We know that the majority of attacks against ATM's are against the
environment of the ATM (ie Card Skimming) and not with the software
itself. This threat may never completely be eradicated. That said, can
someone point out how the software running the software could serve as
There are attacks against the ATM software, but those are different from attack's on the operating system. When you talk about card skimming or splicing into the hardware, those are separate concerns from the operating system. An operating system security patch typically addresses things like privilege escalation, accessing protected memory, etc. Since the ATM is essentially a computer with a touchscreen and a card reader, if you can takeover the computer and force it to run code its not intended you can modify data, capture data, change the way the program functions. So, if the system is not patched, perhaps I can now execute arbitrary commands with the highest privileges and force the ATM software to do something different.
I think you may be romanticizing the complexity and security of Bank ATM roll outs. ATMs may not be on public networks, but they are often certainly accessible for internal corporate networks. If you need to troubleshoot a box, upload software, etc. you probably don't want to send a Tech out into the field. So, if you compromise the Bank's network you can pivot to the ATM network potentially. You should consider malicious insiders at the Bank taking advantage of flaws in the system.
From the physical standpoint, you can run ATM software on commodity hardware. If a tech goes out into the field, he can of course hook up equipment, keyboard, etc. An attacker could do the same. Some bank's have ATMs built into store front, where the back can be accessed from inside the store. I have seen examples where there is a simple pad lock to protect it on the inside. It would not be difficult to gain physical access.
Here is an example:
Let's say you took advantage of something like ms12-053 and developed a real world exploit. You will target this PC from inside the corporate network, or perhaps they are not encrypting their traffic and you physically splice in or otherwise can network level access locally/physically. If you can execute arbitrary code, perhaps you install some malware or remote reporting tools. If you are organized crime, maybe you have a specific exploit to run against the ATM software or a malicious version and you just replace the real ATM software.
At the end of the day, its not different than if you did not patch a pc or server. The difference is that if you can compromise this system, you have a better change of stealing money, identity theft, etc.