![\"user-pic\"](\"/css/images/default.gif\")
I just can't figure out why ATMs run on Windows.
But: I don't think the CSC code is on the mag strip, and I doubt that the ATM OCRs the code.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-681073-100x100.png\")
@brianary: Yeah, really, one late night I pulled up to my ATM to find the screen looking a lot like a windows desktop... I went to the start menu and pulled up the shut down and restart option... but not after I checked to see if it had solitaire installed, haha, it did.
@brianary: Yes, this seems very bogus. NCR ATMs send the card number and PIN up to the host encrypted. Only the last 4 digits are stored in the ATM logs. Some banks do have a card which will send the ATM into a supervisor mode (but only a few do this, and you need a PIN to get into supervisor using the card). And once in supervisor you have NO access to any of the previous user's personal data. Essentialy just ATM maintenance functions, changing settings etc. The worst you could do is change the value of the cash cartridges but that rips the bank off not the people who have visited the ATM.
Remember how old Windows 3.1 ran on top of MS DOS? That's how most atm software runs. There is a layer above Windows XP that operates the encoding, the mechanical, diagnostic and financial portions. Older atms made by Diebold, Fujitsu and NCR still run OS/2. I've reloaded quite a few. The reference made about inserting a card and triggering a program to run is certainly true. When a bank employee needs to balance or replenish the cash they will use a 'balance card'. When this card is read it tells the machine to run a different set of menus that allow much more access to records of that machine. So it seems logical that a piece of malware logging the codes could be triggered to print them out. But you would need access to the os from the inside or on the network [many are still dial-up] to install the malware AND you have to get your hands on a balance card and rewrite it with the correct sequence. These card also require a PIN. Also, I have never seen an atm that can 'eject its banknote storage cassette out into the street'. One, they're in a safe and two, you have to actually push them into place and lock them down. BTW - Only your PIN is encrypted when it goes over the network. The info from the mag strip is not.
@IISaiNtII: Um, this was not always the case for highly-specialized systems like ATMs. I'd just like to know why the switch was made. What was the upside?
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-207120-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-7101-100x100.png\")
@cristiana: But it doesn't matter what OS you're running if someone gains physical access to your machine to make changes. All that changes is the method of obfuscation - and it's easy to come up with all kinds of neat stuff when you're given high-level privileges from the inside. Then again, I hope you already realised that, given how you mention 'high-security' distros.
Also, LINUX. IS. NOT. FREE. I'm not even referring to the time=money bit - Linux IS open-source, but no matter how you cut it you're going to be paying: to have it modified and packaged for your ATM, for full institutional-level support for any issues and the training involved, and any other cost you'd regularly get with a program except the licensing fee.
@ZekeSulastin: And you don't have to do any of this for Windows?
I'm just not sure I need my ATM to include the latest Windows Media Player exploits, Notepad, Solitaire, &c.
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-456956-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-890779-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-68654-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-568700-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-488475-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-436259-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-505958-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-18555-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-112280-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-219008-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-44075-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-1155249-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-186777-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-335709-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-363338-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-53958-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-180171-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-81006-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-21984-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-107016-100x100.png\")
![\"user-pic\"](\"/mt-static/support/assets_c/userpics/userpic-99768-100x100.png\")
![\"user-pic\"](\"http://consumerist.com/assets_c/userpics/userpic-10572-100x100.png\")
I would like to see an ATM running Mac OS X, even if it's just a hackintosh. I imagine it would exceed most current standards for ATM security.
@Nick1693: I nominate that they run Linux on the slowest and most esoteric hardware that can get the job done, and only have one service port deep inside the machine that would require a key to get into. No programs on the cards, of course, and definitely no access to any network but the banking network, and only for pulling information on customer's balances. Software updates must be done in person by an employee.
This would mean the hacker would have to have written the software efficiently, more or less on their own, and have a job at the bank that merits direct access to the service port at the ATM.
@Nick1693: yeah OS X isn't that secure. I remember reading at a hacker convention not so long ago the Mac book air was hacked wirelessly in under 5 mins.
@Nick1693: \"It’s really simple. Safari on the Mac is easier to exploit. The things that Windows do to make it harder (for an exploit to work), Macs don’t do. Hacking into Macs is so much easier. You don’t have to jump through hoops and deal with all the anti-exploit mitigations you’d find in Windows.
It’s more about the operating system than the (target) program. Firefox on Mac is pretty easy too. The underlying OS doesn’t have anti-exploit stuff built into it.\" -Charlie Miller, hacker, on his Pwn2Own competition OSX Safari 4 exploit.
http://blogs.zdnet.com/security/?p=2941
@Nick1693:
hey guyz did you knows that da apple is unhackable!?
stevie jobyjob told me so!
@Nick1693: And yet instead of embracing a new market for their software, Apple would probably sue the hell out of Diebold and whoever else tried to do that...
@Nick1693: Seeing as how this has to start from someone with access inside the bank, it wouldn't matter much whether it was a Mac or not.
Well, with a Mac based system, you'd get to hear this as your card info was stolen.
@Nick1693: A platform is only as locked down as the person who set it up. Even with OSX, you can easily run a keylogger or one of these programs. Here it's not the OS in use, but how it's setup.