Security Review: Automated Teller Machine

By kurifodo at 10:07 pm on February 6, 2008Comments Off on Security Review: Automated Teller Machine

Summary:
Automated Teller Machines (ATMs) have been around since the late 1930s. Nowadays they can be found all over the place. The common and accepted use of these machines is to draw money from your bank account in a convenient and accurate manner. To do this, we typically insert a bank card into the machine with a magnetic strip encoded with our account information such as our name, our account number, a special PIN, and maybe another number or two for security depending on the card. Once we input our card, we must communicate with the machine through the display and keyboard interfaces. These are the only means of communication for normal transactions.

However, what are some of the other aspects of ATMs? The money is typically held in armored, metal drums these days with only one entry-exit point. Video footage of ATM use is recorded also these days in the event something does happen, so authorities will have more information at their disposable to react. Messages to and from Data Bank Centers are relayed via a network in order to confirm account details. The machine’s innards are encapsulated with layers of physical security such as an outer casing, the armored drum mentioned for the money, locks, and a series of sensors such as magnetic, seismic, and thermal.

Assets:

  •   The cash every ATM holds. I would have to venture to say this is the most common asset sought after by thieves of ATMs.
  • ATM components such as card reader, CPU, sensors, etc. These could be valuable to study in order to better mount an attack on an ATM.

Potential Adversaries/Threats:

  • The common thief. Anyone who robs banks, gas stations, etc would seem likely to be the type to try to attack an ATM. Every once in a while you hear about a thief tethering their truck to an ATM in hopes they can carry it away with the truck. This is just one example of my “common thief.”
  • The manufacturers of ATMs and/or the persons who restock the ATMs. These individuals have an inside edge over others when it comes to having information about the ATM’s design and access to the innards of the machine. Though, the person restocking the machine probably wouldn’t stock the machine and then try to steal from it. They might, however, sell information about how to get inside the machine.

Weaknesses:

  • Stolen or duplicated bank cards. If a thief can obtain a real or duped bank card, they are one step away from your withdrawing money from your account. They would also need your PIN, and this might be discovered through observing you punch it in, or through the banks records somehow.
  • The owners manual gives away default passwords and methods for putting the machine into certain modes of operation. For example, this actually happened and can be read about at http://blog.wired.com/27bstroke6/2006/09/atm_hack_uncove.html?entry_id=1560245
  • The network communication lines could be tapped and signals might be altered. A confirmation message from the Data Bank Center might be altered to up the amount withdrawn from the ATM, but not recorded on your account.
  • The ATM is only metal and machinery. It can be destroyed and/or carted off with enough force. Then at a later time, it can be dismantled without worry of time if it were successfully carted off. This is known as Ram-raiding: http://en.wikipedia.org/wiki/Ram-raiding

Potential Defenses:

  • As another physical layer of security, the ATM could sit on top of a vault in the ground where the money would be held. This way, if someone stole the ATM, they would not steal the money, and it would just be harder to get to overall.
  • Sensors could be put into place to detect if someone is tampering with the innards of the machine in an unauthorized manner, and if so, a self-destruct mechanism of the core parts could be initiated (fry the parts?).
  • Instead of a bank card to initiate a transaction, the ATM could require a fingerprint also or retinal scan.

Risks and other issues:

Out of the two assets above, I would say the money in the ATM is the item at most risk. This is due to the value of the asset compared to anything else the ATM is composed of. Cash is the most liquid of all forms of payment, and it cannot be traced easily. These properties make the asset highly attractive. Next, considering the threats and adversaries, I believe the employees who restock the machine have the least risk of being caught. This is because they have access to the machine at certain times. It would be obvious if they stole the money before restocking the machine, but accessing the machine afterwards might be feasible to make it appear as if someone else did the bad deed. Next, I would think the manufacturers of the machines would have the next least risk. They have knowledge of the system, and from the article above, it can be seen if you have only the owners manual, you can steal from someATMs . It would make sense then that people unaffiliated with the machines like criminals would have the most risk. They must break the security of the machine from scratch which is more difficult than if they had inside information. Finally, from the weaknesses above, I would think the last weakness, ram-raiding, is the approach to be most taken. This is because it seems quick with numbers of people on your side, it can be done without revealing your identity, and you have an escape vehicle on hand. The bank card approach seems tricky since once you have stolensomeone’s card, they can just cancel it, and in the interval of time when they haven’t canceled, you need to get to an ATM with knowledge of their PIN to draw money.

By exploiting any of these vulnerabilities above, an individual is definitely participating in an unethical act. Taking the money in an ATM is a classic example of stealing. As a society, we have agreed that stealing is wrong, so this does not need anymore explanation.

Conclusion:

Ever since ATMs were first introduced, criminals have sought to rob them. It is a serious deal, and the level of protection on ATMs these days shows just how serious organizations are to protect the assets inside. Nowadays, the security systems are probably “good enough”, and we should be more worried about user and design error. After a system is at a certain level of security, it might be too costly to go much further, and perhaps responding to acts against the ATM is a better course of action at that point. Design error should be a major cause for concern though. As the article linked above shows, if default passwords and operation modes are left available to anyone with the ATM manual, then things can go very wrong.

Filed under: Ethics,Physical Security,Security ReviewsComments Off on Security Review: Automated Teller Machine

Comments are closed.