Join the Community

22,106
Expert opinions
44,113
Total members
420
New members (last 30 days)
191
New opinions (last 30 days)
28,710
Total comments

Is that a worm in my ATM?

When ATM vendors got behind Windows XP as a replacement for IBM’s OS/2 as it neared the end of its shelf life 10 years ago, there was a predictable flurry of concern.

And instinctively, the concerns made sense. Why would you use the most popular and most targeted all-purpose PC operating system to run such a machine with very specific functions and security requirements?

But there were obvious benefits – among them greater user interface flexibility, compatibility with other internal and customer facing applications and banks’ familiarity with securing desktop estates on the same OS. And, banks said, most ATMs operated within very closed networks.

Then in 2003, the Slammer worm affected operations of 13,000 Bank of America ATMs, even though it wasn’t directly infecting ATMs themselves, rather back-end servers that connected to them. This was followed later that year by two US banks confirming the Welchia or Nachi worm had directly affected some ATMs.

Many commentators took these examples, pointed to banks increasingly moving ATM networking to TCP/IP to save money, and predicted a vulnerable future for ATM security.

Security and ATM vendors responded with additional firewalls, hardware devices and software security layers. And since then things have been pretty quiet.

Now, with XP end of support just eight months away, and around 75 per cent of ATMs still running on the operating system, will this change? Probably not.

The ATM vendors have been leisurely pushing Windows 7 upgrades for the past few years, but  have also been careful to reassure banks that their additional security layers and removal of superfluous vulnerabilities from XP would protect them if they didn’t get around to the upgrade right away.

In the end, upgrade pace will be determined by how seriously each bank takes PCI DSS compliance, whether their hardware is getting too old to run new ATM applications and Windows 7, and competing priorities.

But if an ATM security threat does emerge after XP stops getting patches in April, upgrading might suddenly seem a bit more urgent. 

 

External

This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.

Join the Community

22,106
Expert opinions
44,113
Total members
420
New members (last 30 days)
191
New opinions (last 30 days)
28,710
Total comments

Trending

Tachat Igityan

Tachat Igityan Founder and CFO at destream

Is Fintech Neglecting the Creator Economy?

Nkahiseng Ralepeli

Nkahiseng Ralepeli VP of Product: Digital Assets at Absa Bank, CIB.

Blockchain Oracles in Payments: The Unsung Heroes.

Francesco Fulcoli

Francesco Fulcoli Chief Compliance and Risk Officer at Flagstone

Insights into the FCA Crypto Roadmap and Consumer Research

Now Hiring