As I'm sure many of you have heard, the end of support for Windows XP is the [supposed apocalypse for ATM's](http://www.marketplace.org/topics/tech/95-percent-us-atms-run-windows-xp) worldwide. I am cognizant of the fact that this ensures that no more patches are issued, and that banks need to take that threat seriously. I'm having a hard time identifying potential attack vectors and to me it seems as though this is being sensationalized. 

We know that the majority of attacks against ATM's are against the environment of the ATM (ie Card Skimming) and not with the software itself. This threat may never completely be eradicated. That said, can someone point out how the software running the software could serve as an exploit?

Perhaps I'm being naive, however the machine itself offers limited physical interfaces to exploit - No USB or other bus ports, access to a serial port, etc. The network is (theoretically) locked down with means outside the OS running on the ATM, and the only vector I could see possibly being exploited is the card slot itself.

How could someone exploit the OS the ATM is running on?