The Indian government revealed that over 70 percent of the automated teller machines (ATMs) in the country currently run Windows XP. Since this particular flavor of Windows has not been updated since 2014, its widespread use as an ATM operating system is concerning. Cybercriminals can exploit the many well-known system security issues that affect this outdated system.

A Massive Migration

Finance Minister Arun Jaitley said the government was working with “banks and other parties” to upgrade these machines, according to Softpedia. He reported that roughly 22,000 ATMs would need to be migrated to more current systems — likely Windows 10.

Jaitley did not provide a target date for such a migration, nor did he specify the hardware or software it would require. The finance minister did, however, admit that it would take a long time to complete.

Microsoft Supports Its Outdated ATM Operating System

To keep the ATMs up and running, Jaitley noted, some stakeholders engaged Microsoft to provide custom support for their specific machines. While this support enabled the machines to function, the migration from XP should still be carried out as soon as possible.

This situation highlights the problem with older technologies: When tools fall behind the times, they require capital to upgrade. In this case, while most big banks with plenty of resources continually upgrade their machines, the ATMs typically found in convenience stores and other retail locations have fallen behind.

Stakeholders Don’t Feel the Pain

Although any reasonable threat model for an ATM will include breaching, stakeholders may not be able to see actual breaches occurring or understand the issues stemming from outdated machines. In other words, they may not be feeling the pain.

The economic incentive to replace these machines may actually be negative, since there is currently no standard hardware or software platform. Why migrate at all if you are not sure where you are migrating to? However, failure to do so puts ATM users — their customers — at risk.

The current situation suggests that India has a long way to go when it comes to securing ATMs today and in the future.

More from

Is It Time to Start Hiding Your Work Emails?

In this digital age, it is increasingly important for businesses to be aware of their online presence and data security. Many companies have already implemented measures such as two-factor authentication and strong password policies – but there is still a great deal of exposure regarding email visibility. It should come as no surprise that cyber criminals are always looking for ways to gain access to sensitive information. Unfortunately, emails are a particularly easy target as many businesses do not encrypt…

2022 Industry Threat Recap: Finance and Insurance

The finance and insurance sector proved a top target for cybersecurity threats in 2022. The IBM Security X-Force Threat Intelligence Index 2023 found this sector ranked as the second most attacked, with 18.9% of X-Force incident response cases. If, as Shakespeare tells us, past is prologue, this sector will likely remain a target in 2023. Finance and insurance ranked as the most attacked sector from 2016 to 2020, with the manufacturing sector the most attacked in 2021 and 2022. What…

X-Force Prevents Zero Day from Going Anywhere

This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…

And Stay Out! Blocking Backdoor Break-Ins

Backdoor access was the most common threat vector in 2022. According to the 2023 IBM Security X-Force Threat Intelligence Index, 21% of incidents saw the use of backdoors, outpacing perennial compromise favorite ransomware, which came in at just 17%. The good news? In 67% of backdoor attacks, defenders were able to disrupt attacker efforts and lock digital doorways before ransomware payloads were deployed. The not-so-great news? With backdoor access now available at a bargain price on the dark web, businesses…