Hacker News Reader

Comment by jsundquist | Hacker News Reader

I notice at the end of the article it says a filename was hack.bat.

Looks like they are windows based machines. Wonder if they left auto-play running on them?

from experience (I was a security assessment professional and I have looked at multiple of these ATM machines in the past from a hackers point of view), these machines are almost always windows XP SP3 or the newer once are running windows 7. A number of usb devices are added like the pinpad, keyboard, printer, smartcard reader, cash dispenser, ... Next the entire thing is managed using XFS. (http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WS...) So even tho it might appear the researcher had a large amount of knowledge, this is not so uncommon.

That's also in the article, they left auto-play running.

I'd bet they use standard PC motherboards. The only unusual things the thiefs knew where where to open the hole, and how to use the cash dispenser (altough, I'm quite sure one'd be able to get the entire dispenser documentation from Google).

Knowing that they are Windows machines, why don't people attack the ATMs by the network?

I'm vaguely surprised they bothered to cut a hole to do this. When I was working on ATMs, none of my clients ever bothered to have they ATMs uniquely keyed. I had a keyring of about 30 keys that could open pretty much any ATM I came across.

Most ATMs are in running on Windows 7 with PC hardware. The hardware is probably custom made but still very similar to what you would find in a desktop.

As far the network, you cant access ATMs from the Internet at least in the US. Most of the providers have leased lines to a central server somewhere and then leased lines to whatever 3rd parties they talk to. US banks arent too crazy on letting people remotely service ATMs that are having software problems.

Reply on news.ycombinator.com