Replay attack detection

1. A method, comprising:

instructing a peripheral to move at least one component of the peripheral to a known state;

evaluating an image captured of the peripheral for the at least one component in the known state; and

processing at least one security operation when the evaluating indicates that the at least one component is not represented in the image in the known state.

2. The method of claim 1 further comprising, sending a security alert for a replay attack to a security system of a server when the at least one component is not in the known state within the image.

3. The method of claim 1 further comprising, periodically iterating to the instructing to move the at least one component or to move a different component to the known state or to an additional known state.

4. The method of claim 1 further comprising, iterating to the instructing in response to a request received for a replay attack check on the peripheral.

5. The method of claim 1 , wherein instructing further includes receiving a peripheral identifier for the peripheral and a replay attack check for the known state from a security system of a server.

6. The method of claim 1 , wherein instructing further includes selecting the known state and the at least one component from a list of available known states and available components associated with the peripheral.

7. The method of claim 1 , wherein evaluating further includes switching from a first region of interest being evaluated within previous images captured of the peripheral to a second region of interest within the image associated with the at least one component in the known state.

8. The method of claim 7 , wherein switching further includes evaluating the second region of interest within the image for the at least one component being in a known location or being in a known orientation associated with the known state.

9. The method of claim 1 , wherein processing further includes initiating a security workflow as the security operation on a host device associated with the peripheral.

10. The method of claim 1 , wherein processing further includes shutting down the peripheral as the security operation ensuring the peripheral is inoperable for operation within a host device associated with the peripheral.

11. The method of claim 10 , wherein shutting down further includes sending a security alert to a security system of a server after processing the security operation.

12. A method, comprising:

requesting a peripheral to move from a current state;

obtaining an image captured of the peripheral after the peripheral confirms moving;

inspecting a region of the image that should be associated with a component of the peripheral being in a different location or a different orientation from the current state;

determining that a replay attack is underway for a camera that captured the image when the region of the image does not depict the component of the peripheral moving from the current state; and

performing at least one security operation on the peripheral or a host device associated with the peripheral when the replay attack is determined to be underway.

13. The method of claim 12 further comprising, processing the method on a server that is remotely connected to the host device.

14. The method of claim 12 further comprising, processing the method on the host device.

15. The method of claim 12 , wherein determining further includes comparing a previous location for the component within the region depicted in a previous image for the peripheral against a depicted location for the component in the image to determine whether the component moved from the current state.

16. The method of claim 12 , wherein determining further includes comparing the component within the region depicted in the image against an expected location or an expected orientation associated with moving the peripheral from the current state to a known state.

17. The method of claim 12 , wherein performing further includes performing the at least one security operation by shutting down the host device for operation until the peripheral device is inspected for a security threat.

18. The method of claim 17 , wherein performing further includes raising a security alert from the host device in addition to the performing of the at least one security operation.

19. A system comprising:

a host device comprising a camera, a host device processor, and at least one peripheral device;

a server comprising a server processor;

the host device processor configured to execute host device instructions to perform operations comprising:

monitor first images taken of the at least one peripheral device by the camera;

determining from a first region overlaid in the first images whether non-busy components of the at least one peripheral device show changes associated with a security threat to the host device or the at least one peripheral device;

processing a security operation to disable one or more of the host device and the at least one peripheral device when the security threat is determined to be present from the changes;

periodically instructing the at least one peripheral device to move busy components from an idle state;

determining from a second region overlaid in a second region of second images provided by the camera and after the at least one peripheral device was instructed to move the busy components whether busy components moved from the idle state; and

processing the security operation to disable one or more of the host device and the at least one peripheral device when the second region of the second images are not depicting movement of the busy components from the idle state; and

raising a security alert to the server indicating that a potential replay attack is underway with respect to the camera and the at least one peripheral device when the busy components did not move in the second images from the idle state;

the server processor configured to execute server instruction to perform second operations comprising:

receiving the security alert from the host device; and

dispatching a service engineer or a technician to the host device to inspect the at least one peripheral device and the camera of the host device.

20. The system of claim 19 , wherein the host device is an automated teller machine, a self-service terminal, a point-of-sale terminal, or a kiosk, and wherein the at least one processor includes one or more of a card reader, a media depository, and a media recycler.