Leigh-Anne Galloway - Money makes money: How to buy an ATM and what you can do with it

### Overview In this presentation, Leigh-Anne Galloway discusses her experience acquiring a physical ATM for research and exhibition purposes at InfoSec 2017 on behalf of Positive Technologies. Coming from an incident response and payment card investigation background without prior ATM hardware experience, she explores the market landscape for purchasing ATMs, the intense logistical challenges of handling heavy cash machines, and the physical, hardware, OS-level, and network attack surfaces present in modern automated teller machines.

### Key Topics - **History and Market of ATMs**: Tracing ATM development from John Shepherd-Baron's 1967 prototype in Enfield (Barclays) to modern deployment of roughly 3.8 million units worldwide, Galloway outlines key manufacturers such as NCR and Wincor Nixdorf. - **Procurement Paths**: Galloway evaluated four avenues for obtaining a machine: grey market (eBay listings, medical used-goods liquidators), black market inquiries, a wildcard road-trip option importing an ATM from Russia to the UK, and legal procurement through ATM maintenance companies such as Testlink or SPC International. - **Logistics and Physical Handling**: Freestanding ATMs weigh between 700 and 1,000 kilograms (near a ton) due to reinforced steel vaults with concrete and steel fibers. Moving, powering, and storing an ATM posed extreme challenges, including destroyed concrete floors, outdoor power rigging, and courier lift limitations. - **Attack Vectors and Security Flaws**: Examination of brute force physical attacks, operating system vulnerabilities, application control bypasses, hardware tampering, and network exploitation.

### Technical Details - **Procurement Specifics**: Galloway purchased a refurbished freestanding machine from maintainer Testlink for approximately £3,200 (including VAT). She emphasizes understanding the distinction between "tested" units (no component guarantees) and "refurbished" units (every component refurbished), as well as ordering necessary internal cash cassettes holding roughly 1,800 to 2,000 notes per cassette across four denominations. - **Operating System Attacks**: ATMs predominantly run Windows XP (with newer models moving to Windows 7). Galloway demonstrated bypassing kiosk mode interfaces via hotkey combinations and keyboard navigation to reach the underlying OS and file system, noting that disabled mouse pointers can be easily circumvented with keys. Software-level malware frequently targets XFS (Extensions for Financial Services), which utilizes an open API. Application whitelisting controls can frequently be bypassed using vulnerable whitelisted executables. - **Hardware & Physical Attacks**: While vaults are heavily fortified, front facades are often made of weak plastic that can be cut through with basic household drills or bare hands to access internal PC cabling (such as USB connections). Galloway also highlighted connecting embedded systems (e.g., Arduino, Teensy) directly to the dispenser or PC inside the rear service area (via lockpicking without cosmetic damage) to issue direct dispensing commands. Network access vectors include intercepting unencrypted 3G/4G or leased-line infrastructure, deploying malware via OS update channels, or compromising VPN credentials.

### Takeaways Acquiring and compromising an ATM does not require elite or prohibitive skill, but handling the physical logistics and weight of the machine represents the biggest real-world obstacle. Galloway highlights that ATM security relies heavily on the physical bulk of the vault rather than robust internal computing protections, and points out that responsibility disputes between hardware vendors and banks often leave older hardware inadequately secured despite config-level hardening possibilities.