This question is using ATMs as an example, but it could apply to any number of 'secure' devices such as poker machines, E-voting machines, payphones etc.
Given that ATMs are relatively hardened (in comparison to say, most consumer electronics for example), what would be the process of reverse engineering a device in a black-box AND limited access scenario?
Given that traditionally, an end user of a device such as an ATM will only ever have access to the keypad/screen/card input/cash outlet (at a stretch, access to perhaps the computer housed in the top of the plastic casing(think private ATMs at small stores etc)), it seems like most attack vectors are quite limited. Under these types of circumstances, what could be done to reverse, understand and potentially exploit hardened, limited access systems?
Is the 'ace up the sleeve' kind of situation here physical access to the ATM components? Or is there a way to RE a device from within the environment a user is presented?