Windows on ATM machines??

Printable View

September 19th, 2003, 03:31 PM
allenb1963

Windows on ATM machines??

Yup....it looks like the banking industry has gone off the deep end...

Quote:

Within three years, most bank machines that dispense cash will run on the Windows operating system, according to a study published last week.

By 2005, 65 percent of bank ATMs (not including free-standing machines in places like convenience stores and casinos) in the United States will use a stripped-down version of Windows. About 12 percent of the machines will use the operating system by the end of this year, according to Gwenn Bezard, an analyst at market researcher Celent.

Quote:

"Because we are seeing so many mergers and acquisitions in the last few years, you have large banks running a fleet of ATM hardware," Bezard said. "With open technologies it is easier to run different types of hardware on the same software."

OPEN TECHNOLOGIES??? What planet is this guy from? Windows is DEFINITELY not an open technology, except from a security standpoint. Which brings me to my next point...

Quote:

"What Microsoft actually sells to the banks for ATM use is a cut-down version of Windows that doesn't contain things like Web servers," said Ross Anderson, a researcher in Cambridge, England, and author of Security Engineering. "They have tried to cut out the unnecessary rubbish that clutters up the typical PC. How good a job they've done, I just don't know.... So we definitely can't rule out the possibility that someone in the future writes a Slammer-style worm that causes thousands of ATMs to start spewing out cash."

This is starting to scare me...

Quote:

"When you think about an ATM machine, it is basically a vault," Schneier said. "There is inherent security there."

Yeah...and they're going to make Windows the combination lock to that vault. I'm going to Walmart to buy a bunch of Mason Jars and start banking the way my grandparents did....all I need is a shovel and a decent sized backyard.

Original article found here.
September 19th, 2003, 03:37 PM
reset_button

yeah i agree.

Even though i just put my money into my SAFE in my bedroom, i think that if microsoft do end up doing this, there's allway going to be a risk that someone's gonna invent some virus and trash the sytem...

God if you can control a PC with little knowledge, then how easy will it be to control an ATM?

Or just do what some idiots do, get a chain, and tie that chain around the ATM connect the other end of the chain to your UTE, and FLAW the BABy.
And don't stop till you get to MEXICO!!!
lol
September 19th, 2003, 03:39 PM
bballad

Hey a lot of companies allready are running windows, most notably BoA. I think the aritcal is missleading though, emmbeded Linux is makeing hugh inroads into the ATM feild, a lot of systmes run a java based front end, I doubt they will want to replace that.
September 19th, 2003, 03:50 PM
Elmore

Can't wait for when I'm standing there waiting for my money to pop out, and damn thing freezes!

will there be a reboot button?
September 19th, 2003, 03:50 PM
mnchur

a good majority of atm that are made by diebold already use a stripped down version of NT. As for writting a virus to make these machines spit out money it is possable but not probable. if someone was to write such a virus it would most likely be pretty easy to trace due to the limited number of people who have access to the service ports on the back of the atm.
September 19th, 2003, 04:42 PM
RoadClosed

Hate to tell you guys this, but almost every ATM I have seen that was built in the last few years is Windows. Remember the slammer worm taking out ATM machines all over?
Of course that was server/data center related but you never know, however here is the catch...

ATMs are not connected to the internet. They are connected via direct DDS lines to a mainframe data center type of thing. Then on top of that they use proprietary modems with hardware encryption. The transactions are not real time, they are batched and then applied later in the day with a maximum amount dispensed. Sure they get hacked but most succesful hacks are a result of social engineering. You NEVER know who owns that little ATM kiosk in the mall, do ya?

Hint, most likely NOT the bank.

Oh and did you all know that CISCO IDS blade sendors are also windows NT... now THATS scary. :)
September 19th, 2003, 05:26 PM
MemorY

Quote:

Can't wait for when I'm standing there waiting for my money to pop out, and damn thing freezes!

will there be a reboot button?

and when you reboot what do you get?? BSOD of course :-D
September 19th, 2003, 05:53 PM
dcongram

Interesting comments. I hadn't heard they are changing OS.
Most of the ABM's we work on still run OS/2.
September 19th, 2003, 07:34 PM
OldRedFox

NT self-serve grocery check-out too

Don't know about you, but where I am the grocery stores have self-checkout. All the machines run NT and about once a week I see one stuck somewhere in the reboot cycle. Not exactly the confidence builder I need to trust my ATM to NT.
September 19th, 2003, 07:53 PM
bballad

OS/2 is on life suport at IBM, they recently informed all of their customers of os/2 (mostly banks) that it was going to no longer be supported. They sugested every one transition over to Linux but some ATM makers and banks (notably BoA) went with windows.

Yes all ATM's should be useing the prepritory banking network, unfortunatly some go cheap and use internet connections to VPN to a central location to get onto the banking network (this is bad for a number of reasons, not the least of which is opening a hole in what should be a closed network.). this is a very bad practice that is allowed do to recnet deregulation of the banking industry...any guess who is the largest bank useingthe internet to transfer banking transactions....thats right BoA, interestingly they are the major bank who lost atn conectivity due ot slammer. My sugestion, if you want to keep your money safe stay away from the bank of america
September 19th, 2003, 07:58 PM
RoadClosed

Yep that is stupid. It would leave an ATM open to OS types of exploits like the RPC exploit! WTF were they thinking. I could maybe see it of they had some wan for local ATMs and then concentrated the data onto a VPN at a NOC or something, but only with serious safeguards in place. To hook each ATM to the internet is bordeline negligence.
September 19th, 2003, 08:02 PM
CXGJarrod

I can see it now. Microsoft adds help to ATM Machines:

Person sticks in card into machine.

Clippy pops up "Hi, I can see that you are trying to get money."

Do you want to:

Take out cash
Check Balance
Reboot Machine

Clippy: Do you really want to take out this cash?

User selects yes.

Clippy: Do you REALLY want to delete these funds from savings?
September 19th, 2003, 08:03 PM
nihil

I thank the Lord that there are Bars closer to me than ATMs........have to use old fashioned devices called cheques(checks), but it's one hell of an excuse?

:drink:

Have a good week-end
September 19th, 2003, 08:07 PM
RoadClosed

LOL they have been windows based ATMs for years. Chances are any ATM you have been using with a color screen is 99 percent Windows. The software load just looks like the old style machines with basic text because that's what people like.

To copy a cliche, "it's not the same version your daddy used." And like I stated earlier, CISCO even uses it on their most secure line. Funny isn't it?

Hey hihil,

I lived north of London for a while, I remember having to be issued a check (cheque) card from Barks. so I could write checks. Might as well just use a Debit card eh? All that quid is heavy anyhow. :D
September 19th, 2003, 09:06 PM
sk8

believe it or not, one day an atm machine crashed right in front of me ( i didn't do anything, i swear =p )
September 20th, 2003, 01:22 AM
Fred Brown

What do you do when the blue screen of death pops up? Reboot, reboot. There will need to be a roll of butt wipe next to the screen. It's going to be a smellie time at o banko. :fart:

Freddy
September 20th, 2003, 06:10 AM
catch

Oh gee another thread bashing windows, how creative.

A situation like an ATM system has a few core requirements:

High Assurance. A minimalistic amount of code should be used, ideally a finite machine. This will cover both reliability and security.
Cost. This is not just a central server, large banks have tens of thousands of system and they cannot afford to spend tens of thousand per box.
Support. Banks need support both for uptime and insurance reasons. They need someone who will take responsibility if the system is unreasonably flawed.
Standards Compliance. They need systems that have been measured against a recognized yardstick. (ISO whatever)

First, the version of windows that will be used looks more like Windows CE than Windows Me and even then it is stripped down. All superfluous kernel drivers are removed, including most likely the TCP/IP stack. (in ideal situations anyhow) It would not be running RPC or IIS either for obvious reasons. It is likely that the security policy is removed as well since the system doesn't support OS level shared users. Merely two applications (user and admin) consequently all access controls would be done at the data center level.

Now that that is established, let's look at how this Windows meets the aforementioned requirements using Windows, Linux, FreeBSD, AIX, and QNX as comparison.

High Assurance: For this role a micro kernel system is an absolute must. You simply cannot have a high assurance system outside of this design requirement. Windows, AIX, and QNX all meet this requirement. Linux's monolithic kernel is simply too comprehensive to be trusted or provably assured. FreeBSD's modular kernel is not as tragic as Linux's, but is still simply not up to the task. As I said before, a finite machine like KSOS would be ideal.

Cost: This is clearly where AIX gets clobbered, it is just too much of an OS for such a menial task as individual ATM systems and the cost reflects as much. Some of you would be quick to say that Linux and FreeBSD are free... this is true, kinda. The costs of a turn-key solution for these systems would be significant, however it is unlikely that they would end up more expensive than Windows or QNX.

Support: AIX clearly wins this realm, IBM support has been legendary since the 1930's and is likely to continue being so. Windows support for the most prt is less than stellar, however one area that Microsoft has always been supportive is if their product fails to deliver on an agreed specification. Linux and FreeBSD have no such specifications and no support at all beyond basic configuration help. QNX support is more or less on par with Windows.

Standards Compliance: Here Windows and AIX are superior again, both EAL4 (ISO 15408) Linux was just evaluated at EAL2 (after much effort and hoopla) to the best of my knowledge FreeBSD and QNX have not been evaluated against either ISO or DOD standards. As a technology manager I would not bet my job on something that has not been evaluated, too risky. If something happens and a product has been evaluated I can fall back on that and not just "Duh, well I thought it was good from what I read on slashdot." I know that I am not alone in this standpoint. (an observation made after having worked closely with various financial/defense organizations)

So with a quick review AIX is viable in three categories, but the cost is a fatal blow, just too high. Linux is good in one category and not awful in one. FreeBSD is good in one catagory as well. QNX is also good in three categories (maybe four, but I couldn't find anything in a quick search). Windows is good in three categories and support is a half point.

So, with tens of millions of dollars at stake. Your job and most likely career at stake and thousands of customers’ peace of mind and a non-infinite budget... which do you choose?

catch

Edited to add:
PS I'd prolly pick QNX if only they'd get themselves evaluated... bah.
September 21st, 2003, 03:06 AM
AlkAzAA

Over here in sweden all the ATMs (or bankomat and minuten as they are called here) have been windows based for years and there has never been any big problems with them. Sure, I have seen a few (2 or 3) error messages when I was going to get some money but that is nothing common and most of the time just make people laugh (maybe because they dont know better).
I dont belive windows would still be used and introduced in ATMs in other countries if there had been any big problems with it.

[gloworange]virtual memory low[/gloworange]
September 21st, 2003, 03:18 AM
slick8790

no no no no. i dont believe it. i wont believe it. im liquidating all my assets if that happens
September 21st, 2003, 04:47 AM
darkes

One interesting thing here is that the server side, which is located at the banks IT centre usually does not run Windows.

A lot of banks here still use IBM mainframes as the server, as the software is tried and tested. Also mainframes are very secure (they meet various DoD & ISO standards), and can process vast numbers of transactions per second.

The hardware encryption used is often DES3, which is almost impossible to break, given the careful way in which the keys (or rather partial keys) are physically distributed. Seems a bit over the top, but the cryptographic hardware is also tamper proof. So if you did manage to steal an ATM (has been done!), then the hardware will destroy the DES3 key it was using.