Hot answers tagged

164

I think the assumption here is wrong. They don't have physical access to the machine. They have supervised access to a very limited control panel for a machine which is built into a bomb-proof safe, bolted to the ground and hooked up to an alarm system with an armed response force. Get the machine out of the vault and away from supervision and then yes... ...


136

ATM are supposed to be tamper resistant, and to actively react upon any detected breach of physical security, notably by marking bills with some highly conspicuous and hard to remove ink, and also by committing honourable seppuku. For that matter, an ATM should be compared with HSM, payment terminals and smart card. You can imagine the ATM as a kind of Davy ...


113

This answer applies when the ATM uses the card's magnetic stripe, not when the card's chip is used. The keyboard of an ATM is a completely separated device with special hardware security features (like self-destroying chips if someone tries to open it, etc.) because it's the bottleneck of the whole ATM security. When you enter a pin, the ATM itself won't ...


45

The adage is still accurate. Physical access to the machine is not the same as physical ability to interact with the machine. The vast majority of attacks against a physical box involve actually altering the hardware and there is a limited amount you can do to alter the hardware of an ATM as it is locked in a safe, away from the user. It is, however, ...


37

Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty. fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos. ...


32

Confirming the PIN when the card's magnetic stripe is used requires contacting the bank's server. Since this takes time (and took even more time back in the days of dialup), the ATM combines "verify the PIN" and "withdraw money" into a single contact. The behavior might be different if the card has a chip and the ATM supports it.


30

From an end user perspective, i usually give the reader and surrounding plates a good whack with my fist and i try and peel back any of the faceplates with my keys or a knife. The fact of the matter is, the best quality skimmers aren't detectable. POS machines can be hacked which results in an almost undetectable scenario. Your best bet, if you want to avoid ...


30

Logged out to post this just to be safe: I've worked with ATMs in the past. Our test machines are rather insecure indeed; the OS has to be running on verified hardware, but we can get admin rights to the OS easily enough and do whatever we like. We routinely lower the firewall and open the boxes to the network (they won't have internet) so we can run ...


23

Here is what I think happened. Two conditions which are found often around universities: This is ATM at which you swipe your card and the card remains in your possession while the transaction occurs on the screen. This is not the kind which eats the card and keeps it and spits it back out at you. The ATM software after giving cash for withdrawal and ...


21

Most ATMs have to deal with 2 types of cards: old, magnetic ones and newer chip cards. Magnetic cards can't verify the PIN locally. Chip cards theoretically have this ability - but it doesn't mean that this functionality isn't limited. The behavior you've described perfectly matches magnetic card flow. But - should chip card be verified using another path? ...


18

To a large degree, how safe varies with the attack vector. For instance, they're typically not safe at all from having a skimmer installed, allowing a thief to collect card information from unsuspecting users. They're getting better by added intricately molded fascias that make installing skimmers more difficult, but even that can be overcome by a good ...


17

I'll try to approach your question from a purely physical point of view. Physical access still overrides almost all other security measures, this applies to ATMs as well. Imagine the following scenario: You have a locked (awaiting username & password) PC in a locked nuclear bunker, outside you have a mouse, keyboard, and a monitor. All connected to the ...


15

For a successful attack of this kind to work and be carried out within a minute, two conditions must be met: The card contains a magnetic stripe. The ATM supports magnetic-stripe cards. Since you said SECU, then you probably live in the United States, where the two conditions are met. How can an attack be carried out? The attacker could have installed ...


14

This is a question of policy in the ATM software. Many ATMs do in fact verify the PIN with the bank before allowing you to continue. But the ATM itself doesn't know whether your PIN is correct. It has to ask the bank, and this takes time. How much time it takes will often determine whether or not the ATM will skip this step. Each transaction between the ...


14

physical security of the machine, since it violates a common security principle Not usually. Physical access doesn't meant you can look at it or be in the same place, it means you can poke at the guts. The guts are in a heavy safe, so unless you can haul it away, have hours to cut it open in place, or are one hell of a super-duper locksmith, it's doing ...


12

The newest skimmers cannot be seen. These skimmers wafer thin and insert into the card reader: To make matters worse the modification can be purely software. ATMs can be hacked, their software can be modified to log the mag strips and pins of every user. This is a losing battle and you take a chance every time you use an ATM. Security is relative, that ...


10

Issue to consider: You must assume the worst case scenario -you credit card info has just been stolen. The following answer deals with the actions you should take to safeguard yourself from you money being stolen as well. Note that this answer really doesnt address the mechanisms behind how your information may have been stolen (I can certainly elaborate, ...


8

Well, a few factors. I assume many of the thieves that will attempt to target ATMs fall into two categories. Thieves that will be deterred by physical locks. Thieves that wants the money is the ATM so bad he is willing to physically smash open the machine. The thieves that are actually smart enough to hack into the ATMs system to obtain the cash will ...


8

"If an attacker has physical access to my machine, all bets are off," This is generally applied to PCs/laptops/servers. These have things like USB ports/CD drives (not to mention easy-to-remove screws from which you can poke at the innards) from which you can easily get full access. For example, if I want to get into my friends (Linux) computer, I can just ...


7

Apparently some models of ATMs use a universal key that you can get off the internet. Giving physical access to the hardware. In 2010 a security expert demonstrated how he was able to use this (and the fact that some ATMS can be updated via phone line) to make the ATM spew out money on demand. As others have mentioned, the enclosures in ATMs pretty much ...


7

Generally speaking, it is not safer to reveal information than to keep it by yourself (but this has exceptions). But "not safer" does not mean "unsafe". If it so happens that revealing information about your OS and software is positively unsafe (i.e. significantly increases risks), then: You have a problem, because your software has known holes (otherwise ...


6

What's the use of hashing a 4 digit PIN? You only need 10.000 rounds to get the PIN back, even if each PIN has its own salt. They are probably stored encrypted, for local employees etc, but for an engineer working there it won't be a big problem to get the PIN out of the database.


6

The best you can really do is use ATMs you know or ATMs that have good physical security if one you know isn't available. (go to an ATM inside a bank). Even then, I always spot check the machine for any signs of tampering. A simple trick that can work well is to make sure the keypad isn't compromised (by looking and pulling on it) and then if it appears ...


6

It is a violation of their merchant agreement All credit card merchants are required to conform to PCI-DSS which spells out rules for handing credit card data. If you check the PCI DSS standards, you'll find the following: Never send unprotected PANs by end-user messaging technologies (for example, e-mail, instant messaging, chat, etc.). (The "PAN" is ...


5

There is no way to no for sure what happens inside the ATM, but most ATMs handle transactions by connecting to a server. There is no reason that it should have to keep any record of transactions internally.


5

ATM is secure in a same way all physical security works: your house door lock or a bank vault. It's not "impenetrable to everything", it's just not penetrable in a time allowing to grab the loot and escape. Indeed it is simple risk-reward analysis. A house in "nice neighborhood" can do with weak locks, because it's very likely that someone will notice, call ...


5

I think a better question to ask would be whether it is unsafe for you to reveal that information as opposed to whether it is safe. With the ATM example, ATMs use very specific installations of Windows XP that are very resilient, and the computer itself is generally protected extremely well with various layers of physical security that need to be compromised ...


4

An "ATM room" is more meant to give to the customer a feeling of security than actual security. For a bank, "security" means "security of the bank" so it will want to protect the really valuable thing (in the eyes of the bank), and that's the machine itself and its belly full of money. Therefore, bank ATM are normally integrated in the load-bearing wall of ...


4

The article itself addresses this: Banks can run a simple check to see if any card inserted into an ATM is a counterfeit magnetic stripe card that is encoded with data stolen from a chip card. But there may be some instances in which banks are doing this checking incorrectly or not at all during some periods, and experts say the thieves have figured out ...


3

My sense is that ATM transactions processing is done mostly on the server side: An ATM is basically a safe with a PC, an LCD monitor and some additional devices. ATMs are not on the Internet... To clarify, they are not internet-accessible in the sense that installing cracking software on an ATM would require physical access to internals of the ATM, in ...


Only top voted, non community-wiki answers of a minimum length are eligible