ATMs are among the channels banks use most to serve their customers. Besides being one of the most important channels, because they physically dispense cash to customers and provide access to the customer's account, many fraud cases occur at ATMs.
So can ATMs be hacked?
YES, they can be hacked. Illegal access to ATMs can be achieved either with an application or without using any application at all.
Situations that can leave ATMs open to illegal access:
- Widespread use of outdated and insecure software,
- Errors in network configurations
- Lack of physical security for the ATM's critical components
The most important reason behind these situations is that ATMs are computers running on old operating system versions such as Windows XP. This makes ATMs vulnerable to computer viruses and exploit-based attacks.
Because fraudsters know about these vulnerabilities, they open the ATM's casing, install malicious software on the computer, and can withdraw all of the cash in the ATM's safe with a single command. The best known of these malware strains is the "Tyupkin" malware.
What needs to be done to increase security?
- The best and most effective method available is to post a notice, in a suitable place on the ATM, stating that the ATM is equipped with hidden cameras and records video from every angle.
- First of all, the XFS standard needs to be renewed with an emphasis on security, and two-factor authentication should be applied between the device and the legitimate software. This will reduce the ability of attackers who withdraw money without authorization using trojans to gain direct control over ATM units.
- To prevent fraud, speed up investigation time, audit transactions, and improve service, it is important to integrate camera recordings with the ATM Central software. This way, various incidents can be caught and acted on instantly and automatically through this integration.
- Password protection and integrity checks should be applied to the data transmitted between all hardware units and the computers inside ATMs.
