How is an ATM secure?

Question

I'm curious why an ATM computer is considered secure. The general adage of "If an attacker has physical access to my machine, all bets are off," seems to not apply in this circumstance (since everyone has physical access to the machine). Why is this?

I thought of the fact that many have security cameras placed over them, but this doesn't seem sufficient to keep ATMs secure, as there is no one constantly watching the camera feed and looking for suspicious behavior. The most this could be used for is identifying an attacker after an attack has been attempted. It seems like this is fairly easily solved through plain clothes, a mask, gloves, etc.

So if this alone isn't or shouldn't be enough of a deterrent, why do we not see ATMs getting hacked for all their cash at 4:00am? What makes the device so secure? Is it just a simple risk-reward analysis, where the cash in the ATM isn't worth the effort of the hack? Or is there more to it which makes the computer secure?

Also, I noted that there have been a couple questions about ATM security (like this one and this one), but mine is about the physical security of the machine, since it violates a common security principle, not anything network related.

Answer 1

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force.

Get the machine out of the vault and away from supervision and then yes... all bets are off.

Answer 2

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy Crockett entrenched in Alamo fort and shouting "you'll never take me alive !". By comparison, a basic PC lacks all forms of tamper-resistance and would be more adequately compared with an open buffet at a charity event guarded by non-violent buddhist monks who will discourage discourteous behaviour by making stern faces and striking perpetrators with severe glares only.

In practice, most attacks on ATM are attacks on the ATM environment, e.g. skimming: the ATM itself is untouched, but the debit card is spied upon during its physical transit from the owner's wallet to the ATM entrails.

Answer 3

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user.

It is, however, worth noting that one of the most successful attacks against ATMs is to cover the keypad and card reader with a card reader and keypad of the attacker's own design. They can then use this to scan the card and get the pin. This allows them to clone the card and access the ATM themselves.

The machine itself is still safe since physical access is restricted, but the interface is not physically protected and is thus easily open to security threats. This is why cameras often watch the ATM to look for the installation of such hardware.

Answer 4

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty.

• fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos.

• genuine ATMs have been outfitted with criminal equipment to collect PINs, in response to which ATMs had to incorporate new physical measures.

• ATMs have been simply ripped out and hauled away by criminals.

• ATMs are open 24 hours a day and in deserted areas, creating opportunities for criminals to coerce victims into extracting cash. Prior to the ATM, it was not possible to kidnap someone at knifepoint and take them to a bank and 3 in the morning in a seedy part of town.

• As a general observation, new security measures introduced in banking usually tend to be designed to protect the banks from liability, rather than the safety of customers or their capital.

Answer 5

Logged out to post this just to be safe:

I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run automated tests. They are mostly secured two ways:

1. Hardware. As others have commented, ATMs in "the wild" have a number of physical security measures to prevent tampering with the box, including dynamite-proofing (by some companies in some locales where dynamite use is a common factor), ink-splattering (so if you do manage to get in, you can't use any of the cash), and anti-skimmer measures (with varying degrees of effectiveness).

2. Lack of privileges. Running as intended, you never get the chance to log in as an admin user, cannot use USB devices unless they're verified ATM hardware, et cetera. Again, it's fairly simple to get the ATM to run as unintended -- they do so for installs, upgrades, and so forth -- but you can't do so from the pinpad/frontend of the ATM and the back is usually a) locked (see item 1) and/or b) inside the bank, making it very obvious what you're trying to do.

Answer 6

To a large degree, how safe varies with the attack vector. For instance, they're typically not safe at all from having a skimmer installed, allowing a thief to collect card information from unsuspecting users. They're getting better by added intricately molded fascias that make installing skimmers more difficult, but even that can be overcome by a good sculptor or a 3-D printer.

As for protecting against being broken into - They're often alarmed, so by the time a would-be thief gets into the box, the police are already there. The best bet is to physically haul the machine away and break into in in a safe location, and the machines are often bolted or chained on location to help prevent that.

Answer 7

I'll try to approach your question from a purely physical point of view.

Physical access still overrides almost all other security measures, this applies to ATMs as well.

Imagine the following scenario: You have a locked (awaiting username & password) PC in a locked nuclear bunker, outside you have a mouse, keyboard, and a monitor. All connected to the PC with long cables. Having access to the keyboard and the mouse isn't very different from having RDP access in this case. You can probably send some high-voltage in the cables, thus performing a DoS attack, but that's as far as you can go.

ATMs aren't attacked simply because the risks outweigh the benefits. The ATM has an embedded security camera, there are security cameras around it, it has an internal alarm, it's placed in a securely-built small room. By the time the thieves break into the ATM, the police will probably be already there.

Answer 8

physical security of the machine, since it violates a common security principle

Not usually. Physical access doesn't meant you can look at it or be in the same place, it means you can poke at the guts. The guts are in a heavy safe, so unless you can haul it away, have hours to cut it open in place, or are one hell of a super-duper locksmith, it's doing alright as it sits.

A well-trafficked area and public exposure are often enough because the physical attacks to access the locked parts of the machine take time (or heavy equipment).

As for ATM cameras, they're not about preventing theft from the machine. They're about identifying crime that doesn't break the ATM after the fact, such as somebody placing a skimmer or catching forced-withdrawal crimes.

As bolder attempts against the physical security of the device happen, better installation methods are found to prevent them.

So, since the interfaces that aren't on the front of the machine take opening secure locks or damaging the hardware before being able to apply specialized knowledge, it's easier to just rob the cash box or over or focus on external hacks.

Answer 9

Well, a few factors.

I assume many of the thieves that will attempt to target ATMs fall into two categories.

1. Thieves that will be deterred by physical locks.
2. Thieves that wants the money is the ATM so bad he is willing to physically smash open the machine.

The thieves that are actually smart enough to hack into the ATMs system to obtain the cash will probably find the risk of being caught due to being physically present not worth the amount of cash they can obtain from the ATM, considering there are probably less risky and more lucrative black market activities they can be taking part in.

There have been plenty of demonstrated exploits against ATMs though, many of them illustrated in this blog post here. I'm not sure if any of the exploits have been used in the wild though.

Answer 10

"If an attacker has physical access to my machine, all bets are off,"

This is generally applied to PCs/laptops/servers. These have things like USB ports/CD drives (not to mention easy-to-remove screws from which you can poke at the innards) from which you can easily get full access. For example, if I want to get into my friends (Linux) computer, I can just boot from a live USB/CD, chroot into their Linux FS, change the password from their (or create a new user), reboot, and I now have full access. Windows is trickier, but doable. If they've put a lock on it via BIOS, then I can open it up, remove the hard drive, and then mess with it. Basically, such devices aren't made for security. They have lots of software security, but there is no provision for hardware security since keeping the hardware secure is understood to be your problem.

ATMs, on the other hand, are designed to be secure hardware wise. A well designed ATM will be tough to get into. You probably can cut a hole in the side and get physical access (after which you can take the money and/or get into the banking system), however there probably are alarms that alert the police when an ATM is being tampered with. Any USB slots/ports an ATM may have may be locked down in such a way that only authorized devices can get through. Nevertheless, people are able to get away with installing skimmers in ATM card slots or sledgehammering ATMs and running with the cash. There have been some cases demonstrated where one can flash new firmware (gasp) very quickly.

Answer 11

Apparently some models of ATMs use a universal key that you can get off the internet. Giving physical access to the hardware. In 2010 a security expert demonstrated how he was able to use this (and the fact that some ATMS can be updated via phone line) to make the ATM spew out money on demand.

As others have mentioned, the enclosures in ATMs pretty much prevent direct access to the computer inside. But if you use a skeleton key assuming that only legitimate owners would have one, or allow a random phone call full access to update your system, it doesn't matter.

Answer 12

ATM is secure in a same way all physical security works: your house door lock or a bank vault. It's not "impenetrable to everything", it's just not penetrable in a time allowing to grab the loot and escape.

Indeed it is simple risk-reward analysis. A house in "nice neighborhood" can do with weak locks, because it's very likely that someone will notice, call the police and they'll arrive in a short time. On the other hand, in "bad neighborhood" you often see reinforced doors, because burglar can assume that no one would care about a door being kicked open.

ATM is pretty heavily armored and locked up, so there is no physical access to the computer inside. Just to start hacking the computer you'd have to crack the shell open first. The risk-reward analysis still applies: can you crack and hack it before anybody notices? It would certainly take more than couple of hours, that's why you don't see anyone doing it at 4:00am. However, there are many examples of robberies when thieves ripped the ATM from the wall and stole it in one piece. In this way the part when being exposed can be shortened enough to make the effort worthwhile and move the lengthy part to a safer place.

Please note there is one more variable coming into play: it can't be known for sure how much money is inside the ATM. One can only guess. ATM are rarely "filled up", they are loaded with "just enough" to make it to the next scheduled loading. Sometimes the circumstances give away a hint: there was an incident in Poland when a brand new ATM was stolen the night before a grand opening of a new shopping mall. Predicting the huge crowds, ATM company filled the machine with amount of cash far larger than normal on the day before. Robbers anticipated and took advantage of that, but it still was a risky move.

To sum up:

• Inner computer is not physically accessible from the outside.
• Just to start hacking you need lengthy and noisy cracking open part.
• Once you're equipped to crack the outer shell (to get to the computer) you might just as well continue cutting the money cases, thus alleviating the need of any computer literacy.
• ATM is likely to be equipped with content-destruction devices (paint sprayers).
• You can never know for sure if there's enough money inside just to pay the cost of cutting tools.