Take all my money - penetrating ATMs

Take all my money - penetrating ATMs

Speakers: Fredrik Sandstrom

Conference: DEF CON

YouTube: https://www.youtube.com/watch?v=auoEA8ZD8YA

Overview

Fredrik Sandstrom, a veteran penetration tester with a decade of experience in offensive security, delivers a revealing talk at DEF CON titled "Take all my money - penetrating ATMs." This presentation delves into the surprisingly prevalent vulnerabilities of Automated Teller Machines, drawing from Sandstrom's extensive "war stories" and real-world engagements. The talk highlights that despite their critical role in financial infrastructure, many ATMs suffer from fundamental security flaws, ranging from easily bypassed physical defenses to critical software and network misconfigurations.

Sandstrom's deep dive exposes the stark reality that ATMs, far from being impenetrable fortresses, are often little more than standard personal computers encased in thin metal, running outdated software, and connected via insecure networks. He elucidates how industry standardization, while intended to streamline banking operations, inadvertently creates a fertile ground for attackers, allowing exploits to be broadly applicable across different vendors. The talk culminates in a detailed account of a real-world ATM heist, underscoring the tangible and severe financial consequences of these vulnerabilities. This presentation is crucial for anyone involved in financial security, demonstrating that the weakest links often lie in overlooked physical access points and basic cybersecurity hygiene.

The core message of Sandstrom's presentation is a call to action for the banking industry to re-evaluate its approach to ATM security. He argues that the current strategy often prioritizes insurance policies and compliance paperwork over robust, proactive defense mechanisms. By dissecting common attack vectors—from physical breaches and logical exploits like jackpotting to network-based data exfiltration—Sandstrom provides a comprehensive understanding of the threats and offers clear, actionable insights for defenders. His unique perspective, shaped by years of legally sanctioned ATM penetration tests, paints a candid picture of a critical infrastructure segment ripe for exploitation by both sophisticated cybercriminals and opportunistic, less technical actors.

Background

▶ Watch: Introduction to ATM hacking and talk overview (0:00)

The evolution of Automated Teller Machines (ATMs) began in the 1960s, primarily dominated by large technology firms like IBM. This early landscape was characterized by a lack of standardization, creating significant integration challenges for banks that had to manage diverse vendor systems and proprietary backends. The banking industry recognized the urgent need for a unified approach to allow seamless vendor switching and reduce operational complexities. This drive for standardization gained significant traction by the 1990s, leading to a wave of mergers and acquisitions among ATM manufacturers. What was once a field with around 15 vendors rapidly consolidated, leaving only about four key players by 2018. This consolidation, while simplifying operations for banks, had an unintended consequence for security: it created a highly uniform attack surface.

Central to this standardization is XFS, or eXtensions for Financial Services. Developed by the European Committee for Standardization, XFS provides a common API for controlling ATM peripherals like cash dispensers, card readers, and PIN pads, regardless of the underlying hardware vendor. For attackers, XFS is a double-edged sword: while it simplifies development for legitimate applications, it also means that a successful payload developed for one ATM vendor’s XFS implementation is highly likely to function, with minimal modifications, across other vendors. As Sandstrom notes, "if you get a payload running on one of them, it will probably run off every vendor with just some small changes." This portability significantly lowers the barrier to entry for attackers and amplifies the impact of any discovered vulnerability.

Sandstrom emphasizes a critical, often overlooked aspect of ATM architecture: at their core, modern ATMs are essentially "normal PCs within a metal sheet." Beneath the hardened exterior and specialized components lies a standard computer, complete with motherboards, hard drives (sometimes smaller form factors), and even optical drives (DVDs, for the "younger crowd" as Sandstrom jokes). These internal PCs typically feature standard ports, including USB, and connect to specialized ATM modules such as the cash dispenser, card reader, and PIN pad. This fundamental design choice means that many of the vulnerabilities common to traditional PCs—from weak operating system security to insecure network configurations—are directly applicable to ATMs, often to a surprising degree. The physical placement of ATMs also plays a role in their security posture; while many are found within secure bank branches, a significant number, particularly outside Sweden, are standalone units in malls or shopping centers, making physical access a more viable attack vector.

Key Findings

▶ Watch: How XFS standardization benefits ATM hacking (3:00)

Sandstrom's extensive experience in ATM penetration testing has unearthed several critical and widespread vulnerabilities that underpin the majority of successful attacks. These findings highlight a pervasive disconnect between perceived security and actual resilience within the ATM ecosystem.

Firstly, physical security of the ATM's top compartment is shockingly weak. Contrary to the robust vault protecting the cash, the upper section, which houses the internal PC and other critical components, is often secured by "thin sheet metal, maybe even worse than your locker in when you're in changing rooms." This flimsiness, combined with simple locks (sometimes only three pins), is attributed to the need for technicians to perform monthly maintenance without needing to change keys frequently. Sandstrom recounts instances where technicians would intentionally break locks to avoid carrying keys, making unauthorized access even easier. These locks are so common that keys can be readily purchased on eBay, or attackers can use basic lockpicking tools, magnets, or even rulers to gain entry. Once this top compartment is breached, the attacker gains direct access to the ATM's internal computer and network connections.

A second critical finding is the widespread lack of mutual authentication between the ATM's internal PC and the cash dispenser. Sandstrom explains that while the cash dispenser communicates with the PC, it often does not verify the authenticity of the PC, and vice-versa. This means that if an attacker can bypass the PC entirely and connect their own laptop directly to the cash dispenser via a USB extension cable, they can potentially issue commands to dispense cash. This vulnerability is particularly insidious because it bypasses all software-level security on the ATM's computer, such as firewalls or antivirus, making it a highly effective method for jackpotting.

Thirdly, Sandstrom reveals a staggering prevalence of unencrypted disks within ATMs. He estimates that "around 30 to 40% of all ATM engagements they don't have disc encryptions." This oversight is catastrophic; even if an ATM employs sophisticated antivirus software, AppLocker, or robust firewalls, an attacker with physical access can simply remove the hard drive, access its contents offline, or dual-boot into their own operating system. This allows them to install jackpotting software, steal sensitive transaction data (card numbers, customer photos), or plant persistent backdoors with absolute impunity. This issue, according to Sandstrom, "really overshadows everything" else in terms of severity.

Finally, network security within ATM deployments is often woefully inadequate. Sandstrom observes that network gear connecting standalone ATMs is frequently "like home routers," notorious for "always vulnerable" firmware and often retaining default credentials. While banks typically isolate ATMs from each other on the backend, the local connection between the router and the ATM is often treated as secure, leading to unencrypted transmission of sensitive data. Transaction logs, containing full credit card numbers and other personal information, are frequently sent unencrypted to the backend. This allows for simple man-in-the-middle attacks, where attackers can intercept data, modify transaction requests (e.g., instructing the ATM to dispense more money than requested by altering bill box counts), or even gain direct access to internal cameras to capture PINs and card details. Sandstrom concludes that banks' strategies often prioritize regulatory compliance and insurance policies over implementing robust security measures, leading to a reactive rather than proactive defense posture.

Technical Deep Dive

▶ Watch: Explaining the basic internal parts of an ATM (4:00)

The technical vulnerabilities in ATMs stem from their hybrid nature: a specialized cash-handling machine built upon a general-purpose computing platform. The speaker elaborates on several specific technical aspects that attackers exploit.

At the heart of an ATM's operation is the XFS (eXtensions for Financial Services) standard. This standardized API allows the ATM's internal PC to communicate with and control all peripheral devices, such as the cash dispenser, card reader, and PIN pad, regardless of the hardware vendor. This standardization, while beneficial for development and integration, creates a unified attack surface. If an attacker gains control of the ATM's PC, they can leverage XFS to issue commands to the cash dispenser, bypassing user authentication and directly initiating cash payouts—a technique known as jackpotting. The speaker notes that "if you get a payload running on one of them, it will probably run off every vendor with just some small changes," underscoring the broad applicability of XFS-based exploits.

The "normal PC" inside an ATM often runs standard operating systems (typically Windows) and includes components familiar to any desktop computer: a motherboard, RAM, storage drives (though often smaller form factor), and even legacy devices like DVD drives. This means that common PC vulnerabilities and attack methodologies are directly transferable. Attackers who gain physical access to the top compartment can:

• Directly access the internal PC: This allows for the installation of jackpotting software, which leverages XFS to command the cash dispenser. It also enables the installation of implants or backdoors for long-term data exfiltration.
• Exploit weak remote management: Some ATMs are found with TeamViewer sessions enabled, allowing attackers to connect remotely and bypass firewalls or other network security measures.
• Bypass disk encryption: The lack of disk encryption on 30-40% of ATMs is a critical flaw. An attacker can simply remove the hard drive, connect it to another computer, and access all data without restriction. This allows for the theft of sensitive transaction data, including full credit card numbers and associated customer images. Alternatively, attackers can dual-boot the ATM's PC into their own operating system (e.g., a Linux distribution from a USB drive) to modify or delete files, install malware, or extract data.

Network-level vulnerabilities provide another significant avenue for attack. The speaker highlights that ATMs often use "home routers" with known vulnerabilities and default credentials for their local network connectivity. Even when the backend network between ATMs and the bank is isolated, the local segment between the ATM and its router is frequently insecure.

• Unencrypted transaction logs: A pervasive issue is the transmission of transaction logs without encryption. Using tools like Wireshark, attackers can capture network traffic and extract full credit card numbers, even when the receipt only shows masked numbers.
• Man-in-the-middle attacks: By intercepting unencrypted communication, attackers can manipulate transaction requests. For example, they can modify a request for a $40 withdrawal to instruct the ATM to dispense "20 bills from box one" (which might contain $100 bills) instead of the intended denomination, effectively dispensing $200.
• Open ports and camera access: Some ATMs have network ports left open, providing direct access to internal components, including cameras. Attackers can leverage this to stream camera feeds, capturing customer PINs as they are entered and card details as they are inserted. This data can then be correlated with transaction logs for comprehensive identity theft.

These technical weaknesses, combined with the industry's focus on compliance over practical security, create an environment where sophisticated attacks can thrive, and even relatively unsophisticated criminals can achieve significant financial gains.

Demo / Proof of Concept

▶ Watch: Weak physical security allows easy top-part access (6:38)

While Fredrik Sandstrom's talk did not feature a live, on-stage demonstration of an ATM hack, he presented a compelling and detailed real-world case study from Sweden that served as an impactful proof of concept. This "small heist from Sweden" vividly illustrates how the vulnerabilities discussed earlier can be exploited by criminals, even those without advanced technical skills.

The incident involved two non-technical individuals, described as "two Russian guys," who successfully robbed two ATMs. Their toolkit was rudimentary: "some pair of chisels, some gloves, and some crowbars." Their method directly exploited the physical weakness of the ATM's top compartment, which Sandstrom previously identified as being made of "thin sheets of metal." Instead of attempting to breach the robust cash vault, they focused on gaining access to the internal PC section.

Once inside, they leveraged a critical logical flaw: the lack of mutual authentication between the ATM's internal PC and its cash dispenser. Rather than interacting with the ATM's software or operating system, they connected a simple USB extension cable directly from their own laptop to the cash dispenser unit. This allowed them to bypass all of the ATM's internal security controls, including any firewalls, antivirus, or AppLocker configurations that might have been present on the ATM's PC.

On their laptop, the criminals had obtained and installed the legitimate vendor software typically used for dispensing money during maintenance or testing. This software, designed to control the dispenser, allowed them to initiate cash payouts directly. The police investigation later confirmed this, finding the laptop with the vendor software installed, indicating a level of prior knowledge or possibly insider assistance in obtaining the specialized tools.

The heist resulted in the theft of approximately $80,000. Sandstrom noted that the ATMs were not fully stocked, and had they been, the criminals could have potentially walked away with around $300,000. This example starkly contrasts with more destructive methods like using forklifts, explosives, or excavators, which Sandstrom briefly showed at the beginning of his talk. While effective, those methods are noisy, cause significant damage, and often result in "color on the bill," making the cash unusable. The Swedish heist, by comparison, was a more surgical, less destructive, and ultimately more profitable operation, demonstrating the efficacy of combining physical access with logical exploitation of ATM design flaws. It served as a powerful testament to the real-world impact of the vulnerabilities Sandstrom highlighted throughout his presentation.

Defensive Implications

▶ Watch: Buying ATM keys and practice machines online (7:50)

The vulnerabilities highlighted by Fredrik Sandstrom underscore a critical need for the banking industry to fundamentally re-evaluate and enhance its ATM security posture. The current approach, often driven by insurance policies and compliance rather than proactive defense, leaves significant gaps that can be readily exploited.

The most immediate and critical defensive measure is the universal implementation of disk encryption. Given that 30-40% of ATMs lack this basic protection, it represents a catastrophic single point of failure. Encrypting the hard drive would render stolen drives useless to attackers, preventing the exfiltration of sensitive transaction data and customer photos, and making it significantly harder to install persistent malware or jackpotting software via offline access or dual-booting.

Secondly, banks must drastically improve the physical security of the ATM's top compartment. This area, which houses the internal PC, should be secured with robust locks and thicker, reinforced metal, commensurate with the value of the assets it protects. Relying on simple, easily picked locks or thin sheet metal is an invitation for physical compromise. Regular audits of physical security mechanisms and the use of tamper-evident seals can also help detect attempted breaches.

Thirdly, enforcing mutual authentication between the ATM's internal PC and the cash dispenser is paramount. This would prevent attackers from directly connecting their own laptops to the dispenser and using vendor software to force cash payouts, as seen in the Swedish heist. Implementing cryptographic authentication between these two critical components ensures that only authorized, verified commands are processed by the dispenser.

Network security for ATMs requires a complete overhaul. The use of "home routers" with default credentials is unacceptable. Banks should deploy enterprise-grade networking equipment with robust security features, strong, unique credentials, and regularly updated firmware. All network traffic between the ATM and the bank's backend, especially transaction logs containing sensitive card numbers and PINs, must be encrypted using strong protocols (e.g., TLS/SSL). Additionally, network segmentation should be rigorously enforced, isolating ATMs from other network segments and limiting outbound connections to only necessary services. Open network ports that allow direct access to internal components like cameras must be closed or protected by strict access control lists.

Finally, a proactive approach to software patching and updates is essential. Sandstrom noted that exploits often remain viable for "one year after patching" due to infrequent updates. Banks must establish rigorous patch management policies, ensuring that operating systems, ATM application software, and firmware are updated regularly to address known vulnerabilities. This goes beyond simply "filling out papers correctly" for insurance and involves a commitment to continuous security improvement, driven by actual risk reduction rather than just compliance. Security teams should prioritize ATM security as a core component of their overall IT strategy, recognizing that these machines represent a significant attack surface for both financial theft and data exfiltration.

Key Takeaways

• ATMs are often just vulnerable PCs in a thin metal box: Despite their appearance, many ATMs run standard operating systems on easily accessible hardware, making them susceptible to common PC-based attacks.
• Standardization (XFS) benefits attackers: While intended for interoperability, the widespread adoption of XFS allows successful exploits or jackpotting software developed for one vendor to be easily adapted and used against others.
• Physical access to the top compartment is surprisingly easy: The upper section of ATMs, housing the internal computer, frequently has weak physical security, making it vulnerable to simple tools like chisels, crowbars, or readily available keys, bypassing the more secure cash vault.
• Lack of disk encryption and mutual authentication are critical, widespread flaws: A significant percentage (30-40%) of ATMs lack disk encryption, allowing easy data theft or malware installation via hard drive removal. The absence of mutual authentication between the PC and cash dispenser enables direct dispenser control from an attacker's laptop.
• Network-level vulnerabilities enable data theft and manipulation: Many ATMs use insecure network hardware (e.g., home routers), transmit unencrypted transaction data (including full credit card numbers), and have open ports that can be exploited for man-in-the-middle attacks or direct camera access.
• Banks' security posture is often driven by economics and insurance, not robust protection: There's a tendency to treat ATM security breaches as an insurance issue rather than a fundamental security failure, leading to delayed patching and insufficient investment in core defensive measures.

About the Speaker(s)

Fredrik Sandstrom is a highly experienced penetration tester with a decade of expertise in offensive security. He specializes in identifying and exploiting vulnerabilities across various systems, with a particular passion for ATM hacking. Sandstrom finds ATM security fascinating because it encompasses the entire spectrum of security challenges, from physical breaches and lockpicking to software exploitation and kiosk breakout techniques. His insights are drawn from extensive real-world engagements, offering a practical and candid view of the security landscape of financial machines.