Remote ATM Attack Uses SMS To Dispense Cash 150
judgecorp (778838) writes "A newly discovered malware attack uses a smartphone connected to the computer that manages an ATM, and then sends an SMS message to instruct it to dispense cash. The attack was reported by Symantec, and builds on a previous piece of malware called Backdoor.Ploutus. It is being used in actual attacks, and Symantec has demonstrated it with an ATM in its labs, though it is not revealing the brand of the vulnerable machines."
Asleep at the wheel. (Score:5, Insightful)
Really? This stuff isn't being done to begin with?
Re:Asleep at the wheel. (Score:4, Interesting)
Banks barely do anything. They make insane profits but the scumbags refuse to spend a dime on security or maintenance.
The difference between a bank and organized crime is that you know what to expect from organized crime.
Re: (Score:2)
Banks are protected by law enforcement, insurance, etc. They have well established loss rates due to theft, fraud, etc. and they take appropriate measures to address those loss rates.
I, personally, would not want to pay a surcharge on my ATM card or other bank accounts to supplement the current security with "overkill" measures that cost more than they benefit, just for the satisfaction of knowing that crooks can't steal from MY bank.
Re: (Score:1)
Overkill such as following standard security protocols and networking and IT basics? Or using 2 decade old smart-card technology that EUROPE has used for 20 years? The solution is to go back to strict bank regulation. They obviously cant be trusted to operate on their own.
Re: (Score:2)
Re: (Score:2)
And they decided that they get the most benefit by shifting the cost onto law enforcement paid for by other people.
Re: (Score:2)
In this case, overkill like a $4.95 locking doorknob?
Re: (Score:2)
No, more like management oversight, design review, and other bureaucratic steps to ensure that the proper locking doorknob is selected and properly installed. Even if the committee selected a $4.95 knob as proper (which, after examining the situation they probably wouldn't), the overhead costs of all that would amount to thousands of dollars per doorknob effectively installed.
Re: (Score:2)
So how do you like paying for the added burden on law enforcement to track the crooks down and get the money back?
Re: (Score:2)
Better than I would like for paying for theoretical "perfect" security on the banking system.
Besides, everybody knows the cops can catch bank robbers, and those same cops actually protect my home - if they weren't out there getting a rep. with hold up artists, people might be more inclined to B&E on private residences.
Re: (Score:2)
Nobody is asking for perfect. At this point, some sign of actually trying would be a step in the right direction.
Re: (Score:3)
Re: (Score:3, Interesting)
Banks don't make ATMs. Blaming banks for poor ATM security is, for the most part, like blaming someone who was in an accident because their defective ignition switch shut off the car. Banks need to make sure their ATMs are physically protected and maintained. They do this, for the most part.
Firms like Triton and Diebold build ATMs. That's where change will really have an impact.
Re: (Score:3)
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Re:HUH? (Score:4, Informative)
"they are not charging you a red cent if they have a theft."
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Really? You think when a thief steals $1000 from an ATM that the bank gets paid back by the government? What country do you live in? The government insurance only kicks in when a bank actually fails - then the depositors get the money - not the bank.
Re: (Score:2, Flamebait)
Re: (Score:1)
Either way, the bank either charges you higher service fees and lower interest, or it gets private insurance, or it goes crying, Oliver Twist-style, to the government with its hands out. The bank loses nothing. Ever. But they sure tell YOU to take risks!
Like I said, government does not pay for theft. Okay, so it raises service fees or gets private insurance. Are you complaining that their business model is to profit?
Re: (Score:1)
Re: (Score:2)
They sure aren't very fast or dependable at replacing any money that is stolen through a debit card (such as debt card being used in a fraudulent ATM to skim the PIN).
Similarly we all pay increased costs through fees being spread out through the whole customer base for credit card fraud.
Re: (Score:1)
Re: (Score:1)
"they are not charging you a red cent if they have a theft."
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Really? You think when a thief steals $1000 from an ATM that the bank gets paid back by the government? What country do you live in? The government insurance only kicks in when a bank actually fails - then the depositors get the money - not the bank.
I seem to remember trillions of dollars in bailout insurance being paid to banks, not the customers through FDIC, while they remained open and more profitable than ever. This is socialized government insurance, where moral hazard is removed and its business as usual.
Re: (Score:1)
Re: (Score:1)
You mean loaned out to banks. Banks either paid that back or they failed. Most of it was paid back.
You are repeating the banks' talking points. Some of it loaned out. Some of it was given out. Some of it was exchanged for worthless assets. In the end the bottom line is most people were screwed and the the banks profited.
Were you offered extremely low interest loans which you immediately were allowed to profit massively off of by selling higher interest loans and dissolving your bad investments?
Why didn't the Fed do the right think and allow the irresponsible banks to fail and instead invest those trilli
Re: (Score:2)
If the banks were truly too big to fail, they should have been nationalized, senior management at least fired, preferably arrested and charged and the banks broken into small pieces and sold.
Re: (Score:1)
If the banks were truly too big to fail, they should have been nationalized, senior management at least fired, preferably arrested and charged and the banks broken into small pieces and sold.
Yes, completely. Whether it was fraud or incompetence it is sheer lunacy that we permitted such behavior.
Re: (Score:2)
Funny thing is all the people who scream "socialist" about Obama and the Democrats and even obvious things like nationalizing the failing banks they don't do, rather instead supporting them.
Newest American Ambassador to my country is a former Wells Fargo big shot, which shows their true stripes.
Re: (Score:1)
Don't trust banks / bankers / insurance / sales people. They do not have your own best interests at heart.
Re: (Score:2)
Really? This stuff isn't being done to begin with?
Why would they? It's in a locked steel box. People aren't using it to surf the web.
Re: (Score:3)
Re: (Score:3)
The 7-11 I used to frequent had a ethernet jack near the soda dispensers......this jack was where the nearby ATM was plugged in. It would have been quite easy for me to insert any sort of device between the ATM and the jack. There was enough space between the jack and the ATM and there was also a valid reason for me to be in the area that it wouldn't look like I was doing anything with it. While it wasn't an official bank ATM (unaffiliated), I still could have been malicious had I wanted to. [I also nev
encrypted (Score:1)
Re: (Score:2)
Actually, that sounds like info muggers would find pretty valuable.
Re: (Score:2)
Note that the cable might be ethernet,
So there's your attack vector. Note that you may heavily encrypt the output of all the input devices, but with your own device drivers or added hardware there is little you can do about replaying the input signals themselves. Or from "swallowing" the cards and transmitting all the PIN codes.
Re: (Score:2)
Do you know how many times I've seen an ATM with the Windows Blue Screen of Death on it?
Not hundreds, but over 30. I have *long* suspected these things are exceedingly vulnerable computers being used when they shouldn't be.
I've been airports and seen the arrivals/departures board showing NT errors. I have seen stuff in shop windows and other stuff showing similar stuff. A lot of medical devices can't be upgraded because the company never certified it beyond a certain level of Windows.
I usually make a poi
Re: (Score:2)
I once went to a BB&T ATM and when I tried to use it, it crashed with an Internet Explorer script error.
Re: (Score:3)
I've seen genuine guru meditation errors on screen from the local public access channel in the last 5 years. Think about that. An Amiga still in daily use.
Re: (Score:2)
"Please enter the amount."
700
"The amount entered is not divisible by 0. Please select:
[650]
[750]
[other]
[cancel]"
I choose "Cancel" just in case it applies similar mathematics to my actual payout.
Re: (Score:2)
Banks usually make an effort to have physical security, but not so much all the random supermarkets and shops that have an ATM inside.
What is more interesting is that the cash draw is physically secure. The attackers don't bother trying to open it. Instead they attack the control hardware, and you would think they could make that equally secure. It seems that the desire to load firmware updates, or more specifically new advertising on to machines via a simple and largely unprotected USB connection was too m
Re: (Score:2)
Re: (Score:2)
What, you think the exploit wasn't using Windows? And that wasn't relevant?
Delusional!
Re: (Score:2)
Yeah, I'd be complaining if there were no soldiers on the inside to protect a wall breach.
The emperor really doesn't have any clothes.
Re: (Score:2)
It would be irrelevant, considering there shouldn't even be a wall breach (physical access to the I/O ports of the hardware).
You should be able to insert a card, receive cash, and enter PINs. That's it.
Knowing Diebold though, you can probably buffer overrun the machine with a malformed track 3 on the card.
Physical access? (Score:5, Insightful)
So, this method requires quite a bit of physical access to the ATM. You have to attach a phone (why smartphone, by the way?) to the actual ATM controller.
In my opinion this begs a whole set of other security questions first....
Re: (Score:1)
In my opinion this begs a whole set of other security questions first....
No, it doesn't. It raises questions.
"Begs the question" means something entirely different than what you meant. Please don't misuse this term.
http://begthequestion.info/ [begthequestion.info]
http://public.wsu.edu/~brians/... [wsu.edu]
Re: (Score:2)
That battle is lost, man. The language has already changed.
Re:Physical access? (Score:5, Insightful)
Re: (Score:1)
...AFTER drilling a hole in the physical device...
There's a joke somewhere in there; complete the phrase "Any 'remote' exploit which involves drilling..."
Re: (Score:2)
(why smartphone, by the way?)
It probably connects to a serial port or something.
ATM machines have ports where you can plug in a diagnostic computer. One of the diagnostic functions will be "test the cash dispenser".
The SMS trigger is just there so they can do it at night and make sure somebody's standing there to grab the money.
Re: (Score:2)
Wrong century... ATMs of today are running on off the shelf hardware, with "special" (as in special needs) operating systems (Windows). They have exposed USB ports under the hood and to make it completely idiotic, the only thing locked behind high security is the money. The motherboard is quite often found just under the keypad, which can be accessed by standard keys.
See these guys http://www.youtube.com/watch?v... [youtube.com] (Unfortunately the actual hack is poorly recorded, but still quite interesting).
Re: (Score:2)
I'm pretty sure that the rationale for slack physical security (other than the cash box) is that the store clerk or the camera pointed at it will discourage people from drilling holes in the CPU.
As per a previous /. article, maybe ATM makers moving to a new OS and PC might help matters. Linux is a good candidate. No AutoRun/AutoPlay capability present for starters (although Windows can have it easily turned off as well.)
Ideally, what might be best is to move to a motherboard that is designed from the grou
Re: (Score:2)
Seems to me that it needn't be a smartphone, any device with the proper digital interface can probably do the trick - but it makes better press to say "Force the ATM to dispense cash using SMS..."
I suppose it might make it easier for the crooks to blend in while they take away the loot - just send the SMS while you act like you are doing a legitimate transaction and then walk away with $400. Come back later and do it again, and again... Get a lot of "theft rush" and exposure to potential arrest for your e
Re: (Score:2)
"So, this method requires quite a bit of physical access to the ATM. "
I did once peek over the shoulders of a guy servicing one of those in-store ATMs (i.e., one that looks like a stand-alpne cabinet, not one that's integrated into a wall). Apparently, it's not all that tightly locked down, hardware-wise. The guy told me that only the compartment that contains the banknotes and the counting mechanism have heavy physical security, and that he couldn't access that part. That was why he was allowed to service
Re: (Score:1)
In the vast majority of atms there is just an ordinary pc running windows xp, they are not secure at all from a tech standpoint. This is about being able to steal in the future. If you come in dressed as the repair guy and hide a phone connected to the pc, you didn't take any money, the money fillers won't notice anything nor any audits if any are done. Then you wait a year or whatever and start stealing from it, if they do manage to figure out it's infected/find the phone, who put it there? Do they sti
Re: (Score:2)
I'd think that if you had physical access to the USB port, you would also have physical access to the cash itself and could just take it.
I think that that would be a poor design. One box for the hardware (you don't need armoured car knuckle draggers messing with the electronics), and one box containing the cash (You don't need the maintenance nerds walking away with pocketsfuls of crisp new bills). Both of those would be inside a box that locks out the general public. Actually, I'd probably put the cash inside a box inside the cash portion of the machine, so the armoured car folks are not dealing with cash, but with locked boxes that they
Re: (Score:2)
There's an app for that (Score:5, Funny)
I'd like to announce my new app for sale - Free after using the $200 rebate redeemable at a nearby ATM.
Diebold (Score:2, Interesting)
How's Diebold for a guess? Those fuckers are vulnerable to just about everything.
Re: (Score:2)
Better?
Re: (Score:2)
That was my first guess. My bank uses them, and they are absolutely amazing in terms of completely uninformed user interface design. They've upgraded them over the years and are a little better, but they are just terrible to use physically and electronically. Not really related to hacking, other than by the fact they just don't care about making a quality product.
Who said no one would pay for SMS (Score:3, Funny)
after whatsapp.
Re: (Score:1)
In soviet russia SMS pays yo... wait, that doesn't make sense since this is about the USA.
Physical Access = owned (Score:4, Informative)
This is a physical access attack and therefore not very interesting.
To do this you have to cut the ATM open at the point where the computer is installed and attach a smartphone to the USB port (or in older versions, a USB stick, or keyboard). They recommend upgrading the OS and securing the hard drive. How about putting epoxy in the computer's device ports?
Re:Physical Access = owned (Score:5, Insightful)
or you could cut the ATM open at the point where the cashbox is installed
to say this attack is "just not interesting" is an understatement
Re: (Score:2)
I'd assume the box that the money is in is secured and had paint or the like that will trigger when it is opened.
Plus you can only do it once and it is very noticeable. Chopping a small hole in the box and secretly installing a small phone you could exploit time and time again without drawing attention from passers by.
Re: (Score:2)
look up how they're made, you won't be "chipping a small hole" in anything to access its system and you will set alarm off
Re: (Score:2)
As I said above, you can get the access and look like a maintenance tech, then button it up and walk away with big bulges in your pockets.
Come back later, looking innocent, and take a few hundred bucks per transaction. It makes machines that are protected by highly public physical location (most ATMs) more vulnerable to attack in plain sight by innocent looking people.
Sure, you could cut out the cash box and haul ass in a big pickup truck, but somebody would probably notice that something isn't right about
Re: (Score:2)
If you have physical access, why not grab the money directly?
Re: (Score:2)
The money is locked in a hardened steel enclosure similar to a safe. Apparently the computer is not. This attack is probably one of the easier ways to get at the money.
Re: (Score:2)
Re: (Score:2)
These machines rarely miscount, and if it happens once a day, the bank will probably take notice. There was a weird little trick on certain ATMs a while back that let you tease an extra note from the machine, but the banks caught on very quickly.
Re: (Score:2)
In the early days of ATMs (1980s) I used to get "overcounts" about 5% of the time at certain machines... that doesn't happen (to me) as much anymore, but I'm mostly plastic based now, so maybe it still does.
You could probably spit out several hundred dollars per "pull" with the phone-hack and not raise suspicion - a really good hack would falsify the expected balance, too, so they don't notice the missing cash, but you'd think the guy changing the cash box would notice the thing stuck in the USB port, event
Re: (Score:2)
Re: (Score:2)
I should also mention that I got one or two "undercounts" during that era... my ATMs were all remotely located from the branches, so reporting wasn't exactly convenient. I figured it all worked out in the end, but I might have come out $20 to $30 ahead, overall.
The swipe your ATM card to checkout at the grocery also failed to process a couple of the earliest transactions (there really was a free lunch, those days...), I waited months and months looking for them to show up on the statements, but they never
Re: (Score:2)
In the early days of ATMs (1980s) I used to get "overcounts" about 5% of the time at certain machines... that doesn't happen (to me) as much anymore, but I'm mostly plastic based now, so maybe it still does.
I'm quite surprised how well the ATMs handle the plastic money, especially during this transition phase when it is a mix of paper and plastic. As a human, I have trouble correctly counting the plastic money, it's thinner and sticks to neighbouring bills.
Re: (Score:2)
Re: (Score:2)
Which, apparently, might not be as difficult as we think.
Security is only as good as its weakest link, as they say. And if one of these things is in a place where you could get in and out without being observed (because, say, you've got a clone of the key or know how to bypass the lock) ... well, then this is going to happen.
Free money is worth someone spending time working these thin
Re: (Score:2)
Re: (Score:1)
The ATM has a computer having the operating system and a basic bootstrap software. In fact, the configuration itself it is not located in the ATM but when the ATM is turned on, it is sent to it from the Bank. One important reason is that when somebody steal the ATM, will lost all the configuration including many different types of keys, making the task of opening it or to learn more about the ATM's network behaviour a difficult task.
When the security e
Re: (Score:2)
This is a physical access attack and therefore not very interesting.
This. Everyone knows all you have to do is play some music on the keypad and the ATM will give you money. "Take me down to the basement, fill the buckets with cheese..."
"And we won't, won't pay for this song 'cause it's pub-lic domain!"
Re: (Score:2)
Physical access IS root access!
Physical access is far, far greater than root access.
USB port? (Score:2, Insightful)
How does anyone access the USB port of the computer that controls the ATM, without breaching enough physical security that they might as well just grab the money? Sounds like this could only work if an insider at the bank in question smuggles in a phone and hooks it to the computer. You can't just pull up to an ATM and do this.
Re: (Score:2)
The money is stored in a heavily secured enclosure within the ATM.
It comes down to exposure time for the thief. Popping an access plate off the USB ports, plugging in and feeding $20s out, one at a time is going to take a while. The stolen tow truck, chain and winch is much faster.
Diebold (Score:1)
Re: (Score:2, Insightful)
Switching to Linux wouldn't solve their physical security issue.
Hackers (Score:1)
"Anyway, anyway, guys guys guys, come on. I'm in this computer, right. So I'm looking around, looking around, you know, throwing commands at it, I don't know where it is or what it does or anything. It's like, it's like choice, it's just beautiful, okay. Like four hours I'm just messing around in there. Finally I figure out, that it's a bank. Right, okay wait, okay, so it's a bank. So, this morning, I look in the paper, some cash machine in like Bumsville Idaho, spits out seven hundred dollars into the midd
Re: (Score:2)
If you've ever been the victim of crime you will know the cops do nothing for you. They fill out a report so you can make an insurance claim. That is all. They will give you attitude while doing it. You are bothering them.
The FBI has buildings full of cops dedicated to protecting the banks.
Look at the bright side (Score:2)
Windows XP Based ATM (Score:1)
Does anyone find fault with the phrase "Windows XP Based ATMs"?
Regardless of whether this exploit requires an insider for access to the physical machine, securing $10k-$20k worth of cash with one of the most commonplace operating systems on the planet seems beyond asinine to me.
Re: (Score:2)
XP Embedded. It's a slightly different beast from XP Home. And either way, you shouldn't have physical access, so it's irrelevant whether it runs Windows, Linux, FreeDOS, or even frigging BeOS.
Oh, take a wild guess (Score:2)
Gotta be Diebold. Yes, they changed their name. No, those thieves should never be allowed to remove the albatross of crooked voting machines from their scrawny, corrupt necks.
Re: (Score:2)
Yeah, that was my response too. Diebold is well-known to do a shit job with ATM security.
'Magic Number' could be a valid Credit Card Number (Score:2)
FWIW, the magic number '5449610000583686' mentioned in the article passes the Luhn Algorithm [wikipedia.org], and is therefore valid as a credit card number. The BIN indicates the card was/would be issued by the following bank, transcribed from this site [bindb.com]:
Bin: 544961
Card Brand: MASTERCARD
Issuing Bank: HSBC BANK (PANAMA) S.A.
Card Type: CREDIT
Card Level: PLATINUM
Iso Country Name: PANAMA
Iso Country A2: PA
Iso Country A3: PAN
Iso Country Number: 591
Please... (Score:2)
...if you want an ATM open, you smash it on a methhead's head.
Around here, they use gas... (Score:2)
Fill up the ATM with propane gas through the money slot.
Set up a fuse.
Pick up money and run.
Some photos [google.pl].
Quite impressive, though the success ratio isn't too high.
Re: (Score:1)
The SMS is just a way to communicate to the phone. What the hackers have done (if I'm reading the FA correctly) is make a phone pretend to be a USB keyboard attached to the PC in the ATM. The phone can then be set up to send a control sequence to the ATM tell the ATM to spit out money. So the problem has nothing to do with either SMS or Windows XP. If the ATM was VAX or Mac OS or Home brew OS or Linux and you did not lock down the local USB ports then it would have the same issue.
The general issue of USB p
Re: (Score:2)
OT, I know, but shouldn't that be: Premier Election Rigging Systems?
Re: Diebold? (Score:1)
Actually Obama beat Romney by 3.7 % of popular vote, not 1%. And about 100 more electoral college votwa for Obama.
And Reagan's landslide over Mondale was indeed a landslide. Reagan--57% to Mondale's 42%. The only state Mondale took was Minnesota. And in the electoral college Reagan had 97% od the votes.
Re: (Score:1)
Seriously? The % variance from election to election is about 2-5%. Has been for years. Our country pretty votes 50/50 for the two parties. The only exception was the 92 election in which periot got a significant amount. It has been this way since the 60s. Even the 'landslide' of Regan vs Mondale was by ~2%.
Accept it. Both dudes lost by a narrow margin. You are clinging to conspiracies because your dude lost. Even the 'crushing victory' in the last two was by ~1%. Voter fraud does exist. However, statistically it is negligible. Even Nate Silver accepts that...
Successful voter fraud is undetectable, and thus immeasurable.
You cannot quantify it without verifying individual votes, and you can't do that without tracking each individual vote and removing voter's anonymity.
I am not claiming that it is rampant. I am merely stating the fact that you cannot know how much of a problem it is. Saying it's very rare is as much bullshit as saying it's very frequent.
Re: (Score:2)
You can set up systems where it is hard to do fraud and systems where fraud is trivial. That is the problem with most electronic voting so far. How do you ever know if Diebold has a way to flip 1% of the votes? In a close election it doesn't take much to flip the results.
Then there is the other types of election fraud, often legal. Gerrymandering, strategic placement of polling station, limiting the number of polling booths in areas are some examples.
Re: (Score:2)
people still use cash?
Yes, people still use cash. People still use phones to make voice calls. People still commute to work. People still play CDs and DVDs. People still have standard def televisions. People still use cars powered exclusively by internal combustion engines. People still buy things in actual physical stores. People still wear baseball caps with the bills pointed forward. People still take an entire television season to watch a season's worth of television shows. And some people still actually converse wi