How is an ATM secure?
security.stackexchange.com
security.stackexchange.com
They're regularly lifted and carried away here in Uruguay, one police officer said:
""ATMs are still being stuck to the ground with glue," said one visibly angry commissioner yesterday morning (March 22nd), investigating the unusual theft of yet another ATM, which was completely lifted by thieves, who took it "like a bag of brownies". This time, they "lifted" the cashier that was installed in 4896 between Ariel and February 28 streets, just two blocks from the Sayago mall , and took it away after opening the glass door with a magnetic card."
Plus, they're error-prone, I've been victim of such an error several times (the ATM failed to give me the money but withdrew from my account, which SHOULD NEVER HAPPEN), in one of the cases I never got my money back (from Bank Boston Uruguay, which is now Banco Itaú). I'm of a mind that, for small amounts of money, you're better off having it "under the mattress" that in a bank (see: Cyprus, unresponsive banks, etc...). We've had a Cyprus-like bank freeze here in Uruguay, and much worse than Cyprus in Argentina (they forcibly turned their dollars into worthless pesos a few years ago (3) ).
(1) http://www.ambito.com/noticia.asp?id=680399 (in Spanish)
(2) http://www.lr21.com.uy/justicia/25139-otro-cajero-automatico... (in Spanish)
(3) http://en.wikipedia.org/wiki/Corralito (in English)
Edit: by the way, the faulty ATM in my case was an (old) Diebold machine. So you can imagine I wouldn't trust one with my vote either :P , though I sadly do have to trust them with my money. (fortunately, voting is still manual in Uruguay).
There is an ATM just inside the doors and the storefront didn't have concrete poles out front. One early morning a pickup truck just reversed into the store, chained up the ATM and dragged it away.
There are concrete barriers up now.
Banks aren't very well managed here (at least from what I've seen from the IT side), so they're probably skimping on the security.
Edit: Along the same track, I wanted to comment on one of the points made on StackExchange by Kaz:
Today's ATMs may be more secure than yesterday's ATM's, but the track record has been spotty.
fake ATMs have been set up by criminals and used to duplicate bank cards and collect PINs. This takes advantage of the fact that whereas ATMs authenticate users via cards and PINs, users simply trust that ATMs are real by their visual appearance and bank logos.
genuine ATMs have been outfitted with criminal equipment to collect PINs, in response to which ATMs had to incorporate new physical measures.
A band did this recently, but only managed to steal U$ 20.000 before being spotted. They installed skimmers on 5 ATMs on popular places.
Another guy managed to steal U$ 450.000, but was captured (news in Spanish).
http://www.montevideo.com.uy/notnoticias_133463_1.html
An example from Brazil (in Spanish, but with very clear pictures):
http://www.taringa.net/posts/offtopic/4349623/Estafa-en-Caje...
ATMs have been simply ripped out and hauled away by criminals.
This happens a lot here, as mentioned.
ATMs are open 24 hours a day and in deserted areas, creating opportunities for criminals to coerce victims into extracting cash. Prior to the ATM, it was not possible to kidnap someone at knifepoint and take them to a bank and 3 in the morning in a seedy part of town.
This is scarily common (that is, it happens often enough not to make the headlines) in Argentina, and has happened several times in Uruguay.
Example from January (in Spanish), it only makes for a footnote in the Crime News section:
http://www.clarin.com/policiales/secuestran-Liniers-llevan-r...
As a general observation, new security measures introduced in banking usually tend to be designed to protect the banks from liability, rather than the safety of customers or their capital.
A few weeks ago I came across a donation kiosk for a charity, installed in the cafeteria of a newly built highway service station. The donation app had apparently crashed, leaving the machine with vanilla Windows 7. Some kids managed to start MS Paint and were busily drawing squiggles on the touchscreen. If you started IE instead and visited a website with a drive-by download, you could have easily installed a backdoor on it.
Nothing is inherently safe, so the key is to have the money inside rendered useless.
Be it broken-glass, seals, radio/gps, there are probably many other ways of detecting non-normal use (given ATMs is usually bolted). Add that to the fact that it's incredibly risky and difficult to physically remove.
What you would end up with would be useless or marked money.
So, it's not 100% secure, but it is a futile target.
Off topic: You can compare this to cryptography. Given an attacker has (physical) access and knows your system, it should still be impossible to crack.
The parameters controlling what is locally allowable on the machine can be changed by editing the right config file - is $500 going to be the maximum allowable withdrawal or $50,000? If you know your way around the actual machine configuration and the operator panel you can do fun things like tell the machine it is full of $1 dollar bills when it's actually full of $20s - you just have to know what the opacity value is for the bill scanner.
The only factor here is physical security to the electronic components, which is exceedingly poor. The interior safes are very strong even once you've opened the external cabinet, so you won't be physically taking the money out very easily. Except for Triton machines, those things are ridiculously flimsy.
I think that goes to show that some ATMs are less secure than we'd like.
http://commons.wikimedia.org/wiki/File:Distributeur_billets_...
So no, they're not always secure.
Sorry, couldn't help it ;)
The downvotes for the above comment doesn't offend me, they're right and appropriate.
What I do mind is the apparent indifference to thoughtful and insightful comments. Way to keep incentives aligned, HN.
Every time I post and get no votes it teaches me that HN doesn't care. Which would be fine if my comments were like the above, but they're not. I upvote and encourage commenters, but I've grown tired.
So the next time you think of lurkers as people not wanting to contribute, now you know there are alternative explanations.