Hacker News Reader

Comment by userbinator | Hacker News Reader

According to FireEye, the Ploutus attacks seen so far require thieves to somehow gain physical access to an ATM — either by picking its locks, using a stolen master key or otherwise removing or destroying part of the machine.

ATMs need to be more physically secure, like bank safes, if they are to be resistant to such attacks. The software part is mostly immaterial here, IMHO --- it doesn't matter what the software is, if you can get access to the physical money.

View on HN

I used to work with various ATMs and the cash dispenser _is_ a hardened safe, with a combination lock and all. If you are to steal an ATM, you will still need to open the safe and the simplest option would indeed be to try and persuade it to just dispense the money.

The thing is that ATMs from larger vendors (IBM, NCR, Bull, Siemens, etc.) have layer upon layers of protection features. For example, you can configure a secondary combination for the safe which will open it and also send an emergency alert. This is for the cases when someone is being forced to open the safe at gunpoint. There are batteries for secondary power supply. There are options for physical lock-down in case of a power loss. Tilt and movement sensors. Redundant communication options, including exotics like x.28 radio.

I mean that all of this was readily available even 20 years ago. ATMs are not designed by amateurs. The issue is that all these are _options_. They need to be bought first and then they also need to be properly configured and enabled, which falls on the banks or their IT service providers to do. The smaller the bank, the less willing they are to spend even more money on configuring secondary stuff and setting up an infrastructure for it, so many of these options will remain off even if they are available.

You explain more about the x.28 radio, and its purpose? Communication between where?

There have been several cases of stolen construction equipment (fork lifts, wheel loader, etc.) being used to steal ATMs. For example: https://www.youtube.com/watch?v=K05LT-WpN5I

Achieving 100% physical security is going to be hard.

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the cash, resulting in obtaining £30 cash taken from the till).

Moving the cash from even a free-standing ATM to the till seems unlikely to be a net improvement in security.

The till probably has under £500 in, probably less. The ATM probably 20 times that.

By offering cash back you're reducing the amount of cash kept in store, reducing the chance of being robbed (less worthwhile). By putting an ATM in store you're increasing the cash on premises, and in your tills (as people use the ATM rather than cash back)

Cash back is a win-win for stores.

Then either the ATM had 20x too much cash in it, or the store will be unable to satisfy 19/20 requests for cash back?

People withdrawing cash from the ATM (often incurring a non-trivial fee) to pay in the same store, rather than just paying on card, seems to be a marginal case and indeed inferior to card payment.

ATMs are often refilled only every day or two, whereas the store's registers are replenished periodically, often at shift changes or when demand increases. Perhaps more importantly the register also takes _in_ cash as unrelated customers pay with cash.

Cash in an ATM is orders of magnitude safer than cash in a till, most significantly for the store staff as less cash invites fewer (traumatising, dangerous) robberies.

When I worked in a convenience store 20 years ago, we’d dump cash into a safe through a mail slot every time the cash in the till rose over a certain amount (the register computer would show a red bar with a message to this effect), and we’d routinely have to turn down requests for all but trivial amounts of cash back for this reason.

The store usually has nothing to lose. In most cases, the ATM in small stores isn't owned by the store: the ATM owner pays them a fee for having it there.

There are ~20 ATMs within a 5 block radius of my apartment (NYC), all in small shops that have no place for an in-wall ATM, and this is in a relatively low ATM density area of the city; there are thousands more like this across the 5 boroughs.

In aggregate these small freestanding ATMs are a huge business, it's unlikely they will harden their whole fleet by building in-wall installations.

Not too many walls will stand up to being rammed by a Bobcat or other small skid loader, and those can be easily transported by a pickup truck and a trailer.

The ATMs built into walls tend to be larger / heavier than the standalone ones. You gonna fit a crane / forklift truck on that pickup truck / trailer too?

Do you know what a skid loader is? My point is that it'll just punch a hole in the wall, ATM and all. Then pick it up and drive away.

Oh it's going to drive away now. That will be hard for a police car to catch up with.

Reply on news.ycombinator.com