Erik Van Buggenhout Royal Holloway, University of London Distance - PowerPoint PPT Presentation

Erik Van Buggenhout Royal Holloway, University of London Distance Learning Conference 2014

Information Security Consultant Instructor Incident Response, Penetration Testing SEC 560 & 542 Royal Holloway, University of London Project: ATM Security assessment framework

§ About the project § ATM Introduction § Attacking the ATM § Common ATM system design § Assessing a sample ATM § Conclusion

§ “A security assessment framework for Automated Teller Machines” § Finished it this year (2014) § Supervisor: Frederik Mennes

§ Automated Teller Machine § Cash disposing & dispensing § 2.2 million devices worldwide § Different hardware & software vendors

The first ATM was installed in 1939 in New York City, known as “Bankograph”. Removed after 6 months because it was not used J It was reintroduced in Ohio in 1959, with huge success. There are currently more then 2.2 million ATM’s worldwide.

The ATM is a “stupid” device, part of the bank’s overall architecture. It relies on back-end services for “important” decisions. PIN validation Account balance Transfer / withdrawal authorization ...

Typical lay-out of a modern ATM 1. ATM computer 2. (Touch)screen 3. Card-reader 4. PIN pad 5. Cash dispenser 6. Cash cassettes

1. ATM computer 2. (Touch)screen 3. Card-reader 4. PIN pad 5. Cash dispenser 6. Cash cassettes

1. ATM computer Disk bays Disk bays 2. (Touch)screen 3. Card-reader CD / DVD CD / DVD 4. PIN pad 5. Cash dispenser Auxiliary ports 6. Cash cassettes USB

It stores MONEY Handles interesting customer data as well, which could be abused to get MORE MONEY

Attack back-end Blow up the safe communication Copy cards & Attack the OS steal PIN codes Access Steal the entire “operator” mode thing ...

Safe certification standards, bolts, video surveillance...

Ink cartridges that stain money upon breach

Anti-skimming devices

Security awareness campaigns

Awareness + force change of default passwords

Barnaby Jack Attack back-end Blow up the safe “ Jackpotting ATMs” - 2010 communication Copy cards & Attack the OS steal PIN codes Access Steal the entire “operator” mode thing ...

Network access? Attack back-end Blow up the safe communication Copy cards & Attack the OS steal PIN codes Access Steal the entire “operator” mode thing ...

Network access? Attack back-end Blow up the safe communication Copy cards & Attack the OS steal PIN codes Shodan HQ (Internet search engine) lists 800+ ATMs Access available on the Internet Steal the entire “operator” mode thing ...

Attack back-end Blow up the safe communication Copy cards & Attack the OS steal PIN codes Access Steal the entire “operator” mode CCC 2013 thing “Electronic bank robberies” Boot ATMs from USB ...

CEN/XFS (eXtensions for Financial Services) provides a standard set of APIs that can be used by Windows applications to operate the ATM peripherals

Operating System Windows-based application Vendor XFS APIs Independent XFS Manager CEN/XFS (eXtensions XFS SPIs for Financial Services) provides a standard set XFS Service Providers of APIs that can be used by Windows Vendor ATM peripheral Dependent applications to operate the ATM peripherals

95% of ATMs was running Windows XP in January 2014 (NCR, 2014)

“How will you approach the Windows XP end-of-support?” (KAL 2013 – ATM Software Trends & Analysis)

Attack failed

Using openly available forensic toolkits we managed to recover the majority of the original hard disk content.

Sweet... But I don’t have a bank back-end (yet)

WFSOpen("CurrencyDispenser1", Set up XFS session with the WFS_DEFAULT_HAPP , "NVISOSPIT", “CurrencyDispenser1”, no WFS_TRACE_NONE, logging is required J WFS_INDEFINITE_WAIT , 0x0000FFFF , &serviceVersion, &spiVersion, &service); Create a dispense object “tDispense” WFSCDMDISPENSE tDispense; Create a denomination WFSCDMDENOMINATION tDenomination; object “tDenomination”

tDispense.fwPosition =WFS_CDM_POSNULL; €€€ tDenomination.cCurrencyID[0]='E'; I want “EUR” J tDenomination.cCurrencyID[1]='U'; tDenomination.cCurrencyID[2]='R'; tDenomination.ulAmount=nviso_amount; The amount is specified dynamically by a command tDenomination.usCount=5; line argument tDenomination.ulCashBox=0; ulaValues[0] =nviso_cassette1; ulaValues[1] =nviso_cassette2; Specify how many notes you ulaValues[2] =0; want per cassette ulaValues[3] =0; ulaValues[4] =0;

tDenomination.lpulValues = ulaValues; tDispense.lpDenomination= &tDenomination; HRESULT hResult = WFSExecute(service,WFS_CMD_CDM_DISPENSE,&tDispense,WFS_INDEFINIT E_WAIT ,&lpResult); Load the dispense with the specified denomination & execute the dispense operation

TODO: Make it generic for different ATM devices (read custom config from registry J )

DEMONSTRATION

Erik Van Buggenhout Royal Holloway, University of London Distance - PowerPoint PPT Presentation

Erik Van Buggenhout Royal Holloway, University of London Distance Learning Conference 2014 Information Security Consultant Instructor Incident Response, Penetration Testing SEC 560 & 542 Royal Holloway, University of London Project: ATM

Run Your Component-Based Semantics Thomas van Binsbergen Royal Holloway, University of London,

Relations entre XLIM Universit de Limoges et ISG-SCC Royal Holloway, University of London

JXTA P2P, Web Services and WS-Talk Royal Holloway, University of London Fionn Murtagh Dimitri

Module-LWE vs. Ring-LWE? Amit Deo Royal Holloway, University of London 15 January, 2018 1/56

Higgs Interferometry in WW/ZZ Nikolas Kauer Royal Holloway, University of London (RHUL) in

searches using the ATLAS detector Dr Tracey Berry Royal Holloway University of London 2

Max- r -Lin Above Average and its Applications Robert Crowston Royal Holloway, University of

(PAIGE) Yilei Liang (Kings College London) D an OKeeffe (Royal Holloway University of London)

do doma main spe pecifi fic ciph phers Carlos Cid Royal Holloway University of London

Narrow band excitation simulations Hector Garcia Morales Royal Holloway University of London

instruction in learning to read? Kathy Rastle Royal Holloway, University of London @kathy_rastle

Neural State Classification for Hybrid Systems Nicola Paoletti Royal Holloway, University of

Neural State Classification for Hybrid Systems Nicola Paoletti Royal Holloway, University of

Key Reuse: Theory, Practice, and Future Kenny Paterson Royal Holloway, University of London

Fundamental Theory Algebraic Graph Transformation Fernando Orejas Royal Holloway University of

Concept Hierarchy Visualization P. Contreras, D. Zervas, F. Murtagh Royal Holloway, University

An introduction to ribbon graphs Iain Moffatt Royal Holloway, University of London ALEA-Network

Key Reuse: Theory and Practice Kenny Paterson Royal Holloway, University of London based on

Ribbon graphs and their minors Iain Moffatt Royal Holloway, University of London British

Introduction Overview of Bibliometric analysis Operations Management Innovation and

Off-shell Higgs signal and total width determination at the LHC Nikolas Kauer Royal Holloway,

Efficient Symbolic Execution for Software Testing Johannes Kinder Royal Holloway, University of

XACML and Role-Based Access Control Jason Crampton Royal Holloway, University of London DIMACS

How does the Brain Solve the Problem of Reading? Professor Kathy Rastle Royal Holloway,