Slashdot Mirror

← Back to Stories (view on slashdot.org)

Cybercriminals Refine ATM Data-Sniffing Software

Posted by CmdrTaco on from the win-atm-lose dept.

BobB-nw writes "Cybercriminals are improving a malicious software program that can be installed on ATMs running Microsoft's Windows XP operating system that records sensitive card details, according to security vendor Trustwave. The malware has been found so far on ATMs in Eastern European countries, according to a Trustwave report. The malware records the magnetic stripe information on the back of a card as well as the PIN, which would potentially allow criminals to clone the card in order to withdraw cash. The collected card data, which is encrypted using the DES algorithm, can be printed out by the ATM's receipt printer, Trustwave wrote."

7 of 257 comments (clear)

  1. ATM != desktop computer by Smelly+Jeffrey · · Score: 4, Insightful

    An ATM is not a desktop computer. WTF is an ATM doing running Windows?

    1. Re:ATM != desktop computer by NES+HQ · · Score: 5, Insightful
      Why shouldn't an ATM run Windows? Cue the standard Windows-bashing, but a decently hardened copied of XP is more than sufficient for the minimal work that an ATM has to do.

      Also, anyone with any network design sense would vlan & firewall the ATMs off of the rest of the network.

      Yes, it's Windows. But without crazy Aunt Judy trying to install her cat screensavers Windows should be fine for the task.

    2. Re:ATM != desktop computer by 99BottlesOfBeerInMyF · · Score: 5, Insightful

      Ultimately it comes down to "why not?"

      It costs a licensing fee. It has more security liability than pretty much any other choice.

      The cost of a Windows XP licence is trivial compared with that of the hardware and custom software development.

      Linux costs nothing to license. BSD costs nothing to license. Windows costs something. That's an added, unneeded cost.

      Might as well go for one that has lots of development tools for which the software can be run on a normal desktop computer.

      Because there aren't lots of dev tools for Linux that run on a normal desktop computer?

      . It's easier to develop for windows that to develop for a custom devkit.

      How is it easier to develop an ATM on Windows than on Linux? They both have tons of tools and myriad experienced developers and companies. Linux is probably better optimized for appliance uses and has a larger share of the appliance market than Windows, making it easier to find companies to work on it.

      In short, I don't buy your arguments at all. Using Windows on an ATM is a sign someone in management somewhere is an incompetent buffoon.

    3. Re:ATM != desktop computer by iamhigh · · Score: 4, Insightful

      I'll second your argument, and I could be considered an MS fanboy by this crowd's standard. But there is no reason to have an ATM running windows, the most used, most exploited OS on something like an ATM. I wouldn't even use Linux, but probably recommend a custom OS, as you can control the hardware used. Then the attackers have to hack some pretty much unknown system, that can easily be built from the ground up to use software and hardware security measures.

      --
      No comprende? Let me type that a little slower for you...
  2. Simple but effecitve compliance law/rule by erroneus · · Score: 4, Insightful

    To run any "public financial transaction device" certain compliances are required and many of these are related to physical security, data security and communications security standards. Clearly, the presence of malware on ATM core software indicates that the ATM security standards are either not being met or are terribly inadequate.

    It occurs to me that one rule that might go a long way to making machines like ATMs (or even voting machines) more secure against corruption is a requirement that the system software should be stored in a read-only format such as CD/DVD or ROM chips. CD/DVD ROMs would probably be the most flexible method and various self-check measures could help ensure that the CD/DVD ROM was genuine. (Say, for example, a validation black-box device of some sort.)

    With enough engineering and hacking, even this method could be thwarted I am sure but it would certainly raise the bar significantly beyond "crack the machine open, connect the system drive to a USB adapter, insert additional code, close up" which is the method of entry I suspect is most used. If there was limited to no local storage and ROM-based operating systems and software combined with solid verification technologies, it would take some serious knowledge to compromise such machines.

    This sort of method would make running Windows XP as the operating system considerably more difficult, but if they are hard-set on running Windows, I am sure they would find a way to comply if it were required.

  3. Re:The top 10 ways computer security list by Canazza · · Score: 5, Insightful

    Using Windows on the Internet is like having a unprotected sex with a member of the opposite sex you met in a club. Looks good enough for you, does what you need it to, but the risk of infection is high.
    Using Linux on the internet is like having unprotected sex with a cow. It's harder to catch a compatible infection, but it's ugly and unlikely to play any of the games you'd like it to.

    --
    It pays to be obvious, especially if you have a reputation for being subtle.
  4. Re:Free gas courtesy of Mircosoft! by Anonymous Coward · · Score: 5, Insightful

    The gas wasn't free, you stole it.