ATMs are an elementary part of our daily lives , our most common point of contact – with the permission of online banking – with financial institutions. Devices that have been modernized over the years to incorporate more features (recharge of mobile balance, withdrawal of tickets for concerts, etc.) and to offer a more comfortable experience to the user (color screen, touch, withdrawal without card …). However, it seems that this evolution has only taken place in the most visible layer for the citizen, because inside the ATMs are still a thing of another decade.
In that sense, cybersecurity experts at Positive Technologies have analyzed 26 ATMs from different manufacturers on a global scale. And the conclusions of his report are devastating: the protection of these devices is practically non-existent and can be exceeded in less than 15 minutes.
Specifically, no less than 15 of these ATMs ran on Windows XP ( a version of the operating system that is discontinued and unsupported since 2014 ), while 22 ATMs were vulnerable to ARP spoofing attacks. In addition, 18 of these machines ‘releases’ were hacked into a ‘black box’ test with the help of only one Raspberry Pi or a similar plate, while another score could be violated by means of a USB port or PS / 2 . In addition, 24 of the ATMs did not have any data encryption configured on the hard drive .
“Most of the time, security mechanisms are a simple nuisance for attackers: our evaluators found ways to avoid protection in almost all cases (…) Since banks tend to use the same configuration in a large number of ATMs, a successful attack at a single ATM can easily be replicated on a larger scale, “the study authors say.
Researchers say that the best way to protect your ATMs (and your customers’ money) is to improve the actual physical security of the machines. By blocking the inputs and hardware processing of the machines, many of the cybersecurity problems they face could be solved. On the other hand, they also suggest that banks monitor the recording and monitoring of security events in their network.
