OS2World OLD-STATIC-BACKUP Forum

Public Discussions => Off Topic discussions => Topic started by: BigWarpGuy on 2008.03.05, 16:02:50

Title: Windows-based cash machines 'easily hacked'
Post by: BigWarpGuy on 2008.03.05, 16:02:50
http://news.zdnet.com/2100-1009_22-6233030.html (http://news.zdnet.com/2100-1009_22-6233030.html)
"Security experts have hacked ATMs to show how easy it is to steal money and bank account details from modern cash machines. "

IMO; I think they should go back to using OS/2. I would feel safer.  8)
Title: Re: Windows-based cash machines 'easily hacked'
Post by: warpcafe on 2008.03.06, 10:41:22
Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas
Title: Re: Windows-based cash machines 'easily hacked'
Post by: RobertM on 2008.03.06, 18:39:53
Well, there were other issues they noted as well - but the article, even with the pro-OS/2 paragraph, seems to have glossed over them and focused on the things that are not Windows or new software related. The other stuff that they didnt spend as much time on were the worms that infiltrated the ATM network through Windows machines (through exploits in Windows) and the fact that the new setup uses apparently no encryption making it very easy to use a packet sniffer to read a customer's data (with the exception of the PIN number - which is the only thing encrypted).

-R
Title: Re: Windows-based cash machines 'easily hacked'
Post by: Robert Deed on 2008.03.06, 23:53:29
OS/2 ATM machines were very rarely externally accessible, most were not even communicating on TCP/IP.  When they started switching them over to tcpip they usually used something similar to injoy firewall in order to keep them secure.

Quote from: warpcafe on 2008.03.06, 10:41:22
Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas
Title: Re: Windows-based cash machines 'easily hacked'
Post by: RobertM on 2008.03.07, 04:35:43
Yeah, they used to use CM/2... but no, they did become externally accessible when many were moved onto the Internet - they were just secured (network wise) better - something the new ATMs apparently arent.

Quote from: Robert Deed on 2008.03.06, 23:53:29
OS/2 ATM machines were very rarely externally accessible, most were not even communicating on TCP/IP.  When they started switching them over to tcpip they usually used something similar to injoy firewall in order to keep them secure.

Quote from: warpcafe on 2008.03.06, 10:41:22
Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas