7 sins of ATM protection against logical attacks Timur Yunusov - - PowerPoint PPT Presentation

▶
7 sins of atm
SMART_READER_LITE
LIVE PREVIEW

7 sins of ATM protection against logical attacks Timur Yunusov - - PowerPoint PPT Presentation

Sep 30, 2023 191 likes •653 views

7 sins of ATM protection against logical attacks Timur Yunusov Senior expert ptsecurity.com whoami Positive Technologies (from 2009) Application security researcher (from 2009) Banking systems

slide-1
SLIDE 1

Заголовок

ptsecurity.com

7 sins of ATM

protection against logical attacks

Timur Yunusov

Senior expert

slide-2
SLIDE 2

Заголовок whoami

  • Positive Technologies (from 2009)
  • Application security researcher (from 2009)
  • Banking systems security senior expert (from 2012)
  • Big fan of #nullcon
  • Always in search/research ;)
slide-3
SLIDE 3

Заголовок whoami

  • Positive Technologies (from 2009)
  • Application security researcher (from 2009)
  • Banking systems security senior expert (from 2012)
  • Big fan of #nullcon
  • Always in search/research ;)

10+ ATMs for the last year

slide-4
SLIDE 4

Заголовок ATM security assessment

slide-5
SLIDE 5

Заголовок 7 sins

  • Kiosk bypass techniques
  • Privilege escalation techniques
  • Application control software bypass
  • Network physical layer
  • Device management
  • Booting process
  • Logical vulnerabilities
  • OS / Software vulns /

Kiosk mode bypass

  • Network attacks
  • Hardware attacks

Hardware Network

OS

slide-6
SLIDE 6

Заголовок Blackbox

Blackbox is dead

slide-7
SLIDE 7

Заголовок Blackbox

Blackbox is dead

slide-8
SLIDE 8

Заголовок Blackbox

Blackbox is (almost) dead (for researchers)

Have strong crypto btw dispenser and OS? BB is not possible BB is possible Yes

slide-9
SLIDE 9

Заголовок Kiosk mode bypass

Kiosk mode bypass Windows XP/7

slide-10
SLIDE 10

Заголовок Kiosk mode bypass

  • Safe mode
  • Hotkeys
  • Windows Plug&Play
  • Race condition
slide-11
SLIDE 11

Заголовок Safe mode

  • F8 + Safe mode with command line
  • DS restore mode
  • AC/DC fun
slide-12
SLIDE 12

Заголовок Hotkeys

  • Win+R
slide-13
SLIDE 13

Заголовок Hotkeys

  • Win+R
  • Alt+Tab
  • Alt+F4
  • Alt+Shift+ESC
  • F1-F12
  • Shift x5 (Windows 7 only)
  • Win+(etc)

http://www.techrepublic.com/blog/windows-and-office/the- complete-list-of-windows-logo-keyboard-shortcuts/

slide-14
SLIDE 14

Заголовок AlwaysOnTop

This ATM is Out Of Service, Sorry for inconvenience

slide-15
SLIDE 15

Заголовок AlwaysOnTop

  • Disabling mouse icon
  • AlwaysOnTop

This ATM is Out Of Service, Sorry for inconvenience

slide-16
SLIDE 16

Заголовок P&P

slide-17
SLIDE 17

Заголовок P&P

slide-18
SLIDE 18

Заголовок P&P video/screenshot

slide-19
SLIDE 19

Заголовок End of the story

slide-20
SLIDE 20

Заголовок Privilege escalation techniques

  • How exactly we extract money?
slide-21
SLIDE 21

Заголовок Privilege escalation techniques

  • FS restrictions
  • Local Security Policy restrictions
slide-22
SLIDE 22

Заголовок Privilege escalation techniques

  • Arbitrary command execute
  • XFS API
  • Command execute
  • priv escalation
  • Write files/registry
  • modify sec configs
slide-23
SLIDE 23

Заголовок Privilege escalation techniques

  • Arbitrary command execute
  • XFS API
  • Command execute
  • priv escalation
  • Write files/registry
  • modify sec configs
  • Read files
  • ***
slide-24
SLIDE 24

Заголовок App control software bypass

Story so far…

  • https://evi1cg.me/archives/AppLocker_Bypass_Techniques.html
  • https://cansecwest.com/slides/2016/CSW2016_Freingruber_Bypassi

ng_Application_Whitelisting.pdf

slide-25
SLIDE 25

Заголовок Security software bypass

  • McAfee Solidcore - https://www.ptsecurity.com/ww-en/about/news/131496/
  • MS Applocker - http://www.blackhillsinfosec.com/?p=5257 – State of Art!
  • etc (6 total different products) – stay tuned!
  • 0days (5 total, in process of fixing): network, local, logical
  • Misconfiguration
  • Whitelist Memory Execution: IE, rundll32, powershell, java, etc
slide-26
SLIDE 26

Заголовок Security software bypass

slide-27
SLIDE 27

Заголовок Network

+ Firewall

VPN TLS MAC

  • OS services
  • Software services (Solidcore, UPDD, etc)
  • Processing
  • Track2
  • Processing
  • Track2
  • Processing
slide-28
SLIDE 28

Заголовок Network vulns

  • VPN disabling
  • Logical vulns part
  • TLS disabling
  • MAC disabling
  • Files/registry manipulations
slide-29
SLIDE 29

Заголовок Network/Hardware layer

  • 3G industrial modem
  • Long story short

http://blog.ptsecurity.com/2015/12/critical- vulnerabilities-in-3g4g-modems.html

  • Security measures
  • VPN channel
  • Private APN
  • Result
  • ATM network infection
  • Processing access
slide-30
SLIDE 30

Заголовок Network/Hardware layer

  • Access to *:80
  • Auth bypass
  • Physical access
  • Proper VPN protocols(((
slide-31
SLIDE 31

Заголовок Device mgmt

How to do all hacking stuff much easier?

slide-32
SLIDE 32

Заголовок Device mgmt

  • Keyboard/mouse
  • Teensy
  • Network card
  • fw bypass
  • plug&play
  • USB drive
  • local access to Exe file content
  • plug&play
  • MS13-081
slide-33
SLIDE 33

Заголовок Booting process

The easiest way is…

slide-34
SLIDE 34

Заголовок Booting process

  • BIOS pwd
  • Network load
  • Safe mode
  • Physical access
  • OS access
  • Same passwords story
  • Bootkit
  • Software skimming
slide-35
SLIDE 35

Заголовок Logical vulns

How it happened?

slide-36
SLIDE 36

Заголовок Logical vulns

  • Security tools runs from regedit/autorun
  • Shift x5
  • Win+U
  • Security race condition
  • Hash(loooooooong file)
  • exploit.exe at the same time
  • Ctrl+C
slide-37
SLIDE 37

Заголовок Logical vulns

slide-38
SLIDE 38

Заголовок Logical vulns

  • VPN disabling
slide-39
SLIDE 39

Заголовок Logical vulns

  • FS access is strictly prohibited
slide-40
SLIDE 40

Заголовок Logical vulns

  • FTP is strictly prohibited!
slide-41
SLIDE 41

Заголовок Summary

Windows 7 SP1 ATM Windows XP SP3 ATM

Kiosk bypass Hotkeys/Safe mode KeyboardDisabler bypass App control bypass 0day/Trusted soft Untrusted booting Privilege escalation 0day/MS15-051 Untrusted booting VPN/TLS disabling Misconfiguration/FS Untrusted booting Social Engineering Misconfiguration/FS

  • Untrusted boot

BIOS accessing from OS No password Network attacks MAC/TLS/VPN/App service MAC/TLS/VPN/OS services

slide-42
SLIDE 42

Заголовок How all that happens?

  • Security through obscurity is not an option!
  • You should know your landscape and your threat model
  • Use compliance management tools instead of paper
  • In case of impossibility of fixing vulns, use

mitigation measures like SIEM

slide-43
SLIDE 43

Заголовок Greetz

  • Anon guy ;-)
  • Positive Technologies researchers teams:
  • ICS/SCADA
  • Reverse Engineering
  • Banking security
slide-44
SLIDE 44

Заголовок Contacts

http://uk.linkedin.com/in/tyunusov tyunusov@ptsecurity.com a66at

slide-45
SLIDE 45

Заголовок

Thank You!

ptsecurity.com