mmicn

The windows CE and OS/2 are getting rare. those I have tested all had win XP and win 7. (I have tested nearly every major financial institution in my country)

With regards to the "spraying of bills", the bills themselves are usually in a safe, which is separated from the electronics (computer & peripherals). But I do agree that when a machine is breached it should halt immediately. Having said that, financial institutions are not going to take this route for a variety of reasons, one of which is just general maintenance. If the case is breached, do you suspect that the intruders had access to everything? If so you want need to brick the entire device, to prevent any data from leaking back to the intruders.

Your suggestion with regards to maintenance is indeed a valid one, but again the increase in cost is simply to big. Most financial institutions in my country and region (western europe) actually see ATM purely as a cost, and install them simply because they want customers to get a hold of their money. It is that simple. So why would they increase the costs?

I think, and I don't want to start any flamewars or anything, that reconsidering the use of Windows in its current form is a valid route. If you were to start from an extremely limited & stripped down version sure, but not in the way companies are currently using it (for those that might wonder, yes full installs of windows happen all the time).

Anyway, I'm glad this is in the open. The more people talk about it, the more things will change.

Depends on what you mean by "harder to install malware on". Most of these machines are regular Windows, and inherit the default risk associated with such machines. The only difference is that some might have better hardening.

from experience (I was a security assessment professional and I have looked at multiple of these ATM machines in the past from a hackers point of view), these machines are almost always windows XP SP3 or the newer once are running windows 7. A number of usb devices are added like the pinpad, keyboard, printer, smartcard reader, cash dispenser, ... Next the entire thing is managed using XFS. (http://www.cen.eu/cen/Sectors/Sectors/ISSS/Activity/Pages/WS...) So even tho it might appear the researcher had a large amount of knowledge, this is not so uncommon.