Attack On Note Verifier  - Page 1
Forum section: electronics / general

author: Sionyn
author_rank: Frequent Contributor
timestamp: October 30, 2013, 10:34:57 pm
content: If you can physically access and modify a machine, you can change the way it behaves. Is this really news?Unless this attack is a buffer overflow or something when you put in a particularly formatted note, I don't see the issue. "Oh, you can bypass the bill checker if you break the machine open, pull the ROM chips, and put in new ROM chips!"The guy went and analyzed the firmware to discover how it worked, and then noted that you could bypass the check routines in it to always set the "good" pins high. About the only thing even mildly worrying is that there is apparently no crypto lock on the firmware, but a crypto lock on the firmware would be useless if you have physical access to the machine anyway, only slightly complicating the job of redesigning the internals, so that's not saying much. There's a reason these machines are secured with a lock and a sturdy metal case.http://threatpost.com/researcher-finds-method-to-insert-malicious-firmware-into-currency-validator/102746

author: amyk
author_rank: Super Contributor
timestamp: October 31, 2013, 02:08:06 pm
content: Quote from: Sionyn on October 30, 2013, 10:34:57 pmIf you have physical access you don't even need to know what the existing firmware is like - just write your own dummy.Nothing beats physical security...The only things these articles encourage are more locked-down platforms and extra complexity in the name of "security", but really just to give the corporations more control. (E.g. driver signing, EFI/secure boot, TPM, "trusted" computing, etc...)

author: tehmeme
author_rank: Regular Contributor
timestamp: October 31, 2013, 02:48:58 pm
content: These non-stories really do annoy me. It's not the non-story itself it's the willingness of the media to spread it around with out any critical thought. I've not seen an article yet that has mentioned this.I must be missing the point, if you have physical access, why not take the cash?Coincidentally, I found a huge security flaw in the banking system, if you are in a bank vault you could stuff your pockets with bank notes... ignore the fact that you have to get in and out.

author: Jon86
author_rank: Frequent Contributor
timestamp: October 31, 2013, 04:16:47 pm
content: I think the main thing is that they don't care if it's a stupid story, as long as they get peoples' attention they couldn't care less.

author: nctnico
author_rank: Super Contributor
timestamp: October 31, 2013, 04:46:12 pm
content: I wouldn't call it a stupid story. People working in stores, bars and restaurants are utterly clever to find a scheme which makes them money besides their usual wage and tips.

author: mamalala
author_rank: Unknown
timestamp: October 31, 2013, 06:36:23 pm
content: Quote from: nctnico on October 31, 2013, 04:46:12 pmNot to mention service personnel. In the past there have been more than one issues with those EC-Card payment terminals that you often find in stores. Some folks placed a bug inside that transmitted the relevant data of a card via an RF link. Those units looked OK, even the seal was original. Only by either opening them or by weighing them it could be found. Since those things happened in several markets, it stands to reason that some service person or someone in the distribution chain fiddled with them prior to sealing.I see no reason why such a thing could not happen with note acceptors as well.Greetings,Chris

author: kfitch42
author_rank: Frequent Contributor
timestamp: October 31, 2013, 06:50:21 pm
content: If I have physical access, then REing the firmware on the note acceptor seems rather convoluted. Attack the "communication" between the note acceptor and rest of the machine. This communication was DEAD SIMPLE in the one Dave tore down. Maybe install an RFID reader... just walk up to the machine and get free soda.

author: tehmeme
author_rank: Regular Contributor
timestamp: October 31, 2013, 07:02:34 pm
content: There's no argument over the fact that this can be done and illegal activity ensues.What's stupid is the way it is being reported, and the discussion being offered within those articles.There is no new threat nor new technology being used nor is any of this a secret. These are well known issues.To portray this as a new phenomenon is silly. To publish this as a public awareness piece is another issue altogether.

author: tehmeme
author_rank: Regular Contributor
timestamp: October 31, 2013, 07:08:08 pm
content: Quote from: kfitch42 on October 31, 2013, 06:50:21 pmAgreed, triggering the machine to vend is a much easier and direct method.Unless the culprit is using this ploy to drain the vending machine of change.

author: SeanB
author_rank: Super Contributor
timestamp: November 02, 2013, 05:08:11 pm
content: There was an instance at a bank of an ATM losing notes every month, random amounts. Turned out that one employee at the bank knew the key combinations at the front of the machine in service mode to test the note dispenser, and he would casually walk past the machine at some time and flip the switch to service. This did nothing to normal operation just allowed service mode keyboard operations. He then would " test" the dispenser and on the way back in flip the switch back to normal. Took them a few months to finally twig on why this was happening, and covertly install a camera to watch the machine rear. It was inside the banking hall public area with the front through a window into the public outside concourse area for all hours access but the rear of the machine with the open power and data and service panel was in the bank hall and was initially not covered by cameras. When this was discovered they took all the models of the same design and added an extra key operated service switch along with a key operated cover over the panel area to replace the toggle switch and open bay.

author: Whuffo
author_rank: Regular Contributor
timestamp: November 02, 2013, 05:52:13 pm
content: There was a time in the past when the USPS installed "self service" postal kiosks in mall parking lots. The bill acceptors were optical, like the one Dave tore down and it didn't take long for some creative folks to figure out that a photocopy of a bill would work. Many thousand of dollars were lost, and the authorities couldn't figure out who was doing it.Given the amount that was allegedly stolen (buy a stamp with a photo dollar, pocket the change) - there must have been dozens of people working those machines all night every night. Not me, but I knew folks who were involved - but I can't remember their names.