Windows-based ATMs succumb to virus

Elinor Mills Abreu

SAN FRANCISCO: Automatic teller machines at two banks running Microsoft's popular Windows software were infected by a computer virus in August, the maker of the machines said on Monday.

The ATM infections, first reported by SecurityFocus.com, are believed to be the first of a computer virus wiggling directly onto cash machines.

Computer security experts predicted more problems to come as Windows migrates to critical systems consumers rely on.

An unknown number of ATMs running Windows XP Embedded were shut down during the spread of the so-called "Nachi" worm, said officials at Diebold Inc., which made the ATMs and refused to name the customers affected.

The Nachi worm, also called "Welchia," was written to clean up after the MSBlast, or Blaster, worm. Instead it crippled or congested networks around the world, including the check-in system at Air Canada. Both worms spread through a hole in Windows XP, 2000, NT and Server 2003.

In January, the SQL Slammer worm led to technical problems that temporarily kept Bank of America Corp.'s customers from their cash, but did not directly cause the ATM outage.

"It's a harbinger of things to come," said Bruce Schneier, chief technical officer of network monitoring firm Counterpane Internet Security.

"Specific purpose machines, like microwave ovens and until now ATM machines, never got viruses," said Schneier, author of "Beyond Fear." "Now that they are using a general purpose operating system, Diebold should expect a lot more of this in the future."

'HORRENDOUS SECURITY MISTAKE'

John Pescatore, an analyst at Gartner, agreed.

"It's a horrendous security mistake," he said, of specific-purpose machines like ATMs running Windows, written for general purpose computers and for which Microsoft Corp. releases security fixes on a regular basis. "I'm a lot more worried about my money than I was before this."

Diebold switched from using IBM's OS/2 on its ATMs because banks were requesting Windows, said Steve Grzymkowski, senior product marketing manager at Diebold.

"They have been asking us to ship ATMs with Windows because of the graphics capabilities. They want a common look between the ATMs and Web banking sites," he said. "Another advantage is they are familiar with Windows."

To help prevent future problems Diebold is shipping ATMs with firewall software designed to block out viruses and other attacks, he said.

"As far as it happening again, I wouldn't want to speculate on that," Grzymkowski said.

Schneier and Pescatore said they were worried about the security of other Windows-based Diebold appliances -- voting machines, which run Windows CE.

But a Diebold spokeswoman said the company's voting machines are not used on a network, so "that is currently not an issue."

Reuters