Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since everyone has physical access to the machine). Why is this?

I thought of the fact that many have security cameras placed over them, but this doesn't seem sufficient to keep ATMs secure, as there is no one constantly watching the camera feed and looking for suspicious behavior. The most this could be used for is identifying an attacker after an attack has been attempted. It seems like this is fairly easily solved through plain clothes, a mask, gloves, etc.

So if this alone isn't or shouldn't be enough of a deterrent, why do we not see ATMs getting hacked for all their cash at 4:00am? What makes the device so secure? Is it just a simple risk-reward analysis, where the cash in the ATM isn't worth the effort of the hack? Or is there more to it which makes the computer secure?

Also, I noted that there have been a couple questions about ATM security (like this one and this one), but mine is about the physical security of the machine, since it violates a common security principle, not anything network related.

share|improve this question
15  
I try to wiggle the card slot at every ATM I use, to reduce the chance someone attached a skimmer. –  Izkata Mar 20 '13 at 15:52
30  
If you have physical access you can simply open the money storage and walk away. No need for hacking or other clever tricks. –  gerrit Mar 20 '13 at 16:22
4  
@gerrit breaking open the money box is easier said than done. A lot of would be thieves manage to tear the ATM free from its anchor but then fail to get any money out afterwards. –  Dan Neely Mar 20 '13 at 17:57
7  
It does not violate any principles. Physical access in case of a PC means that you can easily boot your own operating system and run your own programs with full rights, because the PC has the interface for it (CD drive, USB port, etc.) –  vsz Mar 20 '13 at 19:17
11  
This question comes from wrong assumption: the ATM's computer is NOT physically accessible. You can't read it's memory or send signals to processor pins. –  Agent_L Mar 21 '13 at 12:00

12 Answers 12

up vote 132 down vote accepted

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force.

Get the machine out of the vault and away from supervision and then yes... all bets are off.

share|improve this answer
10  
That's not always true. It is certainly true that this describes many (if not most) ATM installations, but there are many types of ATM machines installed in many different locations and ways, and not all of these conditions apply to all of them. –  Xander Mar 20 '13 at 14:21
3  
Master codes do still work on the limited keypad, at least some of the time... Google around ;) –  Izkata Mar 20 '13 at 15:56
6  
The skinny little gas station ATM machines certainly don't look that hardened, but they probably only keep a few thousand in them at a time. Those ATM companies probably spend more on the statisticians to predict theft than they do on the Fort Knox model ATM... –  Dave Swersky Mar 20 '13 at 16:34
39  
ATM machines. ATM machines. ATM machines. ATM MACHINES. ATM MACHINES. ATM MACHINES. ATM MACHINES. ATM MACHINES. –  Garrett Albright Mar 21 '13 at 2:30
12  
@GarrettAlbright Automatic ATM Machines >=) –  Izkata Mar 21 '13 at 3:47

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy Crockett entrenched in Alamo fort and shouting "you'll never take me alive !". By comparison, a basic PC lacks all forms of tamper-resistance and would be more adequately compared with an open buffet at a charity event guarded by non-violent buddhist monks who will discourage discourteous behaviour by making stern faces and striking perpetrators with severe glares only.

In practice, most attacks on ATM are attacks on the ATM environment, e.g. skimming: the ATM itself is untouched, but the debit card is spied upon during its physical transit from the owner's wallet to the ATM entrails.

share|improve this answer
5  
Would be ahem... interesting to have another kind of Davy Crockett installed as a tamper-resistance measure. –  Deer Hunter Mar 20 '13 at 16:17
32  
Where can I find violent Buddhist monks for my charity buffet? –  LarsTech Mar 20 '13 at 17:07
5  
That’s a very interesting, but at the same time very vague answer. How are these mechanisms realised? –  Konrad Rudolph Mar 20 '13 at 20:15
8  
Vendors are not exactly keen on publishing details, but you can expect a set of detectors for light, pressure, temperature, and a mesh of wire running on the inside of the tamper-proof casing. If light is detected, or a wrong pressure, or a wrong temperature, or one of the wires is cut, then the system "commits suicide". E.g. critical secrets (such as cryptographic keys) are kept in a special RAM, powered by a battery; on intrusion, the RAM contents are erased, then power for that RAM is switched off. –  Tom Leek Mar 20 '13 at 20:23
4  
Informative and entertaining. (+1) –  paraxor Mar 20 '13 at 21:21

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user.

It is, however, worth noting that one of the most successful attacks against ATMs is to cover the keypad and card reader with a card reader and keypad of the attacker's own design. They can then use this to scan the card and get the pin. This allows them to clone the card and access the ATM themselves.

The machine itself is still safe since physical access is restricted, but the interface is not physically protected and is thus easily open to security threats. This is why cameras often watch the ATM to look for the installation of such hardware.

share|improve this answer

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty.

  • fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos.

  • genuine ATMs have been outfitted with criminal equipment to collect PINs, in response to which ATMs had to incorporate new physical measures.

  • ATMs have been simply ripped out and hauled away by criminals.

  • ATMs are open 24 hours a day and in deserted areas, creating opportunities for criminals to coerce victims into extracting cash. Prior to the ATM, it was not possible to kidnap someone at knifepoint and take them to a bank and 3 in the morning in a seedy part of town.

  • As a general observation, new security measures introduced in banking usually tend to be designed to protect the banks from liability, rather than the safety of customers or their capital.

share|improve this answer
4  
Your observation is certainly true of chip-in-pin technology. The technology is incredably flawed and doesn't properly authenticate but it protects credit card institutions from paying out if your card was "chip-in-pin verified" as they are able to say that you were liable for the pin and that it was entirely your fault that the card was used after it was lost. –  Sparksis Mar 20 '13 at 21:05
    
+1 for the disclaimer at the end. Very true and worth keeping it in mind –  PPC Mar 20 '13 at 23:19
    
None of your points concentrate on the security of the ATM device itself. The attack surface of the ATM is quite small. The attack surface of humans using the ATM is quite large. –  Dan Esparza Mar 22 '13 at 13:37

Logged out to post this just to be safe:

I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run automated tests. They are mostly secured two ways:

  1. Hardware. As others have commented, ATMs in "the wild" have a number of physical security measures to prevent tampering with the box, including dynamite-proofing (by some companies in some locales where dynamite use is a common factor), ink-splattering (so if you do manage to get in, you can't use any of the cash), and anti-skimmer measures (with varying degrees of effectiveness).

  2. Lack of privileges. Running as intended, you never get the chance to log in as an admin user, cannot use USB devices unless they're verified ATM hardware, et cetera. Again, it's fairly simple to get the ATM to run as unintended -- they do so for installs, upgrades, and so forth -- but you can't do so from the pinpad/frontend of the ATM and the back is usually a) locked (see item 1) and/or b) inside the bank, making it very obvious what you're trying to do.

share|improve this answer

To a large degree, how safe varies with the attack vector. For instance, they're typically not safe at all from having a skimmer installed, allowing a thief to collect card information from unsuspecting users. They're getting better by added intricately molded fascias that make installing skimmers more difficult, but even that can be overcome by a good sculptor or a 3-D printer.

As for protecting against being broken into - They're often alarmed, so by the time a would-be thief gets into the box, the police are already there. The best bet is to physically haul the machine away and break into in in a safe location, and the machines are often bolted or chained on location to help prevent that.

share|improve this answer
    
One would think that GPSes are cheap enough know where it would be cost effective to implement on the ATM, with maybe a 3G or AM/FM beacon or similar. –  BigHomie Mar 20 '13 at 14:05
    
@MDMoore313 I've read that they are indeed putting GPSs into ATMs now, but I don't know the details of how they're being used, so you may well be correct. –  Xander Mar 20 '13 at 14:06
1  
Get the ATM into the back of an all-metal van and no GPS (or GSM) signal will get through. –  Cosmin Prund Mar 20 '13 at 16:47
    
@CosminPrund then how is it that GPS modules mounted in trunks can still acquire their triangulated position? Unless you're referring to a van with a faraday cage mounted to the inside, a standard van probably doesn't stand a chance. –  BigHomie Mar 21 '13 at 14:18
1  
@MDMoore313, GPS signals are very weak and easy to block; That's why you need to mount your GPS navigator on the windshield of your car. Truck mounted units are mounted by a specialist and mounted so that they can get a signal. The fact that a specialist can find such a place doesn't mean you can get a signal anywhere within the truck. And I didn't say trucks, because those usually have light-weight sides made of fabric. Think of a white-van, the windowless kind. The kind used by delivery companies. –  Cosmin Prund Mar 22 '13 at 10:07

I'll try to approach your question from a purely physical point of view.

Physical access still overrides almost all other security measures, this applies to ATMs as well.

Imagine the following scenario: You have a locked (awaiting username & password) PC in a locked nuclear bunker, outside you have a mouse, keyboard, and a monitor. All connected to the PC with long cables. Having acess to the keyboard and the mouse isn't very different from having RDP access in this case. You can probably send some high-voltage in the cables, thus performing a DoS attack, but that's as far as you can go.

ATMs aren't attacked simply because the risks outweigh the benefits. The ATM has an embedded security camera, there are security cameras around it, it has an internal alarm, it's placed in a securely-built small room. By the time the thieves break into the ATM, the police will probably be already there.

share|improve this answer

physical security of the machine, since it violates a common security principle

Not usually. Physical access doesn't meant you can look at it or be in the same place, it means you can poke at the guts. The guts are in a heavy safe, so unless you can haul it away, have hours to cut it open in place, or are one hell of a super-duper locksmith, it's doing alright as it sits.

A well-trafficked area and public exposure are often enough because the physical attacks to access the locked parts of the machine take time (or heavy equipment).

As for ATM cameras, they're not about preventing theft from the machine. They're about identifying crime that doesn't break the ATM after the fact, such as somebody placing a skimmer or catching forced-withdrawal crimes.

As bolder attempts against the physical security of the device happen, better installation methods are found to prevent them.

So, since the interfaces that aren't on the front of the machine take opening secure locks or damaging the hardware before being able to apply specialized knowledge, it's easier to just rob the cash box or over or focus on external hacks.

share|improve this answer

Well, a few factors.

I assume many of the thieves that will attempt to target ATMs fall into two categories.

  1. Thieves that will be deterred by physical locks.
  2. Thieves that wants the money is the ATM so bad he is willing to physically smash open the machine.

The thieves that are actually smart enough to hack into the ATMs system to obtain the cash will probably find the risk of being caught due to being physically present not worth the amount of cash they can obtain from the ATM, considering there are probably less risky and more lucrative black market activities they can be taking part in.

There have been plenty of demonstrated exploits against ATMs though, many of them illustrated in this blog post here. I'm not sure if any of the exploits have been used in the wild though.

share|improve this answer

Apparently some models of ATMs use a universal key that you can get off the internet. Giving physical access to the hardware. In 2010 a security expert demonstrated how he was able to use this (and the fact that some ATMS can be updated via phone line) to make the ATM spew out money on demand.

As others have mentioned, the enclosures in ATMs pretty much prevent direct access to the computer inside. But if you use a skeleton key assuming that only legitimate owners would have one, or allow a random phone call full access to update your system, it doesn't matter.

share|improve this answer
5  
Note also that John Connor is able to dispense cash from ATMs using an Atari Portfolio. Eeeeasey money. –  g33kz0r Mar 20 '13 at 21:43
    
Well if Jeff Godblum can infect an alien armada with a Mac... –  Mike Brown Mar 22 '13 at 15:19

"If an attacker has physical access to my machine, all bets are off,"

This is generally applied to PCs/laptops/servers. These have things like USB ports/CD drives (not to mention easy-to-remove screws from which you can poke at the innards) from which you can easily get full access. For example, if I want to get into my friends (Linux) computer, I can just boot from a live USB/CD, chroot into their Linux FS, change the password from their (or create a new user), reboot, and I now have full access. Windows is trickier, but doable. If they've put a lock on it via BIOS, then I can open it up, remove the hard drive, and then mess with it. Basically, such devices aren't made for security. They have lots of software security, but there is no provision for hardware security since keeping the hardware secure is understood to be your problem.

ATMs, on the other hand, are designed to be secure hardware wise. A well designed ATM will be tough to get into. You probably can cut a hole in the side and get physical access (after which you can take the money and/or get into the banking system), however there probably are alarms that alert the police when an ATM is being tampered with. Any USB slots/ports an ATM may have may be locked down in such a way that only authorized devices can get through. Nevertheless, people are able to get away with installing skimmers in ATM card slots or sledgehammering ATMs and running with the cash. There have been some cases demonstrated where one can flash new firmware (gasp) very quickly.

share|improve this answer

ATM is secure in a same way all physical security works: your house door lock or a bank vault. It's not "impenetrable to everything", it's just not penetrable in a time allowing to grab the loot and escape.

Indeed it is simple risk-reward analysis. A house in "nice neighborhood" can do with weak locks, because it's very likely that someone will notice, call the police and they'll arrive in a short time. On the other hand, in "bad neighborhood" you often see reinforced doors, because burglar can assume that no one would care about a door being kicked open.

ATM is pretty heavily armored and locked up, so there is no physical access to the computer inside. Just to start hacking the computer you'd have to crack the shell open first. The risk-reward analysis still applies: can you crack and hack it before anybody notices? It would certainly take more than couple of hours, that's why you don't see anyone doing it at 4:00am. However, there are many examples of robberies when thieves ripped the ATM from the wall and stole it in one piece. In this way the part when being exposed can be shortened enough to make the effort worthwhile and move the lengthy part to a safer place.

Please note there is one more variable coming into play: it can't be known for sure how much money is inside the ATM. One can only guess. ATM are rarely "filled up", they are loaded with "just enough" to make it to the next scheduled loading. Sometimes the circumstances give away a hint: there was an incident in Poland when a brand new ATM was stolen the night before a grand opening of a new shopping mall. Predicting the huge crowds, ATM company filled the machine with amount of cash far larger than normal on the day before. Robbers anticipated and took advantage of that, but it still was a risky move.

To sum up:

  • Inner computer is not physically accessible from the outside.
  • Just to start hacking you need lengthy and noisy cracking open part.
  • Once you're equipped to crack the outer shell (to get to the computer) you might just as well continue cutting the money cases, thus alleviating the need of any computer literacy.
  • ATM is likely to be equipped with content-destruction devices (paint sprayers).
  • You can never know for sure if there's enough money inside just to pay the cost of cutting tools.
share|improve this answer

protected by Community Mar 21 '13 at 17:00

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.