Want to hack a hole-in-the-wall cash machine for free dosh? It's as easy as Windows XP

The ones not built into a wall are usually bolted to the floor. When it comes to access to compromise a machine I think the wall mounted units are actually more vulnerable as they usually have an enclosed backroom for access while filling the machine. The front is usually entirely sealed, but that backroom can be accessed by bribing the right sales clerk or shop owner, who probably also has access to the video recording equipment to accidentally switch it off or spill some coffee a day ahead of the attack. And once the attacker is in the backroom he is out of view and can do his nefarious deeds undisturbed. Hanging around in public is usually more visible. Though the blatant "put on a polo shirt with the banks logo, walk in and put up some barriers, open the machine and get to work" approach will probably also work. People are surprisingly unquestioning if you wear a correct looking outfit and act like what you are doing is completely normal.

You'll need access to the hardware in order to pick up the cash anyway so you'd be nearby regardless.

"we need to be physically near" isn't really a get out when these can be placed in quiet shopping centre areas, sides of petrol stations, closed back branches etc.

And they are probably NOT running Windows XP. Instead they are likely to be running Windows XP Embedded or Windows Embedded Standard 2009, which is still under extended support, and both of which have much less attack area than vanilla XP.

Came here to say the exact same thing. I'd expect that kind of cockup from the Daily Mail not El Reg...

XP Version

The NCR machine here at the Tesco Superstore up the road from the office, shows Windows XP Professional, copyright 1983-2001! When I took the picture of the machine last June, it was in a state of shutdown, but frozen up..

Whether embedded or not, to any customer who has been spoon fed the risks of staying with XP, it then doesn't look that brilliant..

all of the attacks mentioned require access to the hardware

A lot of attacks reported near where I live extract the machines with stolen diggers (So being near a building site immediatly increases the actual risk greatly), none with the explsoives have been used around here yet.

Not the network port attacks

All you need is physical access to the twisted pair connected to its port - if a convenience store had an ATM connected in that way it would probably be pretty easy - many of them will have wiring run in a suspended ceiling which would be trivial to access from a restroom.

Just cut the cable, attach connectors to both ends, and connect it to a wifi router with a battery. Then you can replace the ceiling tile, hack the ATM at your leisure from the parking lot over wifi, and when you are ready to trigger the "dispense all cash" command you have a couple conspirators go inside and distract the cashier so he isn't watching when the ATM spits out $10,000. They probably wouldn't figure it how it happened, so you'd be able to return later, swap the battery, and do it again!

Many ATMs use cellular, I wonder if the network port attacks could be done against that either by splicing into the antenna wire (since the antenna is often just sitting on top with a wire running inside the ATM) or by getting it to connect to a fake base station.

As far a I can see, all of the attacks mentioned require access to the hardware, so that immediately limits the actual risk of these exploits taking place.

What's more, getting at the hardware to hack it invariably means getting into the same security casing which protects the cash store. Who busts open a safe - effectively - and then spends ten minutes to an hour hacking the computer inside rather than simply removing the drawer full of cash and scarpering?

I can assure you from first hand experience that certain rather large banks are still running NT4 on ATM's let alone XP. OS/2 was prevalent until very recently!

But yes, the real issue is access in the first place. Prevent physical access and 99% of these attack vectors go away. The exception, and the far more plausible one, would be for someone with access other areas of a banks network to direct attacks to the ATM.

The inside job, supported by insider info is far more plausible a threat.

Will criminals actually bother with all this?

It's nice that someone's thinking about the IT side of ATM vulnerabilities, but i can't see criminals bothering with gaining physical access to LAN ports, etc and working out how to hack the machine to dispense the cash. They seem to have worked out quite serviceable low-tech methods of doing this already, using JCBs, gas canisters, or even just a Land Rover with a steel cable.

"As far a I can see, all of the attacks mentioned require access to the hardware, so that immediately limits the actual risk of these exploits taking place."

Go have a poke around the Deviant Ollams YouTube channel, here's a good start https://www.youtube.com/watch?v=a9b9IYqsb_U&t=31s .

He, convincingly, demonstrates just how many things that should be kept secure are not - often laughably so. Here he is opening a banks vestibule door with a mouthful of whiskey https://www.youtube.com/watch?v=SDl4AO4ancI

So just cover the camera and use the manufacturer key\spend 20 seconds picking the lock and you have access to the hardware. Do this late at night and there's a pretty good chance you'll be undisturbed for 10 minutes.

Or get a job repairing the ATM's. The companies that normally do this don't seem to give a shit. Like a past friend I knew had to go to a none working ATM for a fix. When he got there is was all taped off with police as it had been raided. Calling back to base to inform said knob head boss he was told "I don't care if the police are there, go and fix it.".

Re: Physical access is quite easy

Amazing what a Hi-Vis vest can do.

There are numerous studies about how if you look like you know what you're doing you're very unlikely to be challenged. Milgram is a good (and scary!) starting point on this.

Re: Physical access is quite easy

"Amazing what a Hi-Vis vest can do."

Indeed. Add a hard hat, white van, well-used tool belt and a clipboard and you can get away with almost anything.

Re: Physical access is quite easy

At Josco, re: a HighViz Vest.

Back when I used to be a YardDuty & Crossing Guard at my son's elementary school, I wore a HVV as part of safety. I already had one of my own, but the school provided one as well.

I was coming home one early evening when an accident happened to some cars ahead of me on the motorway. Viz was shite, a fog was building, & I feared that other drivers might worsen the situation by adding themselves to the scene. So I pulled over into a nearby parking lot, put on my HVV, grabbed my (6 D cell) MagLite, & walked to the accident scene. I started directing traffic around the scene, just one arm pointed into the parking lot & the other waving the flashlight in a "Go that way" fashion, & traffic started to do as I directed. I kept it up until an actual policeman showed up & thanked me for the assist. As I tipped my hat & was about to leave he asked me what department I was with.

"I'm not. I'm a civilian. I just didn't want your job to get any harder before you got here."

Long story short, he ended up buying me a pint in gratitude & I wound up joining the Policeman's Bowling League... All because I owned a HVV & used it to good intent.

You can do very good & very bad things with a HVV, a clipboard, & a flashlight. If you have a HVV hard hat & a fat walkie talkie (so you look like a construction site foreman) then you can REALLY make things happen. It's all in what you intend & how you go about it.

Re: Physical access is quite easy

Amazing what a Hi-Vis vest can do

Many years ago I routinely used a white lab coat to access Universities, Hospitals, and Research labs - never had a single problem.

There's nothing special about Lincolnshire. It's basically your good old fashioned ram-raiding.

Round my parts they prefer Landies and JCBs to smash the wall or the front door, then a Subaru to scarper with it. Earlier in the year they hit three local Aldi's on three consecutive nights...

The other one I've heard is basically filling the machine with gas, although I don't recall if that's to use the gas pressure directly or to ignite it and blast the things open.