News

99% of Europe's XP-driven ATMs still not updated to Win 7

April 7, 2014

By the end of 2013, just 4,150 ATMs in Europe — 0.7 percent of the total — had been upgraded to Windows 7, according to the comprehensive study, "ATMs in Europe 2014: Hardware, Software and Services," by RBR. The strategic research and consulting firm also found that 23 of the 33 country markets studied have no Windows 7 ATMs at all.

Desire for service, stability

Adoption of newer operating systems has been slowed by the need for suppliers to provide driver software for the hardware devices in ATMs, such as cash dispensing mechanisms and card readers. And, because downtime has a major impact on customer service, the banking industry has clung to established operating systems with proven stability. 

Risk mitigation initiatives

ATM operators have implemented a variety of risk mitigation tools, including whitelisting, sandboxing and encryption, along with more conventional technology like application-level firewalls and anti-malware and anti-virus software. However, opinions differ as to whether these countermeasures comply with payment card industry security requirements, and whether institutions are leaving themselves open to substantial fines.

Risks after XP support ends

The lack of migration from XP suggests that most banks believe they have sufficient security solutions in place to protect their networks, at least for now, RBR said. How quickly migration proceeds will depend on criminals' ability to exploit newly discovered XP vulnerabilities at the ATM.

For now, banks are confident that the risk is small, but a well-publicized breach would cause many banks to re-evaluate.