ATMs At Risk, Researcher Warns At Black Hat

LAS VEGAS, NEVADA -- Black Hat USA 2010 -- A security researcher today gave notice to companies that make automated teller machines (ATMs).

Here on the first day of the Black Hat conference, Barnaby Jack, director of research at IOActive, demonstrated attacks that would allow a criminal to compromise ATMs, allowing hypothetical thieves to steal cash, copy customers' ATM card data, or learn the master passwords of the machines. While one of the attacks required a few seconds to open the ATM and insert a USB drive with code to overwrite the system, the other attack used a remote management feature commonly found on standalone ATMs.

Jack's presentation targeted machines made by Tranax and Triton, but other ATMs likely have similar security issues, he said.

"I found specific vulnerabilities in the ATM machines," Jack said during a press conference following the presentation. "But the attack surface is [similar] across the ATM industry as a whole ... In every ATM system I've looked at, I've been able to find flaws."

Jack said he used fairly simple analyses of the operating system and software commonly found on ATMs to create the exploits he demonstrated on stage. "We are back to 1999 in terms of code quality," he said.

Other security experts who watched the presentation agreed that ATM software would likely be a gold mine for security researchers.

"The presentation shows that the security of these machines need to be revisited because they were never architected with [online] security in mind," says Jamie Butler, director of research for security firm Mandiant.

In the past, cybercriminal attacks on cash machines have generally focused on physical attacks, such as adding skimmers to steal users' ATM card data -- or even stealing the whole machine. Instead, IOActive's Jack focused on the software, creating a remote administration tool, dubbed Dillinger, and rootkit, known as Scrooge. Dillinger allows a person to easily select known ATMs and retrieve data or send payloads, while Scrooge, which can be sent to an ATM as a payload, overwrites the system's programming to allow a person to control the machine.

Most standalone ATMs, such as those frequently found in convenience stores and bars, run on Windows CE. But Jack stressed that the vulnerabilities he found were in the proprietary cash management software, not in the operating system.

A compromised cash machine can be controlled by a person who inserts a card with special codes stored on the magstripe or who types a code on the ATM's keys, Jack said. He demonstrated Scrooge's ability to make the ATM dispense 50 bills -- all novelty cash in his demonstration -- and to store the details of any card inserted into the machine.

Triton, the maker of one of the ATMs, has required that all code running on its system be signed. It offers its customers special tamper-resistant keys for preventing access to the internal components of a cash machine, said Bob Douglas, vice president of engineering for the firm.

"We have developed a defense against attacks of this nature," Douglas said

Related Slideshow: Barnaby Jack Hits The Jackpot With ATM Hack

This is not the first time ATMs have been targeted with rogue code.

In 2009, Diebold, the No. 2 maker of ATMs, warned customers that more than 20 cash machines in Eastern Europe had been found to contain malicious code. The software had features similar to those demonstrated by IOActive's Jack, allowing criminals to steal and retrieve ATM card data and dispense cash from the cartridges. At the time, security researchers claimed the attack was an inside job, but Jack said his research has convinced him otherwise.

"Based on what I have seen, I think there is a possibility that the attacks were software-based," Jack said.