It has been reported that a pair of security researchers have discovered two vulnerabilities in ATMs widely used across the United States that could allow a determined criminal to steal cash and customer data. They found the flaws in machines manufactured by Nautilus Hyosung America Inc., the largest provider of ATMs in the U.S. By gaining access to the same network as the target ATM, the researchers were able to obtain full control of the machine and bypass its security measures. They also discovered master keys to the ATMs for sale on Amazon.com.
All too often when attempting to secure software, there is a tendency to focus on external threats. This leaves the potential for internal threats to be either overlooked or deprioritised. This trust of internal systems and processes can lead to a false sense of security should anyone with the ability to gain access to the network, physical interfaces or maintenance software for a device attempt to breach the system.
\”In the case of an ATM machine, gaining access to the network used by the machine offers the potential for sensitive data access on many levels and should be a hardened environment. Hardening such an environment for an ATM deployed outside of a banking institution is particularly problematic as the safeguards present within a bank are often weaker. For this reason, those needing cash from an ATM should look to prioritise using ATMs within banks over those in retail or office settings.