Flaw in popular ATMs allows criminals to steal cash and your data

From Komando.com (Nov. 12):

ATMs are supposed to be a safe, convenient way for people to access their money. At least, they are in theory — but hackers, as always, have other ideas.

A team of security researchers has discovered two critical security flaws in some of the most common ATMs in America. With a bit of malicious code, a hacker can easily steal all the cash from an ATM. Worse still, the second flaw gives total access to an ATM’s data — which means a hacker could siphon up the information of anyone who’s ever used it.

…………..

If you think you’re safe when you visit an ATM, think again. Here’s what you need to know about this dangerous ATM flaw before hackers are able to take advantage of it.

Bank ATMs let you “apply for a pwn”

According to new reports from Bloomberg, a pair of researchers from Red Balloon Security found a two critical security flaws in ATMs manufactured by Nautilus Hyosung America Inc. This company is the largest provider of ATMs in the United States, and their machines are found in most major banks.

The researchers found that with access to the same network as the ATM, they were able to hijack its system and completely take the machine over. These vulnerabilities allowed the researchers to bypass any security software, giving them them plenty of opportunity to wreak havoc.

One vulnerability is in the software that powers the ATM’s accessories — such as the cash dispenser, PIN pad and card reader. By cracking this exploit, the researchers found plenty of areas where malicious code could be injected. This would allow the hacker to theoretically empty the ATM of all its cash. [read more]