2014-06-02
Abstract
Malware was capable of reading PINs and data of the cards inserted into ATMs.
Copyright © 2014 Virus Bulletin
Police in the Chinese Special Administrative Region of Macau have arrested two Ukrainian men who they believe used specially crafted hardware to infect ATMs in the territory, reports Brian Krebs [1]. According to local reports, the malware that infected the ATMs was capable of reading the PINs and data of the cards inserted into the machines – a few days after the infection, the perpetrators would return to the ATMs to harvest the stolen data and remove evidence of the malware.
Malware that targets ATMs is not a new phenomenon. Last year, ATMs in Mexico were infected with the ‘Ploutus’ malware, which was installed after attackers gained physical access to the ATMs’ CD-ROM drives [2]. The malware would essentially create a backdoor that could be operated from the terminal. Anyone who knew a special code could then use it to make the ATM dispense free money, even being able to choose the amount and the denomination of the bills dispensed.
Unlike ‘Ploutus’, the malware used in Macau (about which very few details have been published) didn’t cause the ATMs to dispense money – instead, it merely recorded details of the cards that were inserted into the machine. The malware didn’t require physical access to the ATM either – it was installed by inserting a circuit board into the card slot. And unlike in the case of ordinary ATM skimming, no physical change was made to the ATM, making it impossible for users to detect that anything was wrong.
Although it is not known what operating system the affected Macanese ATMs run on, it is slightly worrying that research performed in April this year showed that nine out of 10 ATMs still run on Windows XP [3] – which received its last ever security updates in April. Although some of these devices run the embedded version of XP, which is still supported, many others do not.
Embedded devices, from routers to Internet-controlled cameras, have become popular targets for cybercriminals, and although security awareness among those manufacturing these devices is growing, it is nowhere near as good as it should be – which, as shown by this example, can have rather serious consequences.
