When I was working with Richard K we had some pen testers give a talk on how they discovered how to program a smart card to compromise a mobile payment terminal. They demonstrated this by making the payment terminal play space invaders when the card was inserted.
So it's not beyond imagination that a doctored smart card connected to a Raspberry Pi could exploit a vulnerability in an ATM. It them may have been possible to dispense cash without debiting their own accounts.
----druck
There are several ATM manufacturers, and anyway the models I worked on in the late '80s and '90s are quite unlikely to be around now. I forget who made the ATM varieties I was familiar with or what, if any OS, their FSMs or equivalent ran on: its quite likely that some ATM makes and models ran under Windows.
Similarly, the ATM network management server which interfaced the financial system to the ATM network and managed ATM states did the same: this was the software I mostly worked on in the '90s. It ran on NCR's Intel 386 boxes under their proprietary UNIX flavour.
Most of the ATM management and interfacing software was C code though some chunks of that was written in MicroFocus COBOL. These ATM networks were often quite small, with the financial software written in RPG3 (UGH!!) and running on IBM AS/400 midrange kit: I liked the AS/400s despite the RPG3. They were dead reliable and OS/400 had a really nice scripting language, they though the standard text editor was surprisingly agricultural: the current Linux editors (I mainly use gedit and sometimes vi) are far more polished editing tools.
Sure. I haven't touched any of that stuff since 2000, and as I said, even then I was more concerned with the software managing the ATM network and interfacing it to the financial system it was front ending. Thats where virtually all the client-specific custom code was situated.
I like these pen testers, the ones I've known are much less fun they'd have just had it display "Penetrated" or some such boring result.
Its more legal than that. Some years ago I was burgled, and they caught the guys. For my burglary, it was 'breaking and entering' and 'theft' but when they did the same to a young woman with a child on the premises that they didn't know about, the policewoman in charge of my part of the case wet her pants 'that's robbery with violence - 8 year stretch!'
They’ve been using general-purpose operating systems for a very long time; I remember one displaying an OS/2 error screen in the mid 1990s.
I think you might be describing the 80s kind which had a 2 line text display (VFD?), whereas everything since has had a CRT or LCD and needed a 'computer' to drive it, and that computer ran some kind of OS (from DOS upwards).
The old type being this kind of thing:
I don't recall supporting any ATM that primitive or any with IBM stamped on them. AFAICR they looked remarkably like the ones you currently find at the front of Sainsbury's and other UK supermarkets, but with rectangular monochrome screens. I can't remember who made them or who supplied the ATM network management software we were customising except that it came from Texas and most of the ATM networks used X.25 protocols.
NCR
The one that rebooted on me and displayed a Windows screen did so maybe a year ago. If it mentioned what version of Windows, I don't recall.
Have something to add? Share your thoughts — no account required.
Ask the community — no account required