the uh
maintenance or something and this
um uh their USB cables uh are available
to other uh connection other
communication we obtain uh the not we
attacker attacker obtain access to USB
uh connect uh TC specially U with this
special code and uh this code helped to
bypass CK mode on the ATM and uh run
malware just executable file from remote
sh uh there will will be no um uh logs
on the uh inm Journal because it's just
uh something that looks like U putting
some letters uh through keyboard uh
these cases are um very hard to
investigation
um and um uh about
uh 20 minutes sorry 20 seconds uh is
enough to eject portion of money up to
40 Bank notes from the ATM just using
tin uh there obviously other kinds of
devices that has more uh more memory
that has different features for example
remote remote control or some other
kinds of malicious activity like USB
cables that are not actually cables but
also kind of tens device you can buy
them for 40 bucks or 100 bucks doesn't
matter and they pretty much do the same
thing you upos skate something as a
legitimate device and the technician use
it to install it into the ATM machine
and in this case you just connect it to
the devices but there are also another
kinds of devices that are already
connected and already used and for
example for example technician need to
maintenance this kind of ATM machine
it's through the wall ATM with no
external cables no no nothing or maybe
there is cute Kon on the ATM machine
that
technician don't want to disturb and
because he loves
kittens sometimes to actually access
these cables you need to go into ATM
machine and do some stuff inside of it
and it's kind of messy it's kind of
giving me problems and technicians give
a solution we will use the wireless
keyboards unfortunately it's uh the
general idea in some banks and in some
companies that they can use single
dongle that is connected to the ATM
machine and uh conduct different
activities on the ATM machines and it's
kind of scary because there are
different kinds of research that um
affected this uh this kind of uh devices
wireless devices for example Mouse
jacking attack that affects NRF
21 uh uh
cheap this chip is excellent it's very
cheap it's um used everywhere and it
doesn't provide any
security um the customer or the vendor
should Implement their own crypto inside
these devices and protect the uh the
customers against malicious modification
and there's also devices from the Great
Scot gadgets uh that use Bluetooth
communication and affect this kind of
communication in the malicious
way what are needed to affect ATM
machine we just need to go to this
couple of sites download the GitHub
versions of the uh exploits use dongle
that is used for example for Quadra
copters or the original dongles that are
used by company
Logitech and do some malicious stuff
here's typical setup
we just use ordinary Android um phone
and connect uh our dongle to this cable
and uh leave it nearby the ATM machine
next time the uh normal genuine
technician goes to this ATM machine he
will use his little keyboard do some
stuff and leave it away but on the ATM
machine there will be some uh near the
ATM machine will be something that
obtained the address of this uh keyboard
or even
Mouse and here's one more uh proof of
concept video that we produced uh as
Alex mentioned uh we used uh uh Mouse
jack tool to uh identify uh the address
of this dongle and um when we obtain
this address we uh uh connected to this
dongle and uh send uh specially prepared
comments to the ATM uh and uh it might
be
uh uh run uh malare from remote share or
we can uh put some comments to eject
money from the ATM just using uh this
communication with dongle like uh
ordinary uh
keyboard and
um uh after some times we
will get the
money
uh this unauthorized cash out uh it t
typically takes about uh 40 seconds uh
to eject portion up to 40 Bank notes
from the ATM and we can repeat it again
and again until ATM all ATM with uh such
kind of dongles are will
empty
and the sponsor of this video is
Logitech who uses
uh
who uses excellent uh devices that uh
can be used by anyone for technician
users or for the customer users and they
are excellent in both ways because we
can create this video but they also kind
of
uh consider the problems that they uh
they are facing and the newer versions
of this dongle or the newer firmwares
that can be installed on these kind of
devices are actually protected from the
malicious behavior and uh it's pretty
much excellent because the community
that found problem identified the
solution and the solution was
implemented on the devices every
everyone
wins there are also other flavors of
devices I already mentioned there is
Bluetooth keyboards or some radio
keyboards that can be used and couple of
days ago there was someone in the
Twitter who made a video with
intercepting the communication of his
keyboard that is completely in the plain
text and the general idea about the
wireless keyboards in ATM machines it's
that uh ATMs are actually unattended
devices they stay there and most of the
time they are not used by customers and
malicious guy can actually do everything
with it through the keyboard and for
through the mouse remotely and see if
some some gots to the ATM machine he
just press L Tab and return to the
original behavior of ATM machine it's
excellent for research but I don't
advise you to do it because uh yes you
can optain different fancy devices that
intercept Wireless Communications they
can sneff nearby devices and actually uh
if you speak about the viral keyboards
there's also another kind of devices
that is pretty much scary because some
years ago there was a investigation in
Mexico by uh Brian Krabs about the
Bluetooth sniffers that were used in the
gas pumps and this kind of devices can
also be detected with the uh
uberto devices and if you see something
in the air near the ATM machine please
do send some of message to the bank
because sometimes it's actually
malicious activity and it's not only
about uh Fancy videos and fancy
devices and if ATM technicians somewhere
here please stop uh using uh wireless
keyboard but let's uh continue with the
other part uh is pretty upset when you
should pay for taxes or buy tickets and
pay some money again and uh that feeling
that you should uh uh input some tons of
numbers and letters to pay something uh
in ATM uh but this U problem uh when uh
some people consumers um should uh spend
a lot of time to uh enter in the numbers
and uh make an error and do it again and
again uh now some 8 TMS uh consist of
barcod readers to collect all the
information about your payments or about
your uh tickets taxes doesn't matter
from the barcodes or from the QR codes
1D codes or 2D Cordes and uh in some
banks uh already implemented the feature
When U consumer might uh uh make a
special create some special uh bar Cod
inside the uh mobile application and uh
withdraw money without cards and of
course uh uh presentation without
mention of Bitcoins it's uh not good
presentation so the this ATM uh for
Bitcoins also use
barcodes uh barcodes are everywhere uh
for example here in uh cows
communication Congress uh plenty of
barcodes
and even on toilet walls don't ask how I
found this uh uh bar quads uh and U if
you want to buy some stuff for example
Club m in the convenience store uh
typically cashier um use the barcode
installed on the uh cash desk and um uh
put uh bottle or put some stuff to this
bar barcod Tre leer to uh to enter the
um information about this uh stuff to
the uh program uh thanks uh for Chinese
guys from 10cent exlab uh when they uh
discovered this
uh funny uh that uh when they tell us
funny story about how to bypass cashier
uh and um put some um special specially
create QR code and uh download and
execute
application um there are plenty of
uh codes to and plenty of U possibility
to uh eject uh uh control uh keyboards
key keyboard inputs to the barcode or um
put some information uh uh there are
plenty of uh
uh plenty of ways uh but we
uh prepare one more video when we create
special barcodes and put it on the
Kindle to by
bypass uh kosk mode on the
ATM and
uh uh make some piece of magic from
remote share
again uh there will be no logs again uh
inside the ATM uh uh journals because uh
it looks like
some some letters some uh numbers uh
were uh input from the keyboard and uh
if uh uh banks will try to understand
what happened uh they just
um should understand that uh in in logs
uh there um there will be some strange
situation when uh a keyboard uh when a
barcode reader is uh looks like
keyboard uh typically um barcode reader
in ATM uh
connected to uh to the PC through uh com
or USB ports uh and on the other end um
of the cable is uh Port looks like
VJ but um we had some strange uh and
maybe let's say protected uh ATM when
the uh USB uh cable was cut it up and uh
uh couple of hours to solder in the new
cable and we had the the uh right way
and proper way to eject money from the
ATM uh when I mentioned in the previous
video uh the original research involves
some reconfiguring of the barcode reader
or using the codes that are inside of
the barcod reader already and we found
we came up with the simple fuzzing idea
to use it against any barcode that is
out there just enable it somehow for
example pay for something or do
something uh use the code 128 barcode
with special symbol FN C3 in at the
start and actually barcod readers are
beeping and if it beeps the wrong way it
seems that this code is accepted
sometimes in the original research it's
also mentioned that most of bar feers
are using the USB cables but this
particular one wasn't using it and we
should uh uh rewire it but uh during our
assessments we have seen bod readers
that are already in keyboard mode with
the USB connection and obviously you can
send some symbols that are not the
printting printed ones and they actually
do some interesting stuff with the uh uh
reader itself for example it uses
different function buttons it's using
different uh special combinations of
buttons like control delete and so on
and of course do it responsibly don't do
it at the Congress because we all using
barcodes and sometimes they also can be
affected that was uh about the barcodes
and uh we were speaking also about the
migration of the V from Windows XP to
Windows 7 that were during the previous
years and we prepared some small U
comparison like uh the problems that we
facing by Windows XP and Windows 7 that
were not used for a long time for
example Windows 7 was were implemented
only 2 years ago or one year ago on ATM
machines we have uh some nice
vulnerabilities on in Windows XP like Ms
08067 and we actually haven't seen the
fully ped system or ful Pat ATM system
with Windows XP the same problem goes
with Windows 7 uh we have nice
vulnerability 1710 that can actually be
exploited by the remote user and we also
haven't seen the fully ped ATM system
but yay they migrated to Windows
7 and for example these are the data
from the uh ATM assessment and the
screenshots are the forensic
investigation of 1 18m machines that
were affected by uh one cry virus that
were affecting different kinds of
devices and it doesn't matter if it was
Swift or if it was computer ordinary
home system or if it was ATM
machine we have also seen the shift from
the ipv4 to IPv6 unfortunately who uses
IPv6 and in the internet there are some
sites that are already implementing it
but in the network
everyone uses IPv6 because the new
operating systems by default enable it
and no one use it but malicious guys can
actually abuse the firewalling rules
that allow anyone to use this
communication in the wrong
way Powers shell is excellent because
for couple of years it was not detected
by anyone it was like silver key to any
system if we have faced the Windows 7
you can actually do some great stuff
like mimic ads or the injection get
strokes anything unfortunately the
honeymoon was over and here's the
current detection of the problems with
of the malware that is used that is
using powers
shell with uh ATM machines it's much
more easier because you can use code
from the msdn or different sites that
provide default code to interact
with comports or interact with libraries
and often the this type of
communications it's legitimate and often
it is used by the uh original
software but the malicious guy can issue
the common dispense all the money from
the ATM machine with Powershell it's
only few um key strokes and it's
actually very easy to use it with QR
codes or with uh uh different external
keyboards uh for not a conclusion there
are different kinds of devices that are
already there and we have investigated
some of them and most of them we haven't
spoke spoken about touch screens because
they obviously another point of entry to
the ATM machines there are different NFC
readers that also can be affected and so
on and so forth there biometric devices
that we have spoken two years ago at
this very same conference and I think
there is solution against
the the problems with the iris you can
just close your eyes and don't use
them uh we are thankful for Community
because of the gadgets that were created
and they very helpful for us and very
helpful for you to analyzing what
Communications are there and it's also
another point of that we haven't spoken
today that you can actually use the
drivers that are used by the ATM machine
because vendor specific it's the vendor
specific it's like the SK systems or
different IC Systems the data that is
transmitted is actually the uh can be
brought through errors or some problems
and you can exchange all the these two
devices with single radio that is was
provided by the uh Congress at the camp
it's awesome device that actually
implements both the pH dancer
capabilities radio capabilities and you
can do everything with it and abuse uh
different activities we are very
thankful for the older researchers that
are there who uh who given us the
inspiration to uh use something against
ATM machines we are thankful for the
Congress for the excellent devices
excellent Community excellent
communication because some of our ideas
are
brought from the people and we are
thankful for everyone who is attending
and uh there are different kinds of
devices that can be accessed remotely
but there is also possibility to just
cut a hole in the ATM machine and we're
thankful vendors who provide us with the
work that we are doing security is the
process and I hope
that we will we are making ATMs better
and we are trying to do our best to help
the community and there's something who
do it cheaper thank you thank you
everyone if you have any questions
please
ask thank you Olga thank you alexe for
sharing your impressive work I hope we
have some questions I see over there
microphone three please uh hi so so you
looked at wireless keyboards and mouse
and stuff like that but did you look at
Wireless uh cards like
NFC uh yes we have analyzed some of the
uh devices that uh NFC readers but
unfortunately we can't speak about them
right now because we are in the process
of um uh communicating with wendor to
fix these vulnerabilities because the
problems that we have shown on the
slides uh actually already known and we
try to drive attention to these problems
because they do exist right now they are
here for two 3 4 years and the motto of
this Congress is remembering remembering
uh refreshing memories sorry and uh we
try to refresh memories not only for
vendors but also for the people who are
using
ATMs we have also questions from the
internet my signal Angel yes the
internet wants to know how you did add
Hardware to test the stuff
on uh can we get the hardware yeah
actually you can buy it from eBay it's
uh cheap as sand in matter of the ATM
machine because for example you can buy
the old servers that uh were very pricey
at the time and now they sold for
€1,000 and for the ATM machines is
actually the same the most expensive
part of ATM machine it's actually the
safe and you don't need the safe to
conduct
research microphone one please yes will
you be releasing any of the code that
was done for your testing I'm asking for
a
friend good job uh your friend can speak
to my
friend okay another question from the
internet yes the internet wants know um
regarding the remote attacks so uh did
you have access to the bank Network or
something and uh how do you figure out
what you actually need to
do uh we actually bought the ATM
machines for the our test bed and we
analyzing it in our spare time and we
also communicating with banks and
providing services from them
to for them to understand what problems
they're facing so yes we are we're
communicating with real Banks and real
ATM
machines and another one from the
internet yes the internet wants to know
um for one of the remote uh radio things
if it's a 7 uh 27 mahz uh technique like
kak uh yes there are keyboards that are
using 27 MZ to uh communicate with the
dongle and this communication is
generally
affected
okay ah over there microfone five I
guess yeah have you have you tested
these in the
wild uh we tested in assessments so I
don't advise you to test it in the world
and as for the barcod readers we trying
to test them for example in the
different uh shops or different uh uh
vending machines that uh to analyze if
if it's possible to send them the
control codes so sometimes
maybe he Jen another one from the
internet okay um do you know why most
ATMs run Windows instead of Linux with
maybe is not as vulnerable to malware
and other
vulnerabilities uh yes it's excellent
question that is asked every time that
we are given presentations uh
unfortunately there is uh Legacy code
that is used only on the Windows
machines and
unfortunately the vendors of the devices
inside the ATM machines they don't
disclose the specifications of the
devices and there is no there is no easy
possibility for the Linux to use these
kind of devices but when uh we get to
the ATM machines we actually reboot them
into the Linux and use uh python to
interact with them it's generally
possible but it's not done because
Legacy okay I don't see any more
questions so let's thank the speakers
[Applause]
[Music]
again
[Music]
oh