ATM Hacking: Past and Present

The talk traces how ATM attacks have changed over time, starting with embossed cards and magnetic stripes. It explains how track two data is structured, why the discretionary field once protected card data, and how weak implementations allowed criminals to build valid track data without the bank's cryptographic material. Skimmers and the shift from physical data capture to online fraud are also covered.

The focus then moves to ATM internals. The speaker describes how exposed USB ports on some machines can give an attacker a route out of the vendor interface to the operating system, and how cash dispensers connected over USB can be commanded by specialised software that criminal markets sell. To make this concrete, the speaker takes a low-cost coin dispenser bought online without any software, captures its USB traffic with a sniffer, and uses an LLM to help interpret the request and response blocks into a working proof of concept.

The talk ends with a live demo of a standalone black box device that runs in USB host mode and triggers coin dispensing without a host computer, with Wi-Fi control discussed as a possibility. The takeaways point to checking exposed ports, not assuming vendor software is secure, and treating cash-handling hardware as an embedded target. The Q&A touched on quantum threats, contactless access and the role of the magnetic stripe today.