Date: Wed, 4 Jul 2007 12:46:27 -0400
From: "Kristian Hermansen" <kristian.hermansen@...il.com>
To: full-disclosure@...ts.grok.org.uk
Subject: Hacking Windows XP/CE ATMs for fun and (mostly)
	profit?

The Hyosung NH-5050 ATM runs Windows XP or Windows CE and is
vulnerable to the same exploits which allow criminals to dispense
large amounts of money by exploiting the "denomination alternation"
attack vector using prepaid debit cards.  Mitigating factors require
the attacker having knowledge of how to place the ATM into such an
operational mode that the diagnostic features can be invoked.  The
default passwords must also be unchanged since their factory settings,
unless the attacker has guessed or brute-forced the nearly 1,000,000
possible other combinations.

I won't link anyone to the details, but this attack vector has been
known for a long time against other ATM models.  The question I have
is this -- has Hyosung issued an update to prevent this on newer ATMs?
 It is quite an interesting topic, but I am baffled by the relative
ease compared with other ATM attacks that have been documented
publicly...
-- 
Kristian Hermansen

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Hosted by DataForce ISP - Powered by Openwall GNU/*/Linux