Possible Serious Security Flaw In ATMs

sfjoe writes "According to a story at MSNBC.com, researchers at Algorithmic Research (ARX) have shown it may be possible for 'someone with access to the ATM network to attack the special computers that transmit bank account numbers and PIN codes, called hardware security modules'. Using these methods, an attacker could trick the security modules into exposing a PIN. It has long been considered impossible to access PINs as they are traveling through the ATM network without the encryption key used by the card-issuing bank. If PINs can be compromised, the almost 8 billion transactions per year they handle may be in danger. Not to mention all the transaction at retail stores."

Poink-Poink-Poink-Poink

*Looks left and right*

Stop reading my tones!

Re:

You know, I don't fully understand the attack.
If this is like a windows exploit then we're all in for it.
If on the other hand it's like a linux issue: If you're local, have this obscure package installed, stand on your head and swallow a glass of water yo

Re:

The thing is, anyone can purchase & setup an ATM.

There's almost no State/Federal regulation (that I'm aware of).

Re:Poink-Poink-Poink-Poink

And that is why organized crime has their own ATM division:

http://www.beyondrobson.com/tech/2006/10/avoid_ban k_fraud_i_didnt/ [beyondrobson.com]

Therefore, not only is the ATM network insecure, it always has been for other reasons.

--jeffk++

The reality of this is...

Getting a bigger mattress to store my cash in.

Re:The reality of this is...

I know I am probably the exception amongst most of you. We don't have an ATM card, we go down to the corner bank to get money out the old fashioned way. Everyone at the branch knows the wife and I and no one else could get money out without generating a lot of questions. There's a lot to be said for the good old days.

Re:The reality of this is...

I used to be a teller in a bank a few years ago. It is a very transitory position. I was there for nearly two years and there were few who had been there longer than I and many who had come and gone. Give it some time and people at the bank won't know who you are.

Having said that, I hope that even if they do know who you are, that they ask to see ID every time, like my teller colleagues and I did. A lot of people have this silly notion that the only time we ask for ID is if the person in front of us is not the person on the account. For some reason they didn't understand that we had no way of knowing that until we had seen ID. When we asked we actually had idiots say "Why? I'm the owner of the account," as if we would turn red in the face and say "Of course you are. How silly of me to ask. Certainly a criminal would have provided us with ID without being asked."

But if tellers ever get to the point that store clerks do (and I suspect many have) then any old schmoe will be able to take money out of your account. I can't tell you how many times I've had cashiers ring up a sale without ever even looking at either my ID or my signature on the back of the credit card. I've had times where I offered and was refused, as if they didn't want to have anything to do with security checks of any variety as that might bring upon them responsibility or something. I'm not talking about small purchases here either.

So my point is, if bank tellers get to the point of laziness as most cashiers, you're money isn't safe in the bank whether or not you have an ATM card. The best you can do is keep an eye on it and report anything as soon as it happens.

Re:

Heck, I've *love* to have the banks ask for ID a little more often. My experience was that in hitting a branch of the bank that I didn't patronize often (and staff I didn't recognise), I was able to just present my debit code and pull amounts under $200 wi

Re:

Quoth Chosen Reject

But if tellers ever get to the point that store clerks do (and I suspect many have) then any old schmoe will be able to take money out of your account. I can't tell you how many times I've had cashiers ring up a sale without ever even l

You don't need ID

I can't tell you how many times I've had cashiers ring up a sale without ever even looking at either my ID or my signature on the back of the credit card.

They're supposed to check your signature, but not your ID.

Remember those Visa Check Card commercials f

Re:

It's against the law for you or any who may represent you (legally or not) to pay your way out of debt. I'll probably get a letter in a few weeks noting "suspicious activity" on my account since I paid it off today. Go figure.

Lucky You

Some of us do not have a bank right on our corner. It would likely be a three hour ride on two different transit systems for me to get to my home branch. (Hey, I used to bank in an entirely different city 200+km from where I live). Since I only need to

Re:

My checking account is at Washington Mutual since they have ATMs everywhere. But my savings account is in a credit union with very few ATMs and there's no local network ATM where I live. I write a check for CASH every two weeks that I deposit into my savin

Re:

My dad has a similar attitude towards credit cards. Since declaring bankruptcy 25 years ago, he haven't had a credit card or bought anything on credit. When a truck dealership had a Labor Day sale on $10,000 trucks, he took an $8,000 cashier check in hand

Re:

I kept asking my dad whatever happened to "cash is king" philosophy that he's been preaching for years. He told me to shut up. :)

You dad was right, though. Cash is, indeed, king. The problem is that you have to be willing to save until you can afford to

Re:The reality of this is...

The ATM machines should directly encrypt the card info with the issuing bank's public key(or at least with the single operators public key, and then only get re-encrypted once, by that trusted machine)....that way the men in the middle/other banks along the way do not have the ability to see the transaction info

Re:

Exactly my thinking.

When I read the article, I couldn't believe that anyone would even consider building a "secure" system where third-party machines have to decrypt and re-encrypt such sensitive data... or any encrypted data for that matter... that's wh

Who knew the system was this broke?

My thoughts exactly.

There must be some reason (I hope) but the security model that they're describing in TFA seems horribly flawed. It depends purely on the security of some black-box hardware modules embedded at different points in the system.

Basically, w

Intercepting Transmission

I saw a news report the other day of a guy that hooked his a device (it may have been an iPod) to the back of an ATM where the phone line comes out, and intercepted the signal transmitting the information.

He was able to get credit card numbers, pins, and all of the other information transmitted, and stole a lot of money before being caught. And he wasn't caught by bank security or software, he was caught because a clerk was paying attention, IIRC.

Re:Intercepting Transmission

Here is the story [google.com].

Re:

OMFG. They are sending all of the information on phone lines without encryption. What is this, the 1970s bulletin board era? These are the people we trust to build voting machines because of their security expertise?

Re:

No wonder some of them started making voting machines, too!

Re:

What story are you referring to?

The only one that had inflammatory hand wringing was the Mp3 player that Sound emitted from the line is then interpreted using a modem line tap, or passed through a Ukrainian computer software program which is illegal to pur

Re:

This one [webpronews.com].

Also covered here [timesonline.co.uk].

And here. [com.com]

If there was crypto used, it absolutely sucked.

If all you need is a modem line tap or an illegal program to crack ATM's, there isn't much security is there?

I don't think there is crypto. I think the information is sent

Let's just get this clear right now...

First one to refer to "ATM Machines" or "PIN numbers" gets slapped.

Re:

So I can't talk about the numeric identifier of a leg of an IC, or the machine that does asyncronous transfer mode?

:-)

What's the big deal?

I am surprised this has not surfaced before. Every piece of technology can be hacked if given enough time and access. The only way to remain secure is to stay ahead of the hackers. FTFA: The attack theory is significant because it has long been consider

Re:

It seems perfectly reasonable to me. Most ATMs in America are manufactured by Diebold. Diebold has proven time and again that they consider all their products to be unhackable.

Holding All the Cards

Every bank I know of with back-end offices here in NYC requires everyone passing through their building doors to use onetime password cards (usually RSA keycards) for access. Yet those banks all make us run around broadcasting our PINs to whichever fly-by-night ATM dispenses $100 latenight when we're drunk.

The cost of chipcards that generate onetime passwords, to protect from replay attacks, is minimal. Especially compared with fraud and theft. What's taking them so long?

Re:

Accessiblity for one.

Try reading one of those cards when you've had your pupils dialated sometime.

Re:

Why should I read the card? That's the machine's job. Letting me know the onetime passwords just increases the risk.

Re:Wrong

I worked for a developer that did bank card software and the parent is right about physical security. The banks have thought long and hard about security regarding their card payment operations and they are generally well thought out and practical. Imp

Re:

One major credit card company is switching to chipcards in my country next year. They expect to be finished (ie almost all merchants and cardholders) switched over by 2010.

Danger

"...the almost 8 billion transactions per year they handle may be in danger."

It was as if the entire NCC had suddenly received the news, and the voices of NCC staffers across the country had cried out as one. We could only look at each other in stunned

Easier to manually do it

It would be easier to simply use a video camera over the shoulder of an ATM visitor, and just as effective.

Using the information directly at an ATM to get a couple of hundred dollars would be too much effort, too high risk, and too little return. More likely, the PIN would be used to obtain larger sums of cash via other methods - calling in a bank transfer or something to that effect.

While on the surface it seems unlikely that somebody would go through the hassle, if one gained access to the ATM network, and had means to unencrypt the traffic at least in part, there is a great deal more potential for crime than simply obtaining an ATM PIN number.

Banks shouldn't be reliant on security at the switches either - all it takes is one bad employee to reduce the effectiveness of on site security to nothing, and I imagine with the pay rates they are kicking out, there are more than a few employees vulnerable to trouble of one sort or another.

New Title to Earn?

So if someone cracks the system do they become "The Lord of the PINS?"

Sorry, obvious pun joke. Had to make it. Any others?

Re:New Title to Earn?

No, I think that person becomes a "PIN cushion". :P

Re:

If a computer nerd is a chiphead, then what do you call a PIN hacker?

Re:

I knew a guy, went around resetting pins all over town, name 'o Brunswick, hella a guy.

So just use it as a credit card?

I realize this topic is mostly meant for using a card at an atm to take out cash and the like, but whenever I use my debit card to actually buy something, I make sure to use it as credit, even though most stores' touch-and-swipe pads love to default to a keypad to enter a pin. I just hit 'cancel' then 'credit' and sign the screen. No pin gets transferred, so I don't have to worry about anyone stealing it. Usually, they ask for an id because my signature is so awful (added security for me). I get points for my purchases, which I may be able to redeem within the next decade. And best of all, if anyone does decide to defraud me this way, Visa and my bank will give me the stolen funds back (my bank covers the $50 or so 'deductible' that Visa normally wants). To quote Micheal Scott, it's a win-win-win. I'm safer, my money's safer, and Sam Walton gets less profits because he now has to pay Visa processing fees.

Re:

If you pay your balance off every month, you are also getting an interest-free loan for up to about 45 days.

Re:

They don't make you sign these days (if it's under some unknown amount -- they all seem to be different) and I get cash back on my non PIN purchases.

I never quite understood the reason for using it like an ATM when it takes so fucking long. I use a card b

Important holiday information

Come on, post specifics. With Christmas around the corner we need all the help we can get. Have you seen the prices the new Elmo and P3s go for!

convergence!

Breaking News: Republican Congress rushes Vote-by-ATM bill through committee.

Chicago

As long as the ATMs in Chicago are secure I'll be fine ;-)

No. Fcking. Way.

it may be possible for 'someone with access to the ATM network to attack the special computers that transmit bank account numbers and PIN codes

Holy crap! People with access to a network can attack it? Next you're going to tell me that the only secure com

What a coincidence!

I'm sure it's just a coincidence that Algorithmic Research (ARX) is a vendor of security solutions, including HSMs [arx.com], and that ARX has been losing market share in that space for years and has a tiny market share (nCipher dominates the HSM market worldwide, Safenet, through acquisitions, has the next-largest market share, and then you start getting to competitors with very small market shares). I'm sure the researchers at ARX had no idea that almost all banks in the world use HSMs made by competitors of ARX and just wrote this paper to expose a very real security flaw, one that something tells me ARX HSMs don't allow...
FWIW, ARX was actually something of a leader and had some cool ideas... several years ago. I'm not sure whether it was because of financial trouble, incompetent management, neither, or both, but they were lapped by players like nCipher, Luna (now part of SafeNet), Utimaco, even Thales, which focuses on serving the credit card transaction market but doesn't have things like Diffie-Hellman key exchange because VISA and Mastercard don't require them, and yes, even the old low-cost option, Eracom (bought by Safenet in order to do away with a pesky competitor).

This is highly unlikely

I personally have experience configuring the HSM's and implementing the types of security referred to in this article. To understand how unlikely this hack is, I would have to go into a deep conversation with regard to how these HSM's are supposed to be configures and implemented. The brief version: Typically, PIN's are stored by your card issuer ONLY in their encrypted format. The keys that do the encryption are stored in the HSM and SHOULDN'T be exportable. When enter your PIN at a POS or ATM, it is 3DES encrypted and sent over the wire as an encrypted pin block (EPB). When an inbound EPB is fed into the HSM, the originating bank pulls an encrypted version of your PIN and feeds that into the HSM. The HSM _should_ be a black box and decrypts both in inside of protected memory, makes a comparison of the two PIN's, and returns TRUE or FALSE. PIN's are stored by the card issuer in encrypted form and are NEVER reversible to people. When you forget/lose your PIN, the card issuer will typically issue a new PIN. That's because they CAN'T read a PIN. The PIN is DES encrypted by a symetric 128-bit key that is encrypted by another key which is NEVER NEVER known to any human. If this hack is proposing to repeatedly "guess" EPB's until they get one right, or do EPB->EPB translation until they get something that makes sense.... you would be better off buying lottery tickets. LOL

Re:

Well, the bank needs *some* way to authenticate you. The bank cannot trust any device on the ATM network to say: "Hello, this is stonertom. Really really really."

Re:

Isn't Diebold the #1 supplier of ATMs in the US? I think I read that somewhere. My own personal experience indicates they are dominant on the left coast...