DEF CON 33 - Take all my money – penetrating ATMs - Fredrik Sandstom

The video explores ATM security flaws, emphasizing that many ATMs remain vulnerable due to poor encryption and lack of mutual authentication, enabling hackers to extract cash via simple physical access or network manipulation. A key takeaway is that over 30–40% of ATMs lack disk encryption, making them easy targets for jackpotting software.

Key Takeaways:
• Physical access is often easier than technical attacks; thin metal tops can be breached with tools like shishels or crowbars 17:36–17:55.
• Most ATMs lack mutual authentication between cash dispenser and PC, allowing attackers to connect a USB extension cable and dispense cash without touching the PC 18:06–18:20.
• Many ATMs use unencrypted, home-router-style network gear, exposing transaction logs and camera feeds to attackers 13:00–13:25.
• A real-world heist in Sweden involved two non-technical criminals who used basic tools and exploited missing authentication to extract ~$160,000 in cash 17:02–17:30.
• Banks often prioritize insurance over security, leading to delayed patches and continued vulnerabilities 20:17–20:34.

Attackers can bypass security by exploiting poor physical design, unencrypted networks, and weak authentication—making ATM hacking a persistent, real-world threat despite vendor standardization efforts.

Sources:

• 17:36–17:55 Physical access methods like shishels and crowbars are common and effective.
• 18:06–18:20 Lack of mutual authentication allows USB-based cash dispensing without PC access.
• 13:00–13:25 Unsecured