ATM Penetration testing, Hackers have found different approaches to hacking into ATM machines.

Programmers are not restricting themselves to physical assaults, for example, money/card catching, skimming, and so forth they are investigating better approaches to hack ATM programming.

An ATM is a machine that empowers clients to perform keeping money exchange without setting off to the bank.

Utilizing an ATM, a client can pull back or store the money, get to the bank store or credit account, pay the bills, change the stick, redesign the individual data, and so on.

Since the ATM machine manages money, it has turned into a high-need focus for programmers and burglars.

In this article, we will perceive how an ATM functions, security arrangements used to secure the ATMs, diverse sorts of infiltration testing to break down ATM security, and a portion of the security best practices which can be utilized to evade ATM hacks.

Also Read ATM Black box attacks – ATM Jackpotting

ATM Work Function :

Most of the ATMs have 2 inputs and 4 outputs. The card reader and keypad are input whereas a screen, receipt printer, cash dispenser, and speaker are output.

There are for the most part two sorts of ATMs which vary as indicated by the way they work. They can be called as

1. Rented line ATM
2. Dial-up ATM machines

Any ATM machine needs an information terminal with two data sources and four yield gadgets.

Obviously, for this to happen there ought to likewise be the accessibility of a host processor. The host processor is important so that the ATM can interface and furthermore speak with the individual asking for the money.

The Internet Service Provider (ISP) additionally assumes an essential part in this activity. They go about as the passage to the halfway systems and furthermore the bank PC.

Image Credit: HowStuffWorks

A rented line ATM machine has a 4-wire, indicate point committed phone line which assists in associating it with the host processor.

These sorts of machines are favored in spots where the client volume is high. They are viewed as top of the line and the working expenses of this sort of machine is high.

The dial-up ATM machines just have an ordinary telephone line with a modem and a toll-free number.

As these are typical associations their underlying establishment cost is less and their working costs just turn into a small amount of that of a rented line ATM.

The host is primarily claimed by the bank. It can likewise be claimed by an ISP. On the off chance that the host is possessed by the bank just machines that work for that specific bank will be upheld.

Aso Read    Undetectable ATM “Shimmers” Hacker’s Latest Tool for Steal your Chip-Based Card Details

So what happens when a client embeds his card to pull back the money?

1. Client’s record data is put away on the attractive portion of the card which is situated posterior of the card. The client embeds the card in card peruser.

The card peruser peruses the data from the attractive portion of the card. The information from this card is sent to the host processor which advances the data to the client’s bank.

2. After the card is perceived, the client is requested that give the stick. The client enters the stick utilizing the keypad. The stick is encoded and sent to the host server.

The record and stick are approved by the client’s bank. Once approved by the bank, the host server sends the reaction code to the ATM machine.

3. The client enters the add-up to pull back. The ask goes to the host processor. The host server sends the exchange demand to the client’s bank which approves the sum, pull-back cutoff, and so forth.

At that point subsidize exchange happens between the client’s bank and the host processor’s record. Once the exchange is done, the host processor sends the endorsement code to the ATM which permits the ATM machine to administer the money.

4. The application running on the ATM teaches the money container to administer the money. The money container has a component that considers every charge it leaves the allocator.

This information identified with the exchange like record number, exchange id, time, sum, charge group, and so forth is logged to the log document. This log record is normally known as an EJ log.

5. Amid the administering procedure, a sensor sweeps every bill for its thickness.

This is to check if two bills are stuck together or if any bill is torn or collapsed. In the event that two bills are stuck together, then they are occupied to the reject receptacle.

Also Read A Fileless Malware Called “ATMitch” Attack The ATM machines Remotely and Delete The Attack Evidence

ATM BPT Style Penetration Testing

Security professionals perform advanced penetration tests on automated teller machine (ATM) solutions in the financial sector.

In most cases, serious security flaws are identified in the ATM configurations and associated processes.

ATMs test with our ‘Business Penetration Test’ (BPT) methodology, which simulates real attacks on ATM solutions.

This includes carefully designed targeted attacks, which combine physical, logical, and optionally social engineering attack vectors.

ATM security is often considered a complex area by IT security managers, who tend to focus more on the physical risks and less on the logical weaknesses in the operating system and application layer.

Meanwhile,  ATM security is a business area that often lacks holistic security assessments. Our ATM tests are based on this belief, and seek to paint a holistic ) picture of your ATM environment.

Physical controls

Many banks rely heavily on the assumption that physical access to their ATM solutions is effectively restricted.

In the meantime repeated, illustrates how little effort is often required to gain unauthorized access to the ATM CPU, which controls the user interface and transaction device.

Logical controls

With physical access to the ATM CPU, authentication mechanisms can be bypassed to gain unauthorized access to the ATM platform.

With this access, an attacker may be able to steal credit card data that is stored in file systems or memory, without ever alerting the bank.

Furthermore, experts able to demonstrate, this unauthorized access can be expanded from the ATM to the bank’s network and back-end servers by using the compromised ATM as an attack platform.

ATM solution management processes associated with third-party service providers and application development vendors are often the golden key for an attacker and can be included in the scope of our test to identify logical weaknesses in trust relationships that an attacker can exploit to compromise an ATM.

ATM ecosystem

An ATM solution and network form a complex ecosystem that consists of different vendors and responsible agents, both internal and external to the banking organization.

Due to the complexity of this ecosystem with its distributed roles and responsibilities that cross organizational boundaries, the areas associated with security risk are often overlooked.

The ATM application itself, with its software updates, operating system patches, platform hardening, and networks, is often vulnerable to attacks.

These attacks are not necessarily sophisticated and often not included in standard penetration tests.

PCI DSS

The ATM environment is also part of the PCI DSS scope. However, only a part of the real-life hacking attacks is entirely covered by PCI DSS and PA-DSS.

The PCI SSC released the “ATM Security Guideline” information supplement document in January 2013.

ATM Penetration testing

In ATM Penetration testing, As the number of ATM units increases, the machine is prone to hack attacks, robberies, fraud, etc. Most ATMs are still using Windows XP which makes this ATM an easy target for hackers.

Electronic fund transfer has three components which are a communication link, a computer, and a terminal (ATM). All three of the components must be secured to avoid the attack.

We will look into the type of assessment we can perform to analyze the overall security of an ATM.

1. Vulnerability Assessment and Network Penetration Testing

VAPT are two types of vulnerability testing. The tests have different strengths and are often combined to achieve a complete vulnerability analysis.

In short, Penetration Testing and Vulnerability Assessments perform two different tasks, usually with different results, within the same area of focus.

Vulnerability assessment tools discover which vulnerabilities are present, but they do not differentiate between flaws that can be exploited to cause damage and those that cannot.

Vulnerability scanners alert companies to the pre-existing flaws in their code and where they are located.

These two activities are very common when dealing with ATM security. In network penetration testing we check for network-level vulnerability in an ATM.

Since ATM communicates with the back-end server, it has to be part of some network. By obtaining the IP address of the ATM, we can perform a network-level penetration test.

As a security best practice, the ATM network is segregated from another network of the bank. So the tester has to be part of the ATM network to reach the ATM IP and perform testing.

Once in the ATM network, we can perform a Nessus scan to identify the open port, services running on them, and vulnerabilities associated with the running services.

We can run a full port NMAP scan to identify the TCP and UDP ports and services running on the ATM.

Additionally, Nessus authenticated scan can be used to identify vulnerabilities associated with the installed components in the ATM OS like Adobe, Internet Explorer, etc.

The configuration audit deals with the hardening of the operating system. Most of the ATMs run the Windows OS.

This OS must be hardened as per security best practices to reduce the attack surface for the attacker. Some of the areas we can look into while doing a configuration audit are:

• System access and authentication: Checks related to password and account lockout policy, User rights policy, etc.
• Auditing and logging: Checks related to the event, application and security logs, audit policy, and permission on event logs.
• Account configuration: Checks related to users under the administrator group, the presence of default users, guest accounts, password requirement, and expiration.

2. Application Security Audit:

An application security audit is an intensive, technical, unprivileged, and privileged security test of an application and its associated components with a high percentage of manual testing and verification.

Since unprivileged and privileged tests will be carried out, both the perspective of an outsider (e.g. hacker) and an insider are covered.

We can divide this activity into two categories:

a. Thick client application penetration testing: The majority of ATM applications are thick clients. We can perform application penetration testing of this thick client application. Some of the test cases we can perform are:

• Sensitive information in application configuration files, credentials in the registry, sensitive information, hardcoded in code.
• Intercept the traffic going to the server and try to manipulate/ tamper with the parameters or look for any sensitive information passing between the application and the server.
• Check if the application and database are communicating in cleartext protocol.
• Protection from Reverse Engineering.

b. Application Design Review: In this activity, we can check for security practices being followed in the application. Some of the test cases can be:

• Types of events logged to the log file.
• The privilege with which the ATM application is running.
• Does the software have a provision to restrict different menu options to different user IDs based on user level?
• Access the application-related folders.
• Does the application allow the transaction without a pin or with an old pin?
• Does the application allow the access to OS while running?
• Communication with back-end components.
• Check for effective network isolation.
• Logging out of a customer in case of even a single invalid pin?
• PIN entry for each and every transaction is Mandatory?

Assessment of ATM Security Solution Installed in the ATM:

What is an ATM security solution?

Most of the ATMs run on Windows XP and 7. Patching individual ATM is a quite complex process.

Since Windows XP is no longer supported by Microsoft, many ATM vendor uses security solution to mitigate the threats related to ATM attacks such as Malware-based attacks, and OS-level vulnerabilities.

These security solutions allow the ATM application to run in a very restrictive environment with limited services and processes in the back end.

Two such security solutions are Mcafee Solidcore and Phoenix Vista ATM.

Mcafee Solidcore:

McAfee Application Control blocks unauthorized executables on servers, corporate desktops, and fixed-function devices.

Using a dynamic trust model and innovative security features such as local and global reputation intelligence, real-time behavioral analytics, and auto-immunization of endpoints, it immediately thwarts advanced persistent threats—without requiring labor-intensive list management or signature updates.

• Complete protection from unwanted applications with coverage of executable files, libraries, drivers, Java apps, ActiveX controls, scripts, and specialty code.
• Flexibility for desktop users and server admins with self-approval and auto-approval based on application rating.
• Viable security for fixed-function, legacy, and modern systems.
• Patch cycle reduction and advanced memory protection.
• Centralized, integrated management via McAfee ePolicy Orchestrator.

Phoenix Vista ATM:

Phoenix Vista ATM is a product of Phoenix Interactive Design Inc. This solution integrates with the ATM application itself.

This application works on file integrity checks where any modification/tampering with the application-related critical file will result in a system shutdown.

This disallows any unauthorized program to modify the application-specific file.

XFS (eXtensions for Financial Services) provides a client-server architecture for financial applications on the Microsoft Windows platform, especially peripheral devices such as ATMs which are unique to the financial industry.

It is an international standard promoted by the European Committee for Standardization (known by the acronym CEN, hence CEN/XFS).

XFS provides a common API for accessing and manipulating various financial services devices regardless of the manufacturer.

Vista ATM communicates with the XFS layer which gives commands to the hardware like the cash dispenser of the ATM to dispense the cash.

Any unauthorized modification in XFS files will trigger the Vista ATM application to restart the machine forcefully.

The machine restarts 4-5 times, and after that, it goes into maintenance mode which does not allow the user to perform any transaction.

Pentesting Security Solutions: PCI Standards

The approach for testing security solutions in ATMs remains the same. The end objective is to gain access to OS or to fiddle with the application-related file to see how the application behaves.

An attacker after gaining access to OS can create malware which can issue the command to system hardware using XFS components.

Some of the test cases that can be considered are:

Test cases related to accessing the OS and related files:

• Check if USB is enabled, make your USB bootable.
• Plug in the USB and boot the system through USB.
• Since most of the security solutions take over the OS as soon as it boots, keep on pressing the “Shift” button at boot time. This will break any sequence configured to run at boot in OS. This will result in a Windows login screen.
• If you are aware of a valid username, then enter that and press the “Enter” button. This will result in direct access to the OS without a password.
• If you are not aware of a valid username, try login with “Administrator” as many ATMs do not disable the default administrator account.

Another way is to make your USB bootable. Boot from USB, this will give access to the file system directly without any Windows login.

• Test related to runtime code authorization: Check if USB is enabled, and try to run unauthorized code (exe or batch file) directly from the USB or using the autorun feature of the USB.
• Test related to code protection: Check if application-related files can be moved to another location, modified, or deleted.
• Checks related to process modification: Rename unauthorized files to a valid security solution process. This will result in the execution of an unauthorized file when the application starts.
• Threats related to unauthorized execution through the registry: Check if any critical registry key can be modified or unauthorized software can be executed by keeping them in the Windows startup folder.
• Executables under the Windows startup folder will execute first when the system restarts.
• Security Best Practices to be Followed for ATThe banks can implement security best practices to reduce the attack surface for the attacker. This section can be categorized into three categories:
• Protection against physical attacks:

• Detection and protection against Card skimming.
• Detection and protection against card/ cash trapping.
• Detection against keypad tampering.
• Mirror and pin shield to identify and prevent shoulder surfing attack.
• Implementing a DVSS camera inbuilt into the ATM to capture the facial features of the user along with transaction details and timestamps.
• Vault protection against fire, explosion, etc.
• Lock protection again unauthorized access to banknotes or bills.
• Electric power point and network point protection.
• Disabling unused network and electric port.
• The ATM must be grouted on the floor to secure it against threats related to the robbery. ATM can be implemented with a shock sensor to identify the impact and movement of the ATM machine.
• Implementation of CCTV cameras. The presence of security guards.

• Protection against logical attacks:

• Protection against unauthorized booting by setting non-guessable boot and BIOS passwords. Most ATMs have a default boot password configured.
• Protection against USB and unauthorized hard disk access.
• OS hardening and the latest patch.
• Whitelisting the application, services, and process on ATM.
• Running ATM with a least privileged user. Need to know and need to have an approach.
• File integrity checks.
• Securing the transaction logs.
• Use of secure channels for communication and transaction.
• Configure security best practices in ATM applications.
• Antivirus protection.
• ATM network segregation with other networks.
• Protection against Malware like tyupkin, ploutus, etc.

• Protection against fraud attacks:

• Implementation of geo-blocking. In this implementation, the card can only be used in originating country or region. The user has to take permission to use the card outside the originating country.
• Implementation of chip and pin-based cards to mitigate copied and skimming card-based attacks.
• Implementing a behavior mentoring that detects the unusual transaction in terms of the amount, place of transaction, frequency of transaction, etc.

For More about ATM skimming  attack protection Click here

Sources & Credits

https://www.pcisecuritystandards/pdfs/PCI_ATM_Security_Guidelines_Info_Supplement.pdf

http://money.howstuffworks.com/personal-finance/debt-management/credit-card.htm

Also Learn: Complete Network & WiFi Hacking Bundle