back to article What weighs 800kg and runs Windows XP? How to buy an ATM for fun and profit

Weighing in at 800kg secondhand, freestanding ATMs - a “safe with a computer on top” - are a logistical nightmare to own and research, security boffin Leigh-Anne Galloway warned delegates at the BSides Manchester infosec conference yesterday. b sides manchester talk on ATM. scrren grab from video Security boffin Leigh-Anne …

Gold badge
Unhappy

Is anyone surprised.

These boxes have a very long life.

That said tracking who accesses them should be easy as the list should be quite short.

But probably is not as short as people think, or as well maintained as they expect.

7
0
Silver badge

Re: Is anyone surprised.

Part of their security is limiting access of them to known people, but any of the 'mobile' ones in random shops would still have a higher number of people who have physical access to the box, and I'm sure given enough time....

0
0
Silver badge

Re: Is anyone surprised.

Any device that can be access without 2FA should have its insurance cover revoked.

Of course, as modern devices have got more secure the crooks have gone low tech and now just blow them open. Hence, the banks none too subtle attempts to put people off cash. Because contactless payment systems can't be hacked…

2
0
Bronze badge

Second picture?

Is he using stray cats as a cheaper alternative to £20 notes to test the ATM, I sincerely hope not.

5
0
Silver badge
Coat

The cat is the sidekick, secretly reprogramming the ATM by night when nobody is watching in order to ensure the Rise of the Feline Race.

All bow before IronClaw the 1st !

32
0
Silver badge

The cat is the sidekick,

Isn't the cat the security researcher?

10
0
Silver badge

Re: Second picture?

That pic is the lead-off to a new Microsoft ad campaign: "Windows, so easy to use that even a cat can use it."

11
0
Silver badge

The cat is the sidekick, secretly reprogramming the ATM by night when nobody is watching in order to ensure the Rise of the Feline Race.

Feh. Cat are too lazy to write code.

All bow before IronClaw the 1st !

Cats already expect this. They were, are, and will continue to be, severely dissapointed.

7
0
Bronze badge

You say that, but I caught my cat the other day writing JavaScript in a vain attempt to develop an automatic cat food ordering bot. If his spelling wasn't so bad I'd be up to my neck in cat food by now.

37
0
Silver badge

Feed me a stray cat

Oh my god, what are you doing, stop that.

4
0
Silver badge
Coat

Re: Second picture?

It's a cat scan, like an X-ray, but cheaper

21
0

Re: Second picture?

He?

10
0
Silver badge

Re: Second picture?

That may actually be a war kitteh

4
0
Bronze badge

*sigh*

Even cats have better jobs than me...

11
0
Silver badge

JavaScript?

Nonsense. Everybody knows cats only code in Purrl.

34
0
TRT
Silver badge

Re: JavaScript?

The cat is saying "Dis is computeh, so where is mouse?"

6
0
Bronze badge

Re: Second picture?

She. The researcher is a she.

8
0
Silver badge

Re: She. The researcher is a she.

Some people get that completely distracted when they see a cat...

11
0
Silver badge

Re: Second picture?

"She. The researcher is a she."

So is the cat.

1
0
LDS
Silver badge

Isn't the cat the security researcher?

Of course not, but you can also modify the ATM to deliver cat biscuits and then let the cat discover the way to obtain them...

2
0
x 7
Silver badge

Back in Windows 98 days, at Time Computers, we once had a customer tell the call centre that his cat had FDISKed and FORMATed his hard drive.

The tech offered the cat a job........."because it probably knows more than most of our staff"

6
0

Feh. Cat are too lazy to write code.

They prefer to acquire humans to do it for them.

1
0

Re: JavaScript?

>>The cat is saying "Dis is computeh, so where is mouse?"<<

The mouse is clearly visible left of the keyboard. That leads to two conclusions:

(a) you are clearly distracted by cats,

(b) the lady researcher is left handed.

1
0
Silver badge

She could have put it in a public place...

... with a modified software that asks the user for the amount of money and the PIN.... and then just make a transfer without spitting out any money. An error message on the screen could erase any suspicion.

8
0
Silver badge

Re: She could have put it in a public place...

I saw some program a while back that did exactly that. They set up a fake ATM in the middle of the high street, with someone just sat inside it. People went up to it, they "cloned" the card and then spat the card out with an error on the screen.

People were then shown how it was done.

The idea was to not trust any old ATM

6
0
Happy

Re :I saw some program a while back that did exactly that

this one by any chance?

https://www.youtube.com/watch?v=T23gOh8ByUI

0
0
Unhappy

This is exactly the type of thing that causes me to not have enough money to buy this type of thing.

9
0
Anonymous Coward

"A trailer for Galloway’s talk, [...]"

For a second thought they were offering a way for anyone who wants to take it away.

1
0
Silver badge

What weighs 800kg and runs Windows XP?

The main fire-control computers on HMS Queen Lizzie after BAE 'improved' a ThinkPad?

24
0
Silver badge

I remember an episode the 'The Real Hustle" from a few years ago where they set up a fake ATM consisting of a laptop connected to a card reader and keypad housed inside a large box on a busy street and the amount of people who would just come along and put in their card and pin and when it threw up an error just walk away and go to use another.

There are even companies that turn up to festivals and other pop up events with trucks with a load of ATMs in the back, I whenever possible just use the ATM at the banks and no these little ones in shops, especially as they usually charge to use.

14
0
Silver badge

I remember that episode of TRH. The crazy thing was at least one person saw the guys setting the fake ATM up, including seeing the girl climb inside with her laptop...then just politely asked when the machine would be switched on because they wanted to get some cash out.

13
0
Silver badge

Unless absolutely stuck somewhere, I won't use an ATM unless it is fixed into the side of a building (preferably a bank). These freestanding ones just seem too accessible to ne'er-do-wells. If I have had to use one I am constantly checking my account for suspicious activity.

2
0
Devil

"...too accessible to ne'er-do-wells"

You mean banks?

18
0
TRT
Silver badge

Re: "...too accessible to ne'er-do-wells"

There was a warehouse in a large town to the northwest of London where ATMs of all make, size and model were simply dumped outside at the back. I used to walk past it on the way to the train station every day and every night. No security to speak of, just a sensor light.

I wrote to the company pointing out how easy it would be to obtain a genuine machine front for doctoring for nefarious purposes and asked if they felt any responsibility for the wave of ATM crime at the time. No response.

So I wrote to the council. No response.

So I wrote to the police and enclosed a photograph of the area, of the whole in the chainlink fence made with bolt croppers by the look of the cut ends and of a broken machine front where someone had unsuccessfully tried to remove one. Within a month the yard was cleared of all but the skips full of scrap metal and the whole site had CCTV, IR alarms and a dog patrol.

13
0
Bronze badge

Why use an ATM?

I just get some cash when I buy groceries. I never use an ATM. Why should I? I always carry enough cash in my pocket to buy what I will most likely need the next week or so. When the lights go out I can still buy essentials. Local or even grid failures have happened before and will happen again.

I do not carry a wallet either. I carry an antimagnetic credit card holder with only the absolutely necessary ID and one credit/debit card, plus some tightly folded $100 bills. That in is a front pocket where it is far more difficult for a pickpocketer to pick my pocket.

I am trying to imagine a picture of a pocket with a picture of a pickpocketer taking a picture of a pickpocketer pickpocketing the pocket of a pickpocketer taking a picture of a picture of a pickpocketer picpocketing my pocket. Now, in the other pocket....

1
4
Silver badge

Re: Why use an ATM?

cash? eeeerrr. it makes me feel dirty, i have people to carry that for me.

7
0
Silver badge

Re: TheElder

Next time you buy groceries, take a look at the cash register. Over here, there is a box with a card reader and a numeric key pad. The box connects to the cash register through a wire. The wire goes behind the register - presumably through a hidden key logger - before connecting to register somewhere dark and hard to examine.

The only way to be sure is a specialised payment device (not a phone / camera / music / video / torch / game / thermometer / web browser / Geiger counter / cat toy / address book / diary / taxi finder). The specialised device needs a display to show who is getting paid, how much (and if possible, what for) and a key pad (not a severed finger or eyeball scanner - even if almost every thief knows that a live finger is required.) The device needs a network connection, but minimal storage so there is no excuse for the TLAs to demand your pin.

0
0
Bronze badge

Re: "...too accessible to ne'er-do-wells"

That was a bold way to make your point. You were obviously confident that you would not get caught. Well done.

0
0
Silver badge
Trollface

What weighs 800kg and runs Windows XP?

Your mum.

65
1
Silver badge

Re: What weighs 800kg and runs Windows XP?

Genuine LOL moment there - thanks for that. Have an upvote

15
0
Silver badge

Re: What weighs 800kg and runs Windows XP?

Your mum.

Mum wants a word with you, she's sensitive about her weight and you look like a harp seal. https://polarbearsinternational.org/education-center

8
0
Silver badge

Re: What weighs 800kg and runs Windows XP?

But she's totally cool with running XP?

5
0
Silver badge
Happy

Re: What weighs 800kg and runs Windows XP?

But she's totally cool with running XP?

Ever since she got a machine with Windows 8 on it!

6
0
Anonymous Coward

Re: What weighs 800kg and runs Windows XP?

This ones for all the mothers,

https://www.youtube.com/watch?v=7_rBidCkJxo

0
0
Bronze badge
Happy

Re: What weighs 800kg and runs Windows XP?

@Aladdin Sane:"Your mum"

The single downvote was obviously from his mum.

2
0
Devil

Re: What weighs 800kg and runs Windows XP?

"Your mum."

Ha. Your dream robo-girlfriend who you know is so far beyond your reach!

1
0
Silver badge

Re: What weighs 800kg and runs Windows XP?

Lies. My dream robo-girlfriend runs on RISC OS.

2
0
Anonymous Coward

Correction

The security researcher’s house lair is a converted warehouse.

FTFY. Sounds so much cooler that Cat Lady's "lair" is a warehouse.

6
1
Silver badge
WTF?

Me? Not Surprised at All!

Way, way, back I worked for a Canadian company who manufactured ATM sub-assemblies and accessories.

As the production supervisor I had a Master Key that would unlock all manner of these ATMs. In fact I ended up with several Master Keys (as they were emphasised in paperwork). I found a bunch of them a while back, when I was unpacking my imported personal goods.

When I returned to Canada for a brief visit, I took these Master Keys with me. Believe it or not, decades after they were first installed THEY STILL WORKED! (Opening the locked panel door is a No-No as there is an alarm microswitch attached to detect door opening.)

So not only is the software ancient, so is the hardware!

10
0

So Mr Darmore, girls are not fit for IT?

Bollocks!

7
3

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Forums

Biting the hand that feeds IT © 1998–2017