Erik Van Buggenhout Royal Holloway, University of London Distance - - PowerPoint PPT Presentation

▶
erik van buggenhout royal holloway university of london
SMART_READER_LITE
LIVE PREVIEW

Erik Van Buggenhout Royal Holloway, University of London Distance - - PowerPoint PPT Presentation

Aug 19, 2023 247 likes •1.02k views

Erik Van Buggenhout Royal Holloway, University of London Distance Learning Conference 2014 Information Security Consultant Instructor Incident Response, Penetration Testing SEC 560 & 542 Royal Holloway, University of London Project: ATM

slide-1
SLIDE 1

Erik Van Buggenhout Royal Holloway, University of London Distance Learning Conference 2014

slide-2
SLIDE 2

Information Security Consultant Incident Response, Penetration Testing Instructor SEC 560 & 542 Royal Holloway, University of London Project: ATM Security assessment framework

slide-3
SLIDE 3

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-4
SLIDE 4

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-5
SLIDE 5

§ “A security assessment framework for Automated

Teller Machines”

§ Finished it this year (2014) § Supervisor: Frederik Mennes

slide-6
SLIDE 6
slide-7
SLIDE 7

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-8
SLIDE 8

§ Automated Teller Machine § Cash disposing & dispensing § 2.2 million devices worldwide § Different hardware & software vendors

slide-9
SLIDE 9

The first ATM was installed in 1939 in New York City, known as “Bankograph”. Removed after 6 months because it was not used J It was reintroduced in Ohio in 1959, with huge success. There are currently more then 2.2 million ATM’s worldwide.

slide-10
SLIDE 10

PIN validation Account balance Transfer / withdrawal authorization ...

The ATM is a “stupid” device, part of the bank’s overall architecture. It relies on back-end services for “important” decisions.

slide-11
SLIDE 11
  • 1. ATM computer
  • 2. (Touch)screen
  • 3. Card-reader
  • 4. PIN pad
  • 5. Cash dispenser
  • 6. Cash cassettes

Typical lay-out of a modern ATM

slide-12
SLIDE 12
  • 1. ATM computer
  • 2. (Touch)screen
  • 3. Card-reader
  • 4. PIN pad
  • 5. Cash dispenser
  • 6. Cash cassettes
slide-13
SLIDE 13
  • 1. ATM computer
  • 2. (Touch)screen
  • 3. Card-reader
  • 4. PIN pad
  • 5. Cash dispenser
  • 6. Cash cassettes
slide-14
SLIDE 14
  • 1. ATM computer
  • 2. (Touch)screen
  • 3. Card-reader
  • 4. PIN pad
  • 5. Cash dispenser
  • 6. Cash cassettes

CD / DVD CD / DVD Disk bays Disk bays Auxiliary ports USB

slide-15
SLIDE 15

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-16
SLIDE 16
slide-17
SLIDE 17

It stores MONEY

Handles interesting customer data as well, which could be abused to get MORE MONEY

slide-18
SLIDE 18

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-19
SLIDE 19

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-20
SLIDE 20

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-21
SLIDE 21

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-22
SLIDE 22

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-23
SLIDE 23

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-24
SLIDE 24
slide-25
SLIDE 25

Safe certification standards, bolts, video surveillance...

slide-26
SLIDE 26

Ink cartridges that stain money upon breach

slide-27
SLIDE 27

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-28
SLIDE 28

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-29
SLIDE 29

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-30
SLIDE 30

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-31
SLIDE 31

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-32
SLIDE 32

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-33
SLIDE 33

Anti-skimming devices

slide-34
SLIDE 34

Security awareness campaigns

slide-35
SLIDE 35

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-36
SLIDE 36

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-37
SLIDE 37

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-38
SLIDE 38

Awareness + force change of default passwords

slide-39
SLIDE 39

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-40
SLIDE 40

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-41
SLIDE 41

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ...

slide-42
SLIDE 42

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ... Barnaby Jack “Jackpotting ATMs” - 2010

slide-43
SLIDE 43

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ... Network access?

slide-44
SLIDE 44

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ... Network access? Shodan HQ (Internet search engine) lists 800+ ATMs available on the Internet

slide-45
SLIDE 45

Blow up the safe Copy cards & steal PIN codes Steal the entire thing Attack back-end communication Attack the OS Access “operator” mode ... CCC 2013 “Electronic bank robberies” Boot ATMs from USB

slide-46
SLIDE 46

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-47
SLIDE 47

CEN/XFS (eXtensions for Financial Services) provides a standard set

  • f APIs that can be

used by Windows applications to operate the ATM peripherals

slide-48
SLIDE 48

XFS Manager Windows-based application XFS APIs XFS SPIs XFS Service Providers ATM peripheral Vendor Dependent Vendor Independent Operating System

CEN/XFS (eXtensions for Financial Services) provides a standard set

  • f APIs that can be

used by Windows applications to operate the ATM peripherals

slide-49
SLIDE 49

95% of ATMs was running Windows XP in January 2014

(NCR, 2014)

slide-50
SLIDE 50

“How will you approach the Windows XP end-of-support?”

(KAL 2013 – ATM Software Trends & Analysis)

slide-51
SLIDE 51

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-52
SLIDE 52
slide-53
SLIDE 53
slide-54
SLIDE 54
slide-55
SLIDE 55
slide-56
SLIDE 56
slide-57
SLIDE 57
slide-58
SLIDE 58
slide-59
SLIDE 59
slide-60
SLIDE 60
slide-61
SLIDE 61
slide-62
SLIDE 62

Attack failed

slide-63
SLIDE 63

Using openly available forensic toolkits we managed to recover the majority of the original hard disk content.

slide-64
SLIDE 64

Sweet... But I don’t have a bank back-end (yet)

slide-65
SLIDE 65
slide-66
SLIDE 66
slide-67
SLIDE 67
slide-68
SLIDE 68

WFSOpen("CurrencyDispenser1", WFS_DEFAULT_HAPP , "NVISOSPIT", WFS_TRACE_NONE, WFS_INDEFINITE_WAIT , 0x0000FFFF , &serviceVersion, &spiVersion, &service); WFSCDMDISPENSE tDispense; WFSCDMDENOMINATION tDenomination; Set up XFS session with the “CurrencyDispenser1”, no logging is required J Create a dispense object “tDispense” Create a denomination

  • bject “tDenomination”
slide-69
SLIDE 69

tDispense.fwPosition =WFS_CDM_POSNULL; tDenomination.cCurrencyID[0]='E'; tDenomination.cCurrencyID[1]='U'; tDenomination.cCurrencyID[2]='R'; tDenomination.ulAmount=nviso_amount; tDenomination.usCount=5; tDenomination.ulCashBox=0; ulaValues[0] =nviso_cassette1; ulaValues[1] =nviso_cassette2; ulaValues[2] =0; ulaValues[3] =0; ulaValues[4] =0; €€€ I want “EUR” J The amount is specified dynamically by a command line argument Specify how many notes you want per cassette

slide-70
SLIDE 70

tDenomination.lpulValues = ulaValues; tDispense.lpDenomination= &tDenomination; HRESULT hResult = WFSExecute(service,WFS_CMD_CDM_DISPENSE,&tDispense,WFS_INDEFINIT E_WAIT ,&lpResult); Load the dispense with the specified denomination & execute the dispense operation

slide-71
SLIDE 71
slide-72
SLIDE 72

TODO: Make it generic for different ATM devices (read custom config from registry J)

slide-73
SLIDE 73

DEMONSTRATION

slide-74
SLIDE 74

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

slide-75
SLIDE 75

Modern ATMs are standard, Windows-based, computers full of money ATM software is developed according to open standards Highly interesting target, protection is required! Application whitelisting Network segmentation Disk encryption Protect the BIOS Patch management