ATMs Susceptible to Windows Viruses 403
Kernkraft400 writes "First there was Windows for Warships, now the same operating system used to power millions of home PCs is likely to be used for cash machines in the UK. I can't wait for the next Windows virus or worm to take down all the cash machines."
This story is missing something (Score:5, Informative)
Re:This story is missing something (Score:5, Funny)
Windows is actually just a ploy by Symantec to make money. Makes sense to me.
Re:This story is missing something (Score:2, Funny)
Re:This story is missing something (Score:2)
So yeah, I'm scared. I ought to send an invoice to Microsoft for my time...
Re:This story is missing something (Score:3, Insightful)
No virus problems. No spyware problems.
I believe the GNOME or KDE desktop is the perfect choice for absolutely computer illiterate relatives who want to surf the web, read mail and play the occasional game (my father even mentioned the best thing he liked about Linux was all the games - I didn't even knew they came with the installation!
Why? Because they can't screw something up tha
Re:This story is missing something (Score:5, Informative)
Re:This story is missing something (Score:5, Funny)
Diebold makes lousy everything.
Re:This story is missing something (Score:5, Informative)
The ATMs should be running a custom application to drive the user interface which just pipes its data over an encrypted byte-stream protocol (maybe SSH, maybe something else, I don't know) to a central authorisation server. It should be able to accept a 'status query' request from a machine located in the branch that periodically checks that the ATMs are running and still have cash. These are the only services that are required. Everything else should be disabled. Everything else should be firewalled.
As long as banks follow these security precautions (and I've worked at a UK bank before now -- they're pretty hot on security, as a rule) they should not be susceptible to virus/worm infection, except by a custom-written worm that exploits security flaws in the custom ATM software... and at this point it doesn't matter what OS you're using.
Re:This story is missing something (Score:4, Insightful)
Ummmm....actually that's not the problem.
Mission-critical apps should not be run on crappy, not-meant-for-that-purpose software. It's not a question of how many firewalls you use. ATMs should NOT run windows.
Firewalls are not a "magic fix" for shitty design. Hell the company I work at has a good firewall and they get viruses all the time. A firewall should be a "just in case" security measure, especially for something THAT important.
We're talking about people's money here, it should take more than one guy plugging an infected laptop into the wrong ethernet jack to take it down.
Stuff like this demands a multi-tiered security approach. We're talking encryption of encrypted communications here (with different algorithms), and if they're going to send ANY of this across the internet they better do it right. Otherwise, guess where the next 0-day exploit is going to get tested first?
As long as banks follow these security precautions (and I've worked at a UK bank before now -- they're pretty hot on security, as a rule) they should not be susceptible to virus/worm infection,
Wrong. You can't turn off the ALL the OS services or your custom software can't communicate with anything else. You NEED at least some of the windows code running and that bit of code just may turn out to be the next target of the latest, greatest worm.
except by a custom-written worm that exploits security flaws in the custom ATM software... and at this point it doesn't matter what OS you're using.
Sure it does. A better OS is going to be harder to code an exploit for. What you're saying is that underlying system arcitecture doesn't matter. That's silly.
If it was my call, I would have two boxes running completely different software and hardware, designed by two completely independent teams. I would keep the existence of each team seperate from the other.
One box does the normal ATM stuff, on X86 hardware running something custom and minimalist, communication only via an RSA-encrypted data link.
The second box contains an OS-less processing unit whos purpose is two-fold:
This would make it much harder of a zero-day exploit OR a funamental math breakthrough to wreck the security AND harder for any of the programmers to leave themselves a little backdoor (Office Space).
Using a firewall in this application would be like using aluminum foil as a bullet-proof vest.
Re:This story is missing something (Score:3, Funny)
Re:This story is missing something (Score:3, Informative)
(Very) old news (Score:5, Insightful)
Windows has been used on (at least) Natwest ATM's for a loooong time - several years at least. I've been in several situations where an ATM is displaying a Blue Screen Of Death. Interestingly enough, they show a trend for solidarity in these matters, when one of set is down, they're all down... Presumably the weakness is in the network layer, or some component that is attached to it.
Not that this means too much (apart from the annoyance factor) though, I've never lost any money due to an ATM crash - I'm pretty sure the system is designed so that the central machine does all the secure stuff, with the ATM being not much more than a calculator keypad.
Simon
Re:(Very) old news (Score:2)
Checkout self checker (Score:2)
Re:Checkout self checker (Score:2)
Re:(Very) old news (Score:3, Funny)
Re:(Very) old news (Score:3, Informative)
Re:(Very) old news (Score:3, Insightful)
Re:(Very) old news (Score:3, Insightful)
I think the bigger issue here isn't that the ATM's run Windows, but that some are connected to networks that can be accessed from the Internet. Windows CAN be stable in certain situations (this ATM looked to be running NT 3.5 at a glance)... it's when you put it on a public network that it becomes a hazzard.
Re:(Very) old news (Score:5, Informative)
Actually, this is why "real" databases like Oracle & DB2 are used. They have that nifty little "commit" and "rollback" functionality (part of ACID) that makes it incredibly unlikely that even in the event of a major event at the client, you're not going to be fubar'ed. That, and true fault tolerance (you can throw the power on a working Oracle database, and 9 times out of ten, it'll be just fine when it comes back).
Already happened... (Score:5, Insightful)
Re:Already happened... (Score:2, Funny)
WTF? Where is the article? (Score:5, Insightful)
Now, ATMs running Windows could very well be susceptible to viruses, but something backing that up would be nice.
Re:WTF? Where is the article? (Score:2, Redundant)
Re:WTF? Where is the article? (Score:3, Interesting)
I perform certification testing for a large transaction processor, so I have seen most of the ATMs that are in use in the US today. The first Windows based ATM that we saw arrived in 2000, and ran Win98. You had to reboot it every 3 days or it would lock up. Had cool videos running on it, though
Since then, abo
Misleading Title (Score:5, Insightful)
Citibank (Score:2, Insightful)
In unison now - WTFA? (Score:2)
We'll see... (Score:3, Insightful)
Colchester Town Centre (Score:2, Interesting)
I walk up to the machine to get some cash out, only to be confronted by a Windows 9x dialogue box. The cash machine was on a desktop screen, with a dialogue up on the screen.
It's a joke, seriously.
What Virus? (Score:5, Insightful)
Re:What Virus? (Score:4, Informative)
Re:What Virus? (Score:2)
Re:What Virus? (Score:2)
Wait until Hollywood gets ahold of THIS idea. (Score:3, Funny)
Windows for Warships Features? (Score:2, Funny)
Re:Windows for Warships Features? (Score:2, Funny)
Party Like Its 1999999999 (Score:2, Funny)
YAY
I don't understand (Score:2, Insightful)
Re:I don't understand (Score:4, Insightful)
Banks have used various flavours of windows for years on their ATMs without any major issues. If the ATM network gets compromised it really doesnt matter what OS is running. Its never going to be the end of the world because they are little more than dumb terminals.
And now for the even better stuff. Many aircraft run embedded NT as well in the flight control instrumentation. I suppose we had all better stop flying now. Medical devices have it so I suppose we should refuse medical treatment. Stores use it in POS so that rules out shopping. Microsoft are all over the place and you dont even know it, and strangly enough the world has not actually ground to a halt yet.
Re:I don't understand (Score:4, Informative)
About 20% of ATMs world-wide run Windows. Banks are slow to migrate because of the cost. But the OS/2 systems out there are getting really, really old. Regulators want better encryption, audio support. IT wants TCP/IP. Marketing wants check recognition, targeted adds. You get the idea.
70% of ATMS purchased by banks in 2004 will run Windows, up from 10% in 2001. Minimum specs for a new ATM, a P III or faster processor, with 256 MB RAM and an NIC. Investing in the ATM channel [atmmarketplace.com]
I'm buying more MS stuff (Score:2)
Critical Software Choices (Score:5, Insightful)
In order to (1) catch up with a competitor or perhaps (2) get an "easier" development environment [easier being defined as one where the programmers are commodity and the system doesn't require buidling graphical components from scratch], 'easy' choices are made.
In the end, the bank isn't doing the development, but purchasing a final product... there are tons of variables to an ATM beyond the underlying OS; and honestly, not all that many large vendors to choose from (and a large bank will almost never choose a small vendor, over concerns for longevity and support). Microsoft has made a major push for Windows in many places and makes it as easy as possible for people in different markets to use their OS. It is really the responsibility of the purchasing organization (in the case of an ATM, the bank or credit union) to choose a good solution. But it's a painful balancing act.
By the way, if you really want to be disturbed by how liability for bad software isn't an issue, think about this: the US Federal Aviation Administration requires that every component put into an aircraft must not fail during the life of the aircraft. The next sentence then exempts software from this limitation.
Remote exploits, not viruses (Score:5, Insightful)
No OS is completely bug free and secure for ever. If the network the ATM's connect to is safe, the box should be safe. If they connect to the internet, I'm moving my money to another bank, no matter what OS they run!
Surur
Re:Remote exploits, not viruses (Score:4, Funny)
Memories (Score:5, Funny)
Virus != BSOD (Score:2)
Dame you Diebold! Dame you all to hell! (Score:5, Interesting)
Re:Dame you Diebold! Dame you all to hell! (Score:2)
Wells Fargo and Diebold 2 years ago. . . (Score:5, Informative)
Of course, I went to a few of the ATMs I used and checked them out. All Diebolds. I'm not sure if they were running Windows, but I can assume so. Why would the bank give me such a hard time about who supplied their ATMs? Obviously it wasn't that difficult to just go and find out. It makes me a bit weary that they're trying to implement security through secrecy (let alone secrecy that's not that secret). Plus, being a customer I feel like I have the right to know how my money is handled and what possibilities there are for it being stolen.
Re:Wells Fargo and Diebold 2 years ago. . . (Score:2)
what's next... (Score:2, Interesting)
A fool and his money (Score:2)
The one thing that MS will find different here is that if they actually cost the banks money due to some stupid vulnerability, the banks are quite likely to take it seriously, and do something. Most MS customers don't.
National City Bank (Score:2, Interesting)
I'd prefer a much more specific, secure system. Linux would be "OK", but actually I'd prefer something that is much more secure than that, or maybe a linux/unix flavor that aims for security above all else (inlcluding ease of use).
We're talking about our money,
Banks and networks (Score:4, Insightful)
The best way to secure these things is to make sure that the only physical connection from the ATM is to a well secured computer under controlled by the bank.
Re:Banks and networks (Score:3, Interesting)
Then the network needs to be changed. What are those systems doing on the same network as the ATMs?
If somebody brings in a MS laptop and plugs in to the network, it can then transfer.
And then you fire them for gross incompetence.
It really is that simple. At work, we have access to a secure government hosting network. There are two (2) machines in the building that can access it. They are locked in a room with swipe card and PIN access, and they a
ATMs on the Internet (Score:2)
What is the real problem? (Score:2, Interesting)
The fact that they run Windows and are open to attack or whether or not someone has access to your money? For me it's the latter. How they implement access to my money doesn't really concern me unless my account is not protected. If someone uses their equipment to access my acount without my authorization, then they are responsible for making restitution. If I have problems accessing my account I can vote with my money and move it to another bank.
Me thinks that the average Slashdotter is a little to c
Because IBM's dropping support ... (Score:5, Informative)
Not for OS/2 Warp 4 (That's supported through 2006 at least), but for the earlier releases (3, 2.x, 1.x)...
I believe that most ATM's were based on either OS/2 1.3 or 2.0.
Why we're replacing them with something that is vulnerable to the virus-of-the-week, who knows?
When was the last time you saw an OS/2 virus?
Hmm..... "Duh?" (Score:2)
All I can say is that if banks are going to go the tried and true route of using Windows as their ATM operatin system despite the fact that it has been hit reapeatedly by virii through LAN/WAN/Internet access and internal mail virii, then they deserve what they end up getting as a result. Be it often crashing ATM systems or loss of money because said machines decided it was time to release some swelling belly of money thanks to some virii/worm/trojan/etc.
There really is only one good reason why the banks w
Oh well. (Score:3, Funny)
Happens all the time. (Score:3, Informative)
Windows ATMs have been everywhere for awhile -- the days of OS/2 cash machines being the only story in town are long gone.
Nothing to see here, move along.
Is this new? (Score:2, Interesting)
At one point in time i was lucky enough to be in a store where someone had dialed in and you could watch them working within windows on the screen, the technician realized this at some point and clicked a button which changed the screen on the atm to a label indicating the system was being servic
Why any OS at all? (Score:2, Insightful)
OK, I guess maybe its just cheaper to use something that already exists (windows).
A more important, but related question: Why the hell do the diebold voting machines use w
Windows ATMs in europe crash with US cards (Score:5, Interesting)
Aparently they dont like the way my card is encoded.
It was very annoying trying to find a bank where I could withdraw money from. At one point we we're joking around to see how many ATMs we could crash in one day.
OpenSource ATM Software? (Score:3, Informative)
Maybe it is worth looking into for others.
ATMs and modern OSes (Score:4, Insightful)
It needs:
A card reader.
A cash dispenser.
A video display.
A keyboard input.
A communications channel to HQ.
A printer.
Most run "semi-locally" rather than as completely-dumb terminals.
Most have an "administrator mode" and keep additional local state. For example, they know how much of what kinds of bills they have left.
Most have security cameras, but these need not be "logically" part of the ATM, they can be standalone devices.
Banks have used full-featured ATMs for years. In the early-mid 1990s, OS/2 was the major player. These days it's MS-Windows. 10 years from now, it will probably be something else.
The key security issues with ATMs are:
1) physical security and local encryption of sensitive data in case physical security is compromised, e.g. someone steals the whole ATM.
2) network security - all communications are encrypted
3) isolated network - no direct access to or from the Internet
4) audit trail, e.g. local encrypted recording of all transactions, preferably to write-once media.
I'm sure I left out some things. Please feel free to add.
So, anyone know of any in-use Linux-based ATMs? Even better, anyone know of any totally-Free-and-open-source-software ATMs?
No problem at all (Score:3, Informative)
Yes, the ATMs run Windows software without the varrios patches (Most NT4.0 Sp6, but those are being upgraded to 2k), but some machines (30%) also run OS2 (NCR machines) but those are being upgraded to 2Kd too. The older machines (not few) still runs DOS6.22
About the virus/BSOD, i know they are anoyng, but dont represent great security risks. See, the ATM network are proprietary, closed, constantly monitored and dont have access to internet.
IF, the ATM get some virus, the virus cant do much, no virus has WOSA/XFS (CERN-MS ATM API) commands implemented to do something usefull (Money withdraw?).
There are some banks that are migrating to linux, but the lack of standard API (WOSA/FXS-like) are a trouble. And the banks like to have someone to blame in some serious problem (MSFT!)
Sorry for the poor engrish.
My 0.02c
Just look at what the Diebold down the road did... (Score:3, Informative)
Confidence inspiring++
Slashdot article misses the point (Score:3, Interesting)
It's bound to happen (Score:5, Informative)
-nB
Re:It's bound to happen (Score:5, Insightful)
Remember, they hadn't moved everything into the kernel yet. Even GDI and video drivers were userland. And, of course, they hadn't yet "integrated" Insecure Exploder into the system either, I don't even think IE existed then (NT4 shipped with IE2).
Re:It's bound to happen (Score:5, Informative)
Yes it did, and in fact I still used it personally for a very important server for quite a while. The point is that there are a ton of exploits available even from a user level. The best part about this ATM was the existance of a floppy drive and keyboard&mouse port behind a relatively flimsy lock and piece of sheetmetal on the service hatch (not the money side of the box). Though I never got a chance to sit down and have a chat with this machine, just think what someone could have done if they had long duration access (say working the night shift)?
-nB
Re:It's bound to happen (Score:5, Interesting)
Re:It's bound to happen (Score:2)
http://www.slothmud.org/~hayward/mic_humor/bill
http://www.flickr.com/photos/j
(etc)
Re:It's bound to happen (Score:2)
I've seen it personally. None of the keys on the ATM were mapped to 'return' so you were stuck with the message there.
(For those who don't read Swedish, it's an 'out of virtual memory' error, and that's Win95/98!!)
Re:It's bound to happen (Score:5, Funny)
But have you ever seen this lovely OS [195.38.3.142] on an ATM? I _ran_ for the camera when I passed that one in Karlskrona.
Re:It's bound to happen (Score:2)
Re:Try again (Score:3, Insightful)
wanker.
I'm an open source fan, but there's really no good done in gloating at failure of another, especially when it negatively impacts (random innocent) people's lives.
Also, I do run win2k, and keep it properly updated and configured. I've _never_ been the victim of a worm or a virus.
Re:Try again (Score:2)
Re: blaster and Canada? national bank.
-nB
Re:Try again (Score:2)
It would kind of suck for the ATM owner, bank, and network if this were to happen, but it wouldn't cause panic in the streets.
Re:Try again (Score:3, Insightful)
Mind you, apparently there are already plenty of Bank Terminals that use Windows out there, so it's not particularly interesting news.
Re:Try again (Score:3, Informative)
What an irresponsible thing to say.
MS Blaster (I think) did actually take down all of the Bank of America ATM's in Seattle, WA a while back.
Re:Try again (Score:5, Interesting)
Suppose there's a car with a numeric keypad on the door to unlock it (like the late 80's/early 90's Fords). Now suppose that it's common knowledge that the factory put in a backdoor code, 1357, which will unlock any such car. Despite this becoming common knowledge, and being stated all over the national news, the manufacturer refuses to remove the backdoor, saying it's so they can help the customers. Now I'm standing in my driveway talking to some friends, and my neighbor Joe pulls into his driveway, with his brand new car which has this keypad. So I say to my friends, "I can't wait until his car gets stolen. What an idiot."
Was that an irresponsible thing to say? I don't think so. Joe was stupid to buy such a car when it's common knowledge how easy it is to break into. Maybe if more people exercised peer pressure, and spoke their minds about others' stupid buying habits, people wouldn't continue to support companies that make bad or dangerous products.
If some bank gets ripped off because of their insecure ATMs, that's the bank's fault for choosing a poor piece of equipment, and they deserve to pay the price for that decision. And hopefully lots of customers will move their accounts to banks which use better ATMs.
Re:Well... (Score:3, Informative)
Oh, believe it. For example, the Wachovia machines at Penn Station in NYC are running some custom Win 3.1 implementation. I stood from a distance and watched the ATM repair man fix them once. He had to open them up, pull out some sort of mini keyboard (a la the same types you'll see to attach to a tablet PC) and boot that sucker into Win 3.1)
That being said, a lot of those Bank of America commercials you see now lauding all those great
Re:Well... (Score:2)
That being said:
WinXP Embedded ATM Home [microsoft.com]
Do a google search for "windows embedded ATM" and you'll find plenty of info, including machines made by our best friends Diebold that were infected by a worm this past summer!
Re:Well... (Score:4, Interesting)
Maybe not credit card, but smart cards.... Actually, the credit card reader is just a data input device, right? Maybe it would be possible to do a buffer-overrun attack on an ATM, unless the card reader hardware specifically limits the possible output data.
Re:Well... (Score:2)
Re:Huh? (Score:2, Informative)
Re:RTFA (Score:2)
The ones with the word "Diebold" on the front are all running Windows (95,NT, and XP depending on how old they are). When faced with such a system, put your ATM card back into your wallet and walk away.
Re:RTFA (Score:2)
Re:RTFA (Score:3, Informative)
Re:RTFA (Score:3, Informative)
I'm not arguing that they'd be better off installing gentoo or red hat on those machines, I'm just saying that it's the way it is.
Re:It's already happened (Score:3, Funny)
Re:First... (Score:2, Funny)
- - Install Windows on ATM machines
- -
....
- - Profit
I think step two is to write a virus which moves a couple fractions of a cent into your account anytime someone makes a transaction, ala Office Space!Re:...and this is news how? (Score:2)
Seriously, I don't like the new generation windows-based ATMs. And not because they're insecure, or because they crash. Because they're _slower_ than the old ones they're replacing. The only good thing about them is the nice big easy-to-read colour display. But have you noticed that with the old ones, you'd put your card in and it would _immediately_ ask you for your PIN. The new ones seem to stop, read the data from your card, send a request to
Re:seperate web? (Score:2)
I would say no, but I used to say you couldn't get a virus from an e-mail or a document, and MS proved me wrong on both counts. I just hope they aren't writing the ATM software as well as the OS it runs on...
Re:Been going on for a while (Score:2)
Re:Iressponsible Bastards (Score:2)
Happened to Coventry Building Society last year. They threatened legal action against customers who kept the additional money that the machines gave them by mistake.
Re:Why not use Linux? (Score:3, Funny)
Banking Industry: Stupid."
Let's think about that for a second....which group is holding all of your money again? So which group is smart now?