Cash machines at risk from hacker attacks

Research claims that ATMs are susceptible to hackers because of their PC based operating systems and inadequate firewall protection.

Cash machines are at risk from hackers because banks are failing to properly secure them, a new report has claimed.

A white paper by security services company Network Box has said ATM's are less secure because of changes to the way they operate. It said that 70 per cent of current ATMs are essentially PCs running PC operating systems like Windows XP. This makes them more susceptible than when ATMs were mainly built with proprietary software and communication protocols.

"Most people simply assume that because an ATM is invariably provided by a bank, the transactions and data must be secure," said Mark Webb-Johnson, chief technology officer of Network BOX. "This assumption may have been true in the past, but today ATMs operate in a way that makes them far more susceptible to attack."

Banks switched to Windows XP-based hardware and operating systems because of benefits like better performance and cheaper costs. However, like PCs, these were susceptible to hacking attacks. The report cited an example in January 2008 when an analysis of ATM network traffic revealed that only the PIN number of a card was encrypted. A large portion of traffic travelled in plain text such as card numbers, card expiry dates, transactions amounts and account balances.

It was claimed that all a hacker needed to do was access a part of the IP network between the IP-ATM and payment processor to find out these details. The research claimed that current personal firewall protection was not sufficient as it didn't counter all the threats and had its own inherent problems.

"We've already seen in August 2003 how the Nachi Internet worm crossed over into 'secure' networks and infected ATMs for two financial institutions. And we've witnessed the SQL slammer (aka Sapphire) worm indirectly shut down 13,000 Bank of America ATMs," said Webb- Johnson.

"The chances are that if banks don't use technology that can actually provide an effective level of protection - technology that is already on the market - then it is very likely that more high- profile attacks are to follow," he added.

Although the research was primarily done in the US, Network Box internet analyst Mike Heron said that British banks and financial institutions needed to take notice as the software and hardware used in the US was similar to that used in the UK.

"If [the banks] have got Windows XP-based ATM's then this is obviously something which is a concern. We don't want our details sent in plain text. The current firewall protection is not sufficient and they need to look seriously in how to rectify this so there isn't a breach," said Heron.

Featured Resources

The complete guide to changing your phone system provider

Optimise your phone system for better business results

Download now

Simplify cluster security at scale

Centralised secrets management across hybrid, multi-cloud environments

Download now

The endpoint as a key element of your security infrastructure

Threats to endpoints in a world of remote working

Download now

2021 state of IT asset management report

The role of IT asset management for maximising technology investments

Download now

Recommended

Ryuk behind a third of all ransomware attacks in 2020
Security

Ryuk behind a third of all ransomware attacks in 2020

29 Oct 2020
REvil hacking group says it has made more than $100m in a year
Security

REvil hacking group says it has made more than $100m in a year

29 Oct 2020
36 billion personal records exposed by hacks in 2020 so far
Security

36 billion personal records exposed by hacks in 2020 so far

29 Oct 2020
Trump website defaced in second successive cyber breach
Security

Trump website defaced in second successive cyber breach

28 Oct 2020

Most Popular

Do smart devices make us less intelligent?
artificial intelligence (AI)

Do smart devices make us less intelligent?

19 Oct 2020
Best MDM solutions 2020
mobile device management (MDM)

Best MDM solutions 2020

21 Oct 2020
What is Neuralink?
Technology

What is Neuralink?

24 Oct 2020