CAN ATM BE HACKED?

The attacks they tried are the typical types of exploits and tricks used by cyber-criminals seeking to obtain money from the ATM safe or to copy the details of users' bank cards (also known as skimming).
PT experts said that the typical "network attack" took under 15 minutes to execute, based on their tests.
But in case ATM hackers were looking for a faster way in, researchers also found that Black Box attacks were the fastest, usually taking under 10 minutes to pull off.

PT says that 69 percent of the ATMs they tested were vulnerable to such attacks and that on 19 percent of ATMs, there were no protections against Black Box attacks at all.
Another way through which researchers attacked the tested ATMs was by trying to exit kiosk mode --the OS mode in which the ATM interface runs in.

The PT team says this attack usually takes under 15 minutes, and that 76 percent of the tested ATMs were vulnerable.
Another attack, and the one that took the longest to pull off but yielded the highest results, was one during which researchers bypassed the ATM's internal hard drive and booted from an external one.

Researchers said that during their tests, which normally didn't take more than 20 minutes, they changed the boot order in the BIOS, booted the ATM from their own hard drive, and made changes to the ATM's normal OS on the legitimate hard drive, changes which could permit cash outs or ATM skimming operations.

The attack took under 15 minutes to execute, and researchers found that 42 percent of the ATMs they tested were vulnerable.



"More often than not, security mechanisms are a mere nuisance for attackers: our testers found ways to bypass protection in almost every case," the PT team said. "Since banks tend to use the same configuration on large numbers of ATMs, a successful attack on a single ATM can be easily replicated at greater scale."