Заголовок 7 sins of ATM protection against logical attacks Timur Yunusov Senior expert ptsecurity.com
Заголовок whoami • Positive Technologies (from 2009) • Application security researcher (from 2009) • Banking systems security senior expert (from 2012) • Big fan of #nullcon • Always in search/research ;)
Заголовок whoami • Positive Technologies (from 2009) • Application security researcher (from 2009) • Banking systems security senior expert (from 2012) • Big fan of #nullcon • Always in search/research ;) 10+ ATMs for the last year
Заголовок ATM security assessment
Заголовок 7 sins • Kiosk bypass techniques • Privilege escalation techniques • Application control software bypass • Network physical layer • Device management • OS / Software vulns / OS • Booting process Kiosk mode bypass • Logical vulnerabilities Network • Network attacks • Hardware attacks Hardware
Заголовок Blackbox Blackbox is dead
Заголовок Blackbox Blackbox is dead
Заголовок Blackbox Have strong crypto btw dispenser and OS? Blackbox is (almost) Yes dead (for researchers) BB is not BB is possible possible
Заголовок Kiosk mode bypass Kiosk mode bypass Windows XP/7
Заголовок Kiosk mode bypass • Safe mode • Hotkeys • Windows Plug&Play • Race condition
Заголовок Safe mode • F8 + Safe mode with command line • DS restore mode • AC/DC fun
Заголовок Hotkeys • Win+R
Заголовок Hotkeys • Win+R • Alt+Tab • Alt+F4 • Alt+Shift+ESC • F1-F12 • Shift x5 (Windows 7 only) • Win+(etc) http://www.techrepublic.com/blog/windows-and-office/the- complete-list-of-windows-logo-keyboard-shortcuts/
Заголовок AlwaysOnTop This ATM is Out Of Service, Sorry for inconvenience
Заголовок AlwaysOnTop This ATM is Out Of Service, Sorry for inconvenience • Disabling mouse icon • AlwaysOnTop
Заголовок P&P
Заголовок P&P
Заголовок P&P video/screenshot
Заголовок End of the story
Заголовок Privilege escalation techniques • How exactly we extract money?
Заголовок Privilege escalation techniques • FS restrictions • Local Security Policy restrictions
Заголовок Privilege escalation techniques • Arbitrary command execute - XFS API • Command execute - priv escalation • Write files/registry - modify sec configs
Заголовок Privilege escalation techniques • Arbitrary command execute - XFS API • Command execute - priv escalation • Write files/registry - modify sec configs • Read files - ***
Заголовок App control software bypass Story so far… • https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html • https://cansecwest.com/slides/2016/CSW2016_Freingruber_Bypassi ng_Application_Whitelisting.pdf
Заголовок Security software bypass • McAfee Solidcore - https://www.ptsecurity.com/ww-en/about/news/131496/ • MS Applocker - http://www.blackhillsinfosec.com/?p=5257 – State of Art! • etc (6 total different products) – stay tuned! • 0days (5 total, in process of fixing): network, local, logical • Misconfiguration • Whitelist Memory Execution: IE, rundll32, powershell, java, etc
Заголовок Security software bypass
Заголовок Network • Processing • Track2 • OS services • Software services (Solidcore, UPDD, etc) • Processing • Track2 VPN TLS MAC + Firewall • Processing
Заголовок Network vulns • VPN disabling • Logical vulns part • TLS disabling • MAC disabling • Files/registry manipulations
Заголовок Network/Hardware layer • 3G industrial modem • Long story short http://blog.ptsecurity.com/2015/12/critical- vulnerabilities-in-3g4g-modems.html • Security measures • VPN channel • Private APN • Result • ATM network infection • Processing access
Заголовок Network/Hardware layer • Access to *:80 • Auth bypass • Physical access • Proper VPN protocols(((
Заголовок Device mgmt How to do all hacking stuff much easier?
Заголовок Device mgmt • Keyboard/mouse • Teensy • Network card • fw bypass • plug&play • USB drive • local access to Exe file content • plug&play • MS13-081
Заголовок Booting process The easiest way is…
Заголовок Booting process • BIOS pwd • Network load • Safe mode • Physical access • OS access • Same passwords story • Bootkit • Software skimming
Заголовок Logical vulns How it happened?
Заголовок Logical vulns • Security tools runs from regedit/autorun • Shift x5 • Win+U • Security race condition • Hash(loooooooong file) • exploit.exe at the same time • Ctrl+C
Заголовок Logical vulns
Заголовок Logical vulns • VPN disabling
Заголовок Logical vulns • FS access is strictly prohibited
Заголовок Logical vulns • FTP is strictly prohibited!
Заголовок Summary Windows 7 SP1 ATM Windows XP SP3 ATM Kiosk bypass Hotkeys/Safe mode KeyboardDisabler bypass App control bypass 0day/Trusted soft Untrusted booting Privilege escalation 0day/MS15-051 Untrusted booting VPN/TLS disabling Misconfiguration/FS Untrusted booting Social Engineering Misconfiguration/FS - Untrusted boot BIOS accessing from OS No password Network attacks MAC/TLS/VPN/App service MAC/TLS/VPN/OS services
Заголовок How all that happens? • Security through obscurity is not an option! • You should know your landscape and your threat model • Use compliance management tools instead of paper • In case of impossibility of fixing vulns, use mitigation measures like SIEM
Заголовок Greetz • Anon guy ;-) • Positive Technologies researchers teams: • ICS/SCADA • Reverse Engineering • Banking security
Заголовок Contacts http://uk.linkedin.com/in/tyunusov tyunusov@ptsecurity.com a66at
Заголовок Thank You! ptsecurity.com
Recommend
More recommend
