ATMs Face Deadline to Upgrade From Windows XP

[A Guy]

One-dollar bills. Envelope-free deposits. Stamp dispensers. These are a few of the features that Wells Fargo (WFC), Bank of America (BAC), JPMorgan Chase (JPM), and other banks tout as the latest and greatest features of their fleets of ATMs. It’s hardly stuff to set the heart racing.

When ATMs were introduced more than 40 years ago, they were considered advanced technology. Today, not so much. There are 420,000 ATMs in the U.S., and on April 8, a deadline looms for nearly all of them that underscores how sluggishly the nation’s cash delivery system moves forward. That’s the day Microsoft (MSFT) cuts off tech support for Windows XP, meaning that ATMs running the software will no longer receive regular security patches and won’t be in compliance with industry standards. Most machines that get upgraded will shift to Windows 7, an operating system that became available in October 2009. (Some companies get a bit of a reprieve: For ATMs using a stripped-down version of XP known as Windows XP Embedded, which is less susceptible to viruses, Microsoft support lasts until early 2016.)

Source

A Guy

 

[HerrKaLeun]

Good to know my personal data PIN etc. are protected by a modern and secure OS....

 

[alphanumeric]

I think you'll find that that's Windows XP Embedded. Nothing except the OS is actually stored on the ATM. The info is all on the server the ATM talks to when you use it. A lot of POS terminals use it too, like supermarket cash registers. They'll be in the same boat.

 

[HerrKaLeun]

I think you'll find that that's Windows XP Embedded. Nothing except the OS is actually stored on the ATM. The info is all on the server the ATM talks to when you use it. A lot of POS terminals use it too, like supermarket cash registers. They'll be in the same boat.

so who stops anyone to intercept that information? Or to implement a malware that also communicates the information elsewhere? At the moment i enter my PIN in the ATM, it is in the ATM on an outdated insecure OS.

i guess all the bailout money went to CEO bonuses after all, certainly not into security.

 

[alphanumeric]

As far as I know it's a dedicated phone line from the ATM to the server. Communication is also encrypted. You would have to gain physical access to the internals to infect it with malware. They are not connected to the internet if that's what your thinking. There may not even be a hard drive, with an embedded system it could all be on flash ROM. It's not nearly as insecure as your thinking. It's quit a bit different from the XP you run on your home PC.

 

[HerrKaLeun]

As far as I know it's a dedicated phone line from the ATM to the server. Communication is also encrypted. You would have to gain physical access to the internals to infect it with malware. They are not connected to the internet if that's what your thinking. There may not even be a hard drive, with an embedded system it could all be on flash ROM. It's not nearly as insecure as your thinking. It's quit a bit different from the XP you run on your home PC.

There recently was the case where criminals drilled a hole in the ATM to access the USB port of the MB. they inserted a USB stick to upload their own version of the OS with malware. I'm not sure if they had to come back to download the data it logged, or managed to send it somehwere. I know this requires quite some insider knowledge, but ATM are not 100% safe and having an insecure OS doésn't help.

and if the OS securit doesn't matter becasue on encryption and dedicated phoen line, why are they replacing it at all? If you theory is true, they coudl run XP indefinitely (or at least till they get a new ATM).

I'm not saying you are wrong and I'm not an expert, but having an outdated OS is a risk.

 

[alphanumeric]

It all comes down to "what risk"? If said PC never ever connects to the Internet then you would have to have physical access to it to infect it with malware. The majority of security patches issued by Microsoft are to fix flaws that could be exploited from the Internet. If said PC never connects to the Internet where is the risk. I'm not saying they shouldn't dump XP for a more secure OS, but in the case of an ATM you need to put some perspective on it. They likely don't patch ATM machines every patch Tuesday like you do your home PC, there is no need for it. The hardware is fixed and so is the software.

For someone to do what you posted means they would have to have insider info. It's a little more involved to setup a Windows XP embedded setup than it is to just install XP on your home PC. They would also have to have ATM program code that makes the ATM an ATM. It's a very custom image. It's likely very hard for you to get your hands on it even if you work for the bank of the company that makes the ATM's.

What I read from the article is that they "should" upgrade the ATM, not that they necessarily will. That's my spin on it anyway. I'm not going to lose any sleep over it.

 

[Solarstarshines]

If your smart start stockpiling money at home in a safe and use prepaid cards seems they know about this but don't care about the risk and the customers will be left screwed

 

[Alejandro85]

Once again we must heard that from MS. When they finally drop support for XP, everthing will continue to run exactly the same as it was the day before it, nothing will break nothing will change (for good or bad). For the final user, MS support means ABSOLUTE NOTHING. I wonder how many times the bank IT guys have actually called them

XP is a great OS, contrary to the MS auto-FUD in favor of 7/8, and when properly configured it can be quite safe is used correctly. Of course, the default configuration is wide open to many security flaws which can easily be solved. The very same thing exists in latter versions too, a bit reduced.
And we must not forget that MS business is precisely that, to promote "upgrades" so that they charge the full price again for the same program with a few more features (that banks in particular will never use), so it's natural they boycott their older programs in favor of newer ones.

Security? Common! Banks are using Windows!!! If they REALLY want a secure system, they would use some Linux-based OS for their terminals, not Windows to begin with. A few lacking updates and patches for a very closed system will not make a real difference, more considering those computers aren't exposed to regular users, except in very limited, tightly controlled ways.

 

[kbrady1979]

I work in a facility that houses 6 ATM's owned and maintained by a large regional bank and I occasionally have to work on them. I know they can use a dial-up service to function, but they can also work with a wireless connection....which absolutely blew my mind when I first learned this. Windows XP is vulnerable enough as-is and as far as I know massive ATM hacking hasn't presented itself so obviously it's not that easy to do. I don't trust the "encryption" that is suppose to keep all of this traffic safe because we see and hear stories everyday of how little encryption business and services actually use/employ.....70+ million Target customers now understand that.

I say upgrade to Windows 7 Embedded machines and be done with it. These old ATM machines have served their purpose, time to put them out to pasture.

Also, I was in tech classes with a guy that worked with the local banks and he said the "sensitive" data was handled by Linux based systems.....fwiw.

 

[Computer0304]

I hope my bank is not one of these affected banks. It isn't one of the big national banks.

 

[Lady Fitzgerald]

ATMs and gas pumps have been known to have skimmers attached to them. Often, a hidden camera will be placed so people punching in PINs can be watched. The ATM skimmers are obvious if you are familiar with what the ATM normally looks like. The gas pump skimmers can be sneakier if the crook has a key and can install the skimmer inside. Those keys are easy to come by. I used to have one when I worked for a convenience store. It would have been no trick to have made a copy of it.

 

[Iforgot]

ATMs and gas pumps have been known to have skimmers attached to them. Often, a hidden camera will be placed so people punching in PINs can be watched. The ATM skimmers are obvious if you are familiar with what the ATM normally looks like. The gas pump skimmers can be sneakier if the crook has a key and can install the skimmer inside. Those keys are easy to come by. I used to have one when I worked for a convenience store. It would have been no trick to have made a copy of it.

Or the case of the swopped over pinpad as per McDonalds a while again, (Not sure if it was Mc's or someone similar)
Whereas the pinpad was changed, while the staff was not looking then retrieved at a later date, again while the staff we distracted. then the info was pulled out of the pinpad.
The pinpads were logging accounts and pin numbers.

On any decent system a changed pinpad would be tagged by the admins for access privileges. ie won't do nothing until it's reg'd.

Whether it's dialup or adsl or dedicated line, it should be a registered line/line number or it will have to go though a variety of firewalls, usually Linux based. (Or really should be Linux based)
And even then, anything that can access banks has to be a closed system..... ie no external/internet access, even through firewalls.

Which embedded O/S is irrelevant, it only has drivers for what it's built to do are installed, any other extras should/would be tagged for investigation by the admins, and not allowed until given the rights from the security/network admins.

As to plug in an extra usb device, as above.

 

[smarteyeball]

You thought XP was bad?

My neighbour used to be an ATM tech ~4-5 years ago and some of those ATMs he dealt with were still using Win 3.1 ...

 

[andrew129260]

Wow! Thats really bad!

Nope wait, a popular retail chain uses dos.

 

[King Arthur]

You thought XP was bad?

My neighbour used to be an ATM tech ~4-5 years ago and some of those ATMs he dealt with were still using Win 3.1 ...

If I recall, I believe Windows 3.1 was officially still in support until fairly recently for embedded applications such as ATMs and the in-flight entertainment systems of airliners.