07.29.10

Gemini version available ♊︎

Why Crackers Prefer Windows on Cash Machines

Posted in Microsoft, Security, Windows at 11:02 am by Dr. Roy Schestowitz

ATM pinpad in German

Summary: Windows makes a lot of money for the bad guys, who are exploiting Windows-based ATMs

ATMs that run Windows are running for criminals to take advantage of them. This is a subject that we covered many times before along with examples. See the following older posts for background:

Here is Slashdot’s summary about the latest example:

“Windows CE-based ATMs can easily be made to dole out cash, according to security researcher Barnaby Jack. Exploiting bugs in two different ATM machines at Black Hat, the researcher from IOActive was able to get them to spit out money on demand and record sensitive data from the cards of people who used them. Jack believes a large number of ATMs have remote management tools that can be accessed over a telephone. After experimenting with two machines he purchased, Jack developed a way of bypassing the remote authentication system and installing a homemade rootkit, named Scrooge,”

This links to IDG, which says:

The machines Jack hacked were, however, based on Microsoft’s Windows CE operating system.

And from ZDNet:

At the Black Hat security conference here, Jack demonstrated two different attacks against Windows CE-based ATMs — a physical attack using a master key purchased on the Web and a USB stick to overwrite the machine’s firmware; and a remote attack that exploited a flaw in the way ATMs authenticate firmware upgrades.

Glyn Moody cannot comprehend such a tactless choice of Windows CE for ATMs. He asks, “why not just leave the notes out in the open?”

It should be no surprise that Google’s vulnerabilities in Chrome are sometimes caused by Windows’ inherent insecurity and this time for a change, “Google patches Chrome, sidesteps Windows kernel bug,” reports IDG. “Microsoft was not available for comment late Tuesday.”

It it worth adding that many Firefox flaws are Windows-only as well. Sometimes GNU/Linux is also affected and this new article says that “Google also released workarounds for two vulnerabilities in external components, helping to protect from flaws in the Windows kernel and GNU glibc components.” Nothing is infallible, but Microsoft tends to fail more often than the rest and it hides this.

Share in other sites/networks: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • Reddit
  • email

Decor ᶃ Gemini Space

Below is a Web proxy. We recommend getting a Gemini client/browser.

Black/white/grey bullet button This post is also available in Gemini over at this address (requires a Gemini client/browser to open).

Decor ✐ Cross-references

Black/white/grey bullet button Pages that cross-reference this one, if any exist, are listed below or will be listed below over time.

Decor ▢ Respond and Discuss

Black/white/grey bullet button If you liked this post, consider subscribing to the RSS feed or join us now at the IRC channels.

DecorWhat Else is New


  1. Links 18/1/2022: GNOME 42 Alpha and KStars 3.5.7

    Links for the day



  2. IRC Proceedings: Monday, January 17, 2022

    IRC logs for Monday, January 17, 2022



  3. Links 17/1/2022: More Microsoft-Connected FUD Against Linux as Its Share Continues to Fall

    Links for the day



  4. The GUI Challenge

    The latest article from Andy concerns the Command Line Challenge



  5. Links 17/1/2022: digiKam 7.5.0 and GhostBSD 22.01.12 Released

    Links for the day



  6. IRC Proceedings: Sunday, January 16, 2022

    IRC logs for Sunday, January 16, 2022



  7. Links 17/1/2022: postmarketOS 21.12 Service Pack 1 and Mumble 1.4 Released

    Links for the day



  8. [Meme] Gemini Space (or Geminispace): From 441 Working Capsules to 1,600 Working Capsules in Just 12 Months

    Gemini space now boasts 1,600 working capsules, a massive growth compared to last January, as we noted the other day (1,600 is now official)



  9. [Meme] European Patent Office Space

    The EPO maintains a culture of illegal surveillance, inherited from Benoît Battistelli and taken to a whole new level by António Campinos



  10. Gemini Rings (Like Webrings) and Shared Spaces in Geminspace

    Much like the Web of 20+ years ago, Gemini lets online communities — real communities (not abused tenants, groomed to be ‘monetised’ like in Facebook or Flickr) — form networks, guilds, and rings



  11. Links 16/1/2022: Latte Dock 0.11 and librest 0.9.0

    Links for the day



  12. The Corporate Cabal (and Spy Agencies-Enabled Monopolies) Engages in Raiding of the Free Software Community and Hacker Culture

    In an overt attack on the people who actually did all the work — the geeks who built excellent software to be gradually privatised through the Linux Foundation (a sort of price-fixing and openwashing cartel for shared interests of proprietary software firms) — is receiving more widespread condemnation; even the OSI has been bribed to become a part-time Microsoft outsourcer as organisations are easier to corrupt than communities



  13. EPO's Web Site Constantly Spammed by Lies About Privacy While EPO Breaks the Law and Outsources Data to the United States

    The António Campinos-led EPO works for imperialism, it not only protects the rich; sadly, António’s father isn’t alive anymore and surely he would blast his son for doing what he does to progress his career while lying to staff and European citizens



  14. Links 16/1/2022: Tsunami and Patents

    Links for the day



  15. IRC Proceedings: Saturday, January 15, 2022

    IRC logs for Saturday, January 15, 2022



  16. Links 16/1/2022: Year of the GNU/Linux Desktop and Catch-up With Patent Misinformation

    Links for the day



  17. Patrick Breyer, Unlike Most German Politicians, Highlights the Fact That Unified Patent Court (UPC) and Unitary Patent Are Incompatible With EU Law

    A longtime critic of EPO abuses (under both Benoît Battistelli and António Campinos leadership), as well as a vocal critic of software patents, steps in to point out the very obvious



  18. Links 15/1/2022: Flameshot 11.0 and Libvirt 8.0

    Links for the day



  19. Blogging and Microblogging in Geminispace With Gemini Protocol

    Writing one’s thoughts and other things in Geminispace — even without setting up a Gemini server — is totally possible; gateways and services do exist for this purpose



  20. Links 15/1/2022: Raspberry Pi in Business

    Links for the day



  21. IRC Proceedings: Friday, January 14, 2022

    IRC logs for Friday, January 14, 2022



  22. Gemini Clients: Comparing Moonlander, Telescope, Amfora, Kristall, and Lagrange (Newer and Older)

    There are many independent implementations of clients (similar to Web browsers) that deal with Gemini protocol and today we compare them visually, using Techrights as a test case/capsule



  23. 2022 Starts With Censorship of Christmas and Other Greetings at the EPO

    The nihilists who run the EPO want a monopoly on holiday greetings; to make matters worse, they’re censoring staff representatives in their intranet whilst inconsistently applying said policies



  24. Links 14/1/2022: FFmpeg 5.0 and Wine 7.0 RC6

    Links for the day



  25. White House Asking Proprietary Software Companies That Add NSA Back Doors About Their Views on 'Open Source' Security

    The US government wants us to think that in order to tackle security issues we need to reach out to the collective 'wisdom' of the very culprits who created the security mess in the first place (even by intention, for imperialistic objectives)



  26. Links 14/1/2022: EasyOS 3.2.1 and Qt 6.3 Alpha

    Links for the day



  27. Scientific Excellence and the Debian Social Contract

    The Debian Project turns 30 next year; in spite of it being so ubiquitous (most of the important distros of GNU/Linux are based on Debian) it is suffering growing pains and some of that boils down to corporate cash and toxic, deeply divisive politics



  28. Links 14/1/2022: openSUSE Leap 15.2 EoL, VFX Designers Are Using GNU/Linux

    Links for the day



  29. IRC Proceedings: Thursday, January 13, 2022

    IRC logs for Thursday, January 13, 2022



  30. 2022 Commences With Microsoft-Themed (and Microsoft-Connected) FUD Against GNU/Linux

    A psychopathic Microsoft, aided by operatives inside the mainstream and so-called 'tech' media, keeps spreading old and invalid stigma about "Linux" and Free software; few people still bother responding to these fact-free FUD campaigns, which boil down to ‘perception management’ PR/propaganda


RSS 64x64RSS Feed: subscribe to the RSS feed for regular updates

Home iconSite Wiki: You can improve this site by helping the extension of the site's content

Home iconSite Home: Background about the site and some key features in the front page

Chat iconIRC Channel: Come and chat with us in real time

Recent Posts