ATM flashes a port or two for the enterprising hacker
(2026/01/28)
- Reference: 1769589066
- News link: https://www.theregister.co.uk/2026/01/28/atm_flashes_a_port_bork/
- Source link:
Bork!Bork!Bork! Behold an ATM crying out for a man-in-the-middle attack. An obsolete Microsoft operating system cannot be blamed here. This is all about the hardware.
When we talk about installation, we're usually referring to Windows 2000 turning up on a ticket machine, Windows 7 showing its face where it isn't welcome, or even Windows 10 having a moment on an information display.
Today's bork, however, is a bit different. Spied by an eagle-eyed Register reader, this installation is all about the hardware: a router connected to an ATM to provide connectivity.
[1]
Router on top of an ATM – click to enlarge
We're not going to reveal the location, since this hardware is so loudly crying out for a man-in-the-middle attack that it's practically a honeypot for miscreants. In another image shared by our reader, a cashbox is also wedged up against the machine.
We've obscured any identifying markings on the router, but there's a purple cable running from the device to a grungy BT OpenReach socket in the wall, and another cable connected to an Ethernet socket.
[2]
The device itself looks like a [3]GW6650V series router from Virtual Access. It's not a bad choice – there are a pair of SIM sockets to keep things running should connectivity wobble, and "Advanced Security." Handy for a device that calls itself a "Cost-effective business grade router" with applications including "Financial/ATM."
[4]Crossrail? More like Borkrail...
[5]Windows fails to tip the scales in grocery store deployment
[6]ATM takes a kicking yet keeps on ticking
[7]Splash-screen memories from a Bangkok ticket machine
All good then, at least from the perspective of business rather than domestic use. The 802.11n Wi-Fi isn't going to set the consumer world alight, but it is more than good enough for an ATM.
The problem is the installation. Regardless of how wonderful and secure a given piece of hardware might be, leaving it in a spot where the public can get their hands on it is rarely a good idea.
[8]
After all, as well as the technically savvy who might ponder how a man-in-the-middle attack could be accomplished with all those exposed ports and cabling, there is also the vandal armed with chewing gum and the curious child who would wield a sticky piece of candy or a savory snack.
And then there's the probably interruptible power situation. Let's face it, this gets worse the longer you look at it.
[9]
So, today's bork has nothing to do with the software installation, but everything to do with the hardware installation. Not that this hack would ever leave something quite so exposed for all to see… ®
Get our [10]Tech Resources
[1] https://regmedia.co.uk/2026/01/27/bork12.jpg
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://virtualaccess.com/gw6650v-series/gw6600v-series-router-2/
[4] https://www.theregister.com/2026/01/27/crossrail_more_like_borkrail/
[5] https://www.theregister.com/2026/01/22/windows_grocery_store_scale/
[6] https://www.theregister.com/2026/01/21/atm_bork/
[7] https://www.theregister.com/2026/01/22/splashscreen_bangkok_ticket_machine/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
When we talk about installation, we're usually referring to Windows 2000 turning up on a ticket machine, Windows 7 showing its face where it isn't welcome, or even Windows 10 having a moment on an information display.
Today's bork, however, is a bit different. Spied by an eagle-eyed Register reader, this installation is all about the hardware: a router connected to an ATM to provide connectivity.
[1]
Router on top of an ATM – click to enlarge
We're not going to reveal the location, since this hardware is so loudly crying out for a man-in-the-middle attack that it's practically a honeypot for miscreants. In another image shared by our reader, a cashbox is also wedged up against the machine.
We've obscured any identifying markings on the router, but there's a purple cable running from the device to a grungy BT OpenReach socket in the wall, and another cable connected to an Ethernet socket.
[2]
The device itself looks like a [3]GW6650V series router from Virtual Access. It's not a bad choice – there are a pair of SIM sockets to keep things running should connectivity wobble, and "Advanced Security." Handy for a device that calls itself a "Cost-effective business grade router" with applications including "Financial/ATM."
[4]Crossrail? More like Borkrail...
[5]Windows fails to tip the scales in grocery store deployment
[6]ATM takes a kicking yet keeps on ticking
[7]Splash-screen memories from a Bangkok ticket machine
All good then, at least from the perspective of business rather than domestic use. The 802.11n Wi-Fi isn't going to set the consumer world alight, but it is more than good enough for an ATM.
The problem is the installation. Regardless of how wonderful and secure a given piece of hardware might be, leaving it in a spot where the public can get their hands on it is rarely a good idea.
[8]
After all, as well as the technically savvy who might ponder how a man-in-the-middle attack could be accomplished with all those exposed ports and cabling, there is also the vandal armed with chewing gum and the curious child who would wield a sticky piece of candy or a savory snack.
And then there's the probably interruptible power situation. Let's face it, this gets worse the longer you look at it.
[9]
So, today's bork has nothing to do with the software installation, but everything to do with the hardware installation. Not that this hack would ever leave something quite so exposed for all to see… ®
Get our [10]Tech Resources
[1] https://regmedia.co.uk/2026/01/27/bork12.jpg
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://virtualaccess.com/gw6650v-series/gw6600v-series-router-2/
[4] https://www.theregister.com/2026/01/27/crossrail_more_like_borkrail/
[5] https://www.theregister.com/2026/01/22/windows_grocery_store_scale/
[6] https://www.theregister.com/2026/01/21/atm_bork/
[7] https://www.theregister.com/2026/01/22/splashscreen_bangkok_ticket_machine/
[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_offbeat/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aXnsV_2A38S0UGJNH_kTIwAAA1Q&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://whitepapers.theregister.com/
John_Ericsson
This is crying out for the response of "Don't worry, it's all encrypted!".
Whenever I heard those words I started to worry.
False alarm, no bork
Empire of the Pussycat
ATM traffic is encrypted/secured inside the safe and there're other measures to detect/resist attack, any external networking boxes are just for connectivity.
Outside of a secure branch environment, most ATMs are likely to have exposed connections, i.e. in convenience stores, supermarkets etc., it's ok as they're designed to be secure in the real world.
If there were viable MITM attacks, things would've fallen apart long ago, aside from ATMs, card payment terminals wouldn't be viable, yet pretty much every shop has them these days, and they survive just fine with insecure/exposed connections.
To be fair...
...it might be in a secure location, not out on the street. Still a bit ugly though.
Unrelated anecdote. In Before Times, we used to have a cash machine in our access-controlled office. One night there was a break-in, but the dumb scrotes were more interested in the shiny (but pretty crap) large plasma screen in reception to walk 5 meters further and grab some easy cash.