ATM Security Workshop on GISEC 2024

ATM Security Workshop by Positive Technologies on GISEC 2024

Transcript

1. Automated Teller Machine (ATM)
2. Overview What components does an ATM consist of How does the ATM interact with banks What attacks are applicable to ATMs Practical demonstration
4. Statistics Network attacks Vulnerable Requirements Required time 85% ATMs ATM network access 15 minutes Black Box Vulnerable Requirements Required time 69% ATMs Physical access to the service area 10 minutes Boot in abnormal mode (e.g. safe mode) Vulnerable Requirements Required time 42% ATMs Physical access to the service area 15 minutes Escaping kiosk mode Vulnerable Requirements Required time 76% ATMs Physical access to the service area 15 minutes Hard disk access Vulnerable Requirements Required time 92% ATMs Physical access to the service area 20 minutes
5. About ATMs
6. ATM types (by location) Components of the ATM ▪ Office (installed indoors) ▪ Outdoor (installed outdoors) ▪ Over-the-wall (installed through a partition both inside and outside the building) Supervisor / Operator Panel PC Core Coin Dispenser Receipt / Journal Printer and Card Reader Card Capture Bin Standard Side-Box or Cheque Acceptor Side-Box Security Enclosure Door Top-Box Network connection Digital Audio Volume Control Statement Printer Currency Dispenser or Cash Acceptor Security Enclosure Door
7. Typically ATMs have the following characteristics important for our case: Typical ATM attributes ▪ Run on Win* operating systems — typically Win7, Win10 ▪ Rigidly segmented from the corporate LAN, in their own segment for ATMs, network accesses are sliced strictly ▪ Dedicated group of administrators ▪ Not domain members, only workgroups ▪ Antivirus software is installed on the device >
8. ATM Communications CDM EPP IDC NFC QR Windows Firewall Processing center Monitoring server Bank network Secure communication channel Methods of connecting to an ATM CDM — Recycler/ Dispenser EPP — Peripherals IDC — Card reader NFC — NFC module QR — QR-code module Encrypted processing data Unencrypted monitoring data Unencrypted monitoring data Encrypted processing data
9. Processing center Bank network Encrypted communication ATM Bank application Service providers Peripherals API SPI XFS manager User
10. ATM attacks overview
11. Attacking ATM components Device Possible attacks ATM computer ▪ Connection of USB devices ▪ Connection to hard drive ▪ Boot mode modification Card reader decodes data from bank cards ▪ Card data intercaption Cash dispenser issues banknotes from the safe ▪ Black Box Network equipment connects the ATM to the processing center and remote administration servers ▪ Interception of network traffic ▪ Spoofing of processing center ▪ Attack on available network services ▪ Attack on network devices ▪ Connection from the bank`s internal network ▪ Spoofing or hacking of software update server
12. ▪ Insufficient peripheral security (including cash dispenser issues) ▪ Vulnerabilities or improper configuration of Application Control ▪ Improper configuration of systems or devices ▪ Insufficient network security ▪ Other things ATM vulnerabilities categories youtube.com/@bankomat3210
13. Black box attack
14. With access to the dispenser controller USB port, an attacker can install an outdated or modified firmware version (with malicious content) to bypass the encryption and withdraw cash.) Real life example CVE-2018-9099 CVE-2018-9100 CVE-2017-17668 CVE-2018-5717
15. Computer A Black Box attack in unprotected ATM cabinet Cash dispenser in reinforced safe Black Box connected Cable
16. A Black Box attack
17. Exit from Kiosk mode Exit from Kiosk online contest
18. The keyboard is the main tool when hacking an ATM main task
20. You can automate the search using Teensy Connect device Attacker device (HID emulator, keyboard) Exit kiosk mode Bypass or disable security Send command to cash dispenser to issue banknotes !
21. Privilege Escalation Outdated Software Vulnerable Windows Kernel Exploit for publicly known vulnerability can be developed 0-day exploit can be identified and developed Public exploit exists Vulnerable Application Exploit for publicly known vulnerability can be developed 0-day exploit can be identified and developed Public exploit exists
22. Access to Hard Drive
23. Access to Hard Drive Computer Hard drive External disk Bypass or disable security Direct connection to hard drive
24. Access to Hard Drive Connect external disk Connect to hard drive Access hard drive Start up from external disk Change BIOS boot order Write malware to hard drive Add malware to whitelist or disable security software Run malware Send command to cash dispenser to issue banknotes
25. Boot mode
26. Boot mode ! Star up debug mode Obtain control of ATM OS Exit kiosk mode Execute arbitrary commands Execute arbitrary commands Star up in Safe Mode Send command to cash dispenser to issue banknotes
27. ATM network attacks
28. ATM network attacks Ethernet cable Network devices Attack available network services Bank internal network Processing center Software update server Wi-Fi GSM Spoof or hack software update server Connect remotely to ATM Spoof processing center Attack network devices
29. ATM network attacks Connect processing center emulator Network equipment ATM sends request to confirm translation Real processing center does not receive the request Processing center ATM Processing center emulator
30. ATM network attacks ! Connect to network equipment Exploit vulnerabilities in available network services Bypass or disable security Send command to cash dispenser to issue banknotes
31. Card data theft Card reader Intercept data between card reader and ATM OS Card data Card data Processing center ATM OS Intercept data between ATM and processing center
32. Card data theft Connect to network equipment Access network traffic Intercept card data Attack network devices Attack network traffic
33. Card data theft Infect ATM with malware Install device between card reader and ATM computer Intercept data between card reader and ATM OS Install device between card reader and ATM OS
34. Other things ☺
35. DMA Attacks Victim Machine Data From Memory PCle Device A Complection TLP Attacker Machine Command Sent Memory Read Request TLP PCle Device A
36. DMA Attacks
37. Today we learned about security aspects of ATMs Now you know how attackers will act if they want to hack into your ATM machine And you know who to turn to if you want to conduct such testing by white-hat hackers Let's sum it up
38. Questions and Answers Everything you wanted to know about ATM security but were afraid to ask