ATM Penetration testing, Hackers have found different approaches to hack into the ATM machines. Programmers are not restricting themselves to physical assaults, for example, money/card catching, skimming, and so forth they are investigating better approaches to hack ATM programming.

An ATM is a machine that empowers the clients to perform keeping money exchange without setting off to the bank.

Utilizing an ATM, a client can pull back or store the money, get to the bank store or credit account, pay the bills, change the stick, redesign the individual data, and so on. Since the ATM machine manages money, it has turned into a high need focus for programmers and burglars.

In this article, we will perceive how do an ATM functions, security arrangements used to secure the ATMs, diverse sorts of infiltration testing to break down ATM security and a portion of the security best practices which can be utilized to evade ATM hack.

ATM Work Function :

Most of the ATMs have 2 input and 4 output. The card reader and keypad are input whereas a screen, receipt printer, cash dispenser, and the speaker are output.

There are for the most part two sorts of ATM’s which vary as indicated by the way they work. They can be called as

1.Rented line ATM
2.Dial-up ATM machines

Any ATM machine needs an information terminal with two data sources and four yield gadgets. Obviously, for this to happen there ought to likewise be the accessibility of a host processor. The host processor is important so that the ATM can interface furthermore speak with the individual asking for the money. The Internet Service Provider (ISP) additionally assumes an essential part in this activity. They go about as the passage to the halfway systems furthermore the bank PC.

Image Credit : HowstuffWorks

A rented line ATM machine has a 4-wire, indicate point committed phone line which assists in associating it with the host processor. These sorts of machines are favored in spots where the client volume is high. They are viewed as top of the line and the working expenses of this sort of a machine is high.

The dial-up ATM machines just has an ordinary telephone line with a modem and a toll free number. As these are typical associations their underlying establishment cost is less and their working costs just turn into a small amount of that of a rented line ATM.

The host is primarily claimed by the bank. It can likewise be claimed by an ISP. On the off chance that the host is possessed by the bank just machines that work for that specific bank will be upheld.

So what happens when a client embed his card to pull back the money?

1.Client’s record data is put away on the attractive portion of the card which is situated posterior of the card. The client embeds the card in card peruser.

The card peruser peruses the data from the attractive portion of the card. The information from this card is sent to the host processor which advances the data to client’s bank.

2.After the card is perceived, the client is requested that give the stick. The client enters the stick utilizing the keypad. The stick is encoded and sent to the host server. The record and stick are approved by the client’s bank. Once approved by the bank, the host server sends the reaction code to the ATM machine.

3.The client enters the add up to pull back. The ask for goes to the host processor. The host server sends the exchange demand to the client’s bank which approves the sum, pull back cutoff, and so forth. At that point subsidize exchange happens between client’s bank and host processor’s record. Once the exchange is done, the host processor sends the endorsement code to the ATM which permits the ATM machine to administer the money.

4.The application running on the ATM teaches the money container to administer the money. The money container has a component which considers every charge it leaves the allocator. This information identified with the exchange like record number, exchange id, time, sum, charge group, and so forth is logged to the log document. This log record is normally known as EJ log.

5. Amid the administering procedure, a sensor sweeps every bill for its thickness. This is to check if two bills are stuck together or if any bill is torn or collapsed. In the event that two bills are stuck together, then they are occupied to the reject receptacle.

ATM BPT Style Penetration Testing

Security professionals perform advanced penetration tests on automated teller machine (ATM) solutions in the financial sector. In most cases, serious security flaws are identified in the ATM configurations and associated processes.

ATMs test with our ‘Business Penetration Test’ (BPT) methodology, which simulates real attacks on ATM solutions. This includes carefully designed targeted attacks, which combines physical, logical and optionally social engineering attack vectors.

ATM security is often considered a complex area by IT security managers, who tend to focus more on the physical risks and less on the logical weaknesses in the operating system and application layer.

Meanwhile,  ATM security is a business area that often lacks holistic security assessments. Our ATM tests are based on this belief, and seek to paint a holistic ) picture of your ATM environment.

Physical controls

Many banks rely heavily on the assumption that physical access to their ATM solutions is effectively restricted. In the meantime repeated, illustrates how little effort is often required to gain unauthorized access to the ATM CPU, which controls the user interface and transaction device.

Logical controls

With physical access to the ATM CPU, authentication mechanisms can be bypassed to gain unauthorized access to the ATM platform.

With this access, an attacker may be able to steal credit card data that is stored in file systems or memory, without ever alerting the bank. Furthermore, experts able to demonstrate, this unauthorized access can be expanded from the ATM to the bank’s network and back-end servers by using the compromised ATM as an attack platform.

ATM solution management processes associated with third party service providers and application development vendors are often the golden key for an attacker, and can be included in the scope of our test to identify logical weaknesses in trust relationships that an attacker can exploit to compromise an ATM.

ATM ecosystem

An ATM solution and network form a complex ecosystem that consists of different vendors and responsible agents, both internal and external to the banking organization.

Due to the complexity of this ecosystem with its distributed roles and responsibilities that cross organizational boundaries, the areas associated with security risk are often overlooked. The ATM application itself, with its software updates, operating system patches, platform hardening, and networks, is often vulnerable to attacks.

These attacks are not necessarily sophisticated and often not included in standard penetration tests.

PCI DSS

The ATM environment is also part of the PCI DSS scope. However, only a part of the real life hacking attacks is entirely covered by PCI DSS and PA-DSS. The PCI SSC released the “ATM Security guideline” information supplement document in January 2013.

ATM Penetration testing

In ATM Penetration testing , As the number of ATM units increase, the machine is prone to hack attacks, robberies, fraud, etc. Most of ATMs are still using Windows XP which make this ATM an easy target for the hackers.

Electronic fund transfer has three components which are communication link, computer, and terminal (ATM). All three of the components must be secured to avoid the attack. We will look into the type of assessment we can perform to analyze the overall security of an ATM.

1. Vulnerability Assessment and Network Penetration Testing

VAPT are two types of vulnerability testing. The tests have different strengths and are often combined to achieve a complete vulnerability analysis. In short, Penetration Testing and Vulnerability Assessments perform two different tasks, usually with different results, within the same area of focus.

Vulnerability assessment tools discover which vulnerabilities are present, but they do not differentiate between flaws that can be exploited to cause damage and those that cannot. Vulnerability scanners alert companies to the pre-existing flaws in their code and where they are located.

These two activities are very common when dealing with ATM security. In network penetration testing we check for network level vulnerability in an ATM. Since ATM communicates with the back-end server, it has to be part of some network. By obtaining the IP address of the ATM, we can perform a network level penetration test.

As a security best practice, ATM network is segregated with another network of the bank. So the tester has to be part of the ATM network to reach the ATM IP and perform testing. Once in the ATM network, we can perform a Nessus scan to identify the open port, services running on them and vulnerabilities associated with the running services.

We can run full port NMAP scan to identify the TCP and UDP ports and services running on the ATM. Additionally, Nessus authenticated scan can be used to identify vulnerability associated with the installed components in the ATM OS like Adobe, Internet Explorer, etc.

The configuration audit deals with the hardening of the operating system. Most of the ATM runs the Windows OS. This OS must be hardened as per security best practices to reduce the attack surface for the attacker. Some of the areas we can look into while doing configuration audit are:

2. Application Security Audit:

An application security audit is an intensive, technical, unprivileged and privileged security test of an application and its associated components with a high percentage of manual testing and verification. Since unprivileged and privileged tests will be carried out, both the perspective of an outsider (e.g. hacker) and an insider are covered.

We can divide this activity into two categories:

a. Thick client application penetration testing: Majority of the ATM application are a thick client. We can perform an application penetration testing of this thick client application. Some of the test cases we can perform is:

b. Application Design Review: In this activity, we can check for security practices being followed in the application. Some of the test cases can be:

Assessment of ATM Security Solution Installed in the ATM:

What is ATM security solution?

Most of the ATMs run on Windows XP and 7. Patching individual ATM is a quite complex process. Since Windows XP is no longer supported by Microsoft, many ATM vendor uses security solution to mitigate the threats related to ATM attacks such as Malware-based attacks, OS-level vulnerabilities. These security solutions allow the ATM application to run in very restrictive environment with limited services and processes in the back end. Two of such security solutions are Mcafee Solidcore and Phoenix Vista ATM.

Mcafee Solidcore:

McAfee Application Control blocks unauthorized executables on servers, corporate desktops, and fixed-function devices. Using a dynamic trust model and innovative security features such as local and global reputation intelligence, real-time behavioral analytics, and auto-immunization of endpoints, it immediately thwarts advanced persistent threats—without requiring labor-intensive list management or signature updates.

Phoenix Vista ATM:

Phoenix Vista ATM is a product of Phoenix Interactive Design Inc .This solution integrates with the ATM application itself. This application works on file integrity check where any modification/tampering with the application related critical file will result in a system shutdown. This disallows any unauthorized program to modify the application specific file.

XFS (eXtensions for Financial Services) provides a client-server architecture for financial applications on the Microsoft Windows platform, especially peripheral devices such as ATMs which are unique to the financial industry. It is an international standard promoted by the European Committee for Standardization (known by the acronym CEN, hence CEN/XFS). XFS provides a common API for accessing and manipulating various financial services devices regardless of the manufacturer.

Vista ATM communicates with the XFS layer which gives commands to the hardware like cash dispenser of the ATM to dispense the cash. Any unauthorized modification in XFS files will trigger the Vista ATM application to restart the machine forcefully. The machine restarts 4-5 times, and after that, it goes into maintenance mode which does not allow the user to perform any transaction.

Pentesting Security Solutions: PCI Standards

The approach for testing security solution in ATM remains the same. The end objective is to gain access to OS or to fiddle with the application related file to see how does the application behave. An attacker after gaining access to OS can create a malware which can issue the command to system hardware using XFS components.

Some of the test cases that can be considered are:

Test cases related to access the OS and related file:

Security Best Practices to be followed for ATM

The banks can implement security best practices to reduce the attack surface for the attacker. This section can be categories into three categories:

 6 . Protection against logical attacks:

7 . Protection against fraud attacks:

For More about ATM skimming  attack protection Click here

Sources & Credits