In 2018 Walter was at def.camp and made it to the local television by lockpicking the ATM of the payment village. This attack was not in scope, but it took the guys longer to ask not to pick the lock than for Walter to pick the lock. (https://blackbag.toool.nl/?p=2701)
The payment village shares their skill by buying an ATM locally, as it’s rather hard traveling with an ATM. The locks on the ATM in Romania wasn’t great. However, the ATM Timur Yunusov (@a66ot) bought for HITB Cyberweek was quite nice. Unfortunately, the ATM wasn’t functional when we visited the village. It did ,however, give us a rare insight in one of these machines.
I’ll ignore that this device runs Windows version and focus on the physical security aspects, instead. The ATM is build very sturdy, as its main goal is to thwart access to the money by destructive means. But, what would it take to pick one of these? The lock was a Abloy disk detainer, where at this moment only a handful of pickers are experienced in picking these. Furthermore, the money was protected by another two safe locks. Let’s have a look.
The safe door has two mechanical combination locks of unknown brand. The style reminds us of a La-Guard. It’s most likely a group 2 with three combination wheels. Cracking them is definitely possible, but it’s going to take a few hours.
Again, build to resist destructive attacks, the safe door was build to a high standard and looks well-made.
To finish off this post, here are two pictures of the inside of the safe. We can clearly see the money storage boxes and the dispensary unit. While on the last photo, we have an inside view of the mechanical parts behind the display.
Photos CCBY4.0 Jan-Willem @ Toool Blackbag