At Internet Security Auditors we specialize in security audit processes, and collaborate with financial institutions in reviewing their security systems.
Within the ATM platforms of financial institutions, we have experience auditing systems from the largest manufacturers in the market. The tests performed include both ethical hacking tests and technical validations, and the results are useful for evaluating or maintaining compliance with PCI DSS/PA DSS or ISO27001 certification.
Architecture and protocols analysis
- Includes ATMs distributed across the branch network, the network and communication devices, and the servers.
- The following aspects are reviewed:
- Theoretical validation of that architecture.
- Security review of the servers.
- Network visibility from an ATM.
- External traffic reaching the ATMs.
- Information received from the network.
- Analysis of communication protocols, capture of sensitive data, manipulation of requests, use of insecure protocols/services.
- Assessment of the risk and business impact of a security incident.
Configuration analysis
- Incorrect operating system configuration can sometimes generate security problems in the operating system itself or in some of the running applications.
- The following aspects are reviewed:
- Configuration of: Users, File system, Security levels, Services, Personal firewall rules, Access to administration tools.
- PCI DSS hardening.
- Alteration of the ATM application configuration to record information in logs.
PCI DSS review
- Review of the PCI DSS requirements to be met by the environment.
- Review of the controls implemented to meet the PCI DSS requirements following the security evaluation procedures.
ATM application security review
- Application interface: information obfuscation, maintenance of confidentiality and integrity of information, availability analysis.
- Information transmission.
- Storage.
- Data processing in memory.
- Security of the services used.
- Possible manipulations of the application from the host.
- PCI DSS analysis as described in the previous section.
Client application vulnerability analysis
- Detection of possible application shortcuts that may exist through manipulation of the client interface.
- Detection of vulnerabilities in the application or the different software objects that interact with the client interface and that may pose a risk to the availability of the ATM, access to local ATM components or the network.
- Analysis of possible weaknesses of the application through the use of keyboards connected to the ATM, with physical access to its interior.
Protections against illicit code execution
- Aspects related to the risk of illicit code execution will be reviewed, specifically tests aimed at corroborating or overcoming the protection provided by specific protection systems such as white-listing.
Software update procedure
- ATM systems have software components that must be updated regularly to ensure the correction of defects and emerging security vulnerabilities.
- In the case of ATMs, according to requirements of standards such as PA-DSS, it is necessary to ensure that these processes guarantee the integrity of update files and the impossibility of carrying out an attack on the traffic or sources in such a way that the files used for updates could be altered, both for the Operating System and the ATM application itself.
Hard disk analysis
- Someone who takes possession of a hard disk used in an ATM (theft, reuse of the disk without proper data deletion) could analyze the content of the disk, especially if cryptographic mechanisms are not used to protect it.
- The information that can be obtained from the hard disk of an ATM is evaluated, not only in existing files, but also in deleted files.
- Search for PAN, PINBLOCK, track data, etc., on the hard disk to verify secure writing and/or secure deletion of data on the HD according to PCI DSS requirements.
Review of monitoring and remote management processes
- Theoretical analysis of weaknesses that may be caused by remote management tools in the environment:
- Protections against alteration of information by third parties.
- Accessibility to the tools from the network.
- Requirements for user authentication.
- Review of the possible impact of inappropriate use of customer support processes:
- Authentication required to run those processes.
- Filtering of origins that can execute them.
- Auditing of actions (logs).
- Integrity control of messages.
Cryptography of the ATM application
- It should be reviewed that, in the current process, the ATM Master Key cannot be obtained, nor the keys that are communicated to it.
- Technical evidence should be provided that, using the keys present in the ATM, data such as the PIN or the tracks cannot be decrypted when they are encrypted.
As a result of this audit, the following documentation is provided:
- Executive report.
- Files with the results.
- Specific report on conceptual risk scenarios.
- Includes all technical results from the vulnerability exploitation tests.
