Author Topic: Windows-based cash machines 'easily hacked'  (Read 2983 times)

BigWarpGuy

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 649
    • View Profile
Windows-based cash machines 'easily hacked'
« on: 2008.03.05, 16:02:50 »
http://news.zdnet.com/2100-1009_22-6233030.html
"Security experts have hacked ATMs to show how easy it is to steal money and bank account details from modern cash machines. "

IMO; I think they should go back to using OS/2. I would feel safer.  8)

warpcafe

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 746
  • Failure is not an option.
    • View Profile
Re: Windows-based cash machines 'easily hacked'
« Reply #1 on: 2008.03.06, 10:41:22 »
Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas
"It is not worth an intelligent man's time to be in the majority.
By definition, there are already enough people to do that"
- G.H. Hardy

RobertM

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 2034
    • View Profile
    • A.I.BuiltPC - using OS/2 Warp Server & eComStation for Custom Web and Database Solutions
Re: Windows-based cash machines 'easily hacked'
« Reply #2 on: 2008.03.06, 18:39:53 »
Well, there were other issues they noted as well - but the article, even with the pro-OS/2 paragraph, seems to have glossed over them and focused on the things that are not Windows or new software related. The other stuff that they didnt spend as much time on were the worms that infiltrated the ATM network through Windows machines (through exploits in Windows) and the fact that the new setup uses apparently no encryption making it very easy to use a packet sniffer to read a customer's data (with the exception of the PIN number - which is the only thing encrypted).

-R
|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|


Robert Deed

  • Full Member
  • ***
  • Posts: 194
    • View Profile
    • Rob's Space
Re: Windows-based cash machines 'easily hacked'
« Reply #3 on: 2008.03.06, 23:53:29 »
OS/2 ATM machines were very rarely externally accessible, most were not even communicating on TCP/IP.  When they started switching them over to tcpip they usually used something similar to injoy firewall in order to keep them secure.

Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas

RobertM

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 2034
    • View Profile
    • A.I.BuiltPC - using OS/2 Warp Server & eComStation for Custom Web and Database Solutions
Re: Windows-based cash machines 'easily hacked'
« Reply #4 on: 2008.03.07, 04:35:43 »
Yeah, they used to use CM/2... but no, they did become externally accessible when many were moved onto the Internet - they were just secured (network wise) better - something the new ATMs apparently arent.

OS/2 ATM machines were very rarely externally accessible, most were not even communicating on TCP/IP.  When they started switching them over to tcpip they usually used something similar to injoy firewall in order to keep them secure.

Hi,

well... reading through this article I must admit that what they call "hacked" does not exactly match what we think about when someone says "hack"... you see: Breaking up the cash compartment -even if by simple means- has nothing to do with OS security.
Sniffing on the traffic with whatever device does not mean "hacking" to me either - moreover, it has nothing to do with this-OS-is-better-than-that... they are all just as good as you make them. If the traffic is not encrypted, even "hacking" an OS/2 ATM is simple to put it that way.

What I would have expected from the headline is that somebody was able to load a spyware of keylogger piece of software onto the ATM or hack it via its IP adress over the network, injecting pieces of data and make it dispense dollar bills. THAT's what I call "hacking an ATM". And that was not done.

regards,
Thomas
|
|
Kirk's 5 Year Mission Continues at:
Star Trek New Voyages
|
|