Slashdot Mirror
Remote ATM Attack Uses SMS To Dispense Cash
judgecorp (778838) writes "A newly discovered malware attack uses a smartphone connected to the computer that manages an ATM, and then sends an SMS message to instruct it to dispense cash. The attack was reported by Symantec, and builds on a previous piece of malware called Backdoor.Ploutus. It is being used in actual attacks, and Symantec has demonstrated it with an ATM in its labs, though it is not revealing the brand of the vulnerable machines."
"The company recommended that ATM operators provide better physical security for the computers controlling the machines, lock down BIOS or system hard drives, deploy lock-down software or upgrade to a supported operating system."
Really? This stuff isn't being done to begin with?
So, this method requires quite a bit of physical access to the ATM. You have to attach a phone (why smartphone, by the way?) to the actual ATM controller.
In my opinion this begs a whole set of other security questions first....
I'd like to announce my new app for sale - Free after using the $200 rebate redeemable at a nearby ATM.
He's getting rather old, but he's a good mouse.
How's Diebold for a guess? Those fuckers are vulnerable to just about everything.
after whatsapp.
This is a physical access attack and therefore not very interesting.
To do this you have to cut the ATM open at the point where the computer is installed and attach a smartphone to the USB port (or in older versions, a USB stick, or keyboard). They recommend upgrading the OS and securing the hard drive. How about putting epoxy in the computer's device ports?
How does anyone access the USB port of the computer that controls the ATM, without breaching enough physical security that they might as well just grab the money? Sounds like this could only work if an insider at the bank in question smuggles in a phone and hooks it to the computer. You can't just pull up to an ATM and do this.
And they make election equipment, to count votes. Sheeesh! ATMs I am less worried about because I get my money back when they screw up... If the theft amount gets too painful, the banks will look a better vendor. And switch to Linux...
1 Dachshund + 1 Dachshunds = A Paradox.
The SMS is just a way to communicate to the phone. What the hackers have done (if I'm reading the FA correctly) is make a phone pretend to be a USB keyboard attached to the PC in the ATM. The phone can then be set up to send a control sequence to the ATM tell the ATM to spit out money. So the problem has nothing to do with either SMS or Windows XP. If the ATM was VAX or Mac OS or Home brew OS or Linux and you did not lock down the local USB ports then it would have the same issue.
The general issue of USB ports happily accepting keyboard has been an issue with ATMs before, but you have to stand by the ATM with a keyboard. This way you just plug in the phone and leave it there to exploit time and time again.
Wow, I should not post when knackered.
Actually Obama beat Romney by 3.7 % of popular vote, not 1%. And about 100 more electoral college votwa for Obama.
And Reagan's landslide over Mondale was indeed a landslide. Reagan--57% to Mondale's 42%. The only state Mondale took was Minnesota. And in the electoral college Reagan had 97% od the votes.
"Anyway, anyway, guys guys guys, come on. I'm in this computer, right. So I'm looking around, looking around, you know, throwing commands at it, I don't know where it is or what it does or anything. It's like, it's like choice, it's just beautiful, okay. Like four hours I'm just messing around in there. Finally I figure out, that it's a bank. Right, okay wait, okay, so it's a bank. So, this morning, I look in the paper, some cash machine in like Bumsville Idaho, spits out seven hundred dollars into the middle of the street. That was me. That was me. I did that."
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Mostly random stuff.
What, you think the exploit wasn't using Windows? And that wasn't relevant?
Delusional!
There are two types of people in the world: Those who crave closure
"they are not charging you a red cent if they have a theft."
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Really? You think when a thief steals $1000 from an ATM that the bank gets paid back by the government? What country do you live in? The government insurance only kicks in when a bank actually fails - then the depositors get the money - not the bank.
> They now call themselves Premier Election Systems.
OT, I know, but shouldn't that be: Premier Election Rigging Systems?
I'll see your senator, and I'll raise you two judges.
At least most modern mobile plans give you unlimited SMS.
I'll see your senator, and I'll raise you two judges.
Either way, the bank either charges you higher service fees and lower interest, or it gets private insurance, or it goes crying, Oliver Twist-style, to the government with its hands out. The bank loses nothing. Ever. But they sure tell YOU to take risks!
Mostly random stuff.
"they are not charging you a red cent if they have a theft."
No, they socialize that to the government insurance, which you pay for with your taxes. Banks take zero risk here.
Really? You think when a thief steals $1000 from an ATM that the bank gets paid back by the government? What country do you live in? The government insurance only kicks in when a bank actually fails - then the depositors get the money - not the bank.
I seem to remember trillions of dollars in bailout insurance being paid to banks, not the customers through FDIC, while they remained open and more profitable than ever. This is socialized government insurance, where moral hazard is removed and its business as usual.
Does anyone find fault with the phrase "Windows XP Based ATMs"?
Regardless of whether this exploit requires an insider for access to the physical machine, securing $10k-$20k worth of cash with one of the most commonplace operating systems on the planet seems beyond asinine to me.
Gotta be Diebold. Yes, they changed their name. No, those thieves should never be allowed to remove the albatross of crooked voting machines from their scrawny, corrupt necks.
I have also seen a Windows 2000 screen on an ATM recently in America.
Peter predicted that you would "deliberately forget" creation 2000 years ago...
You mean loaned out to banks. Banks either paid that back or they failed. Most of it was paid back.
Seriously? The % variance from election to election is about 2-5%. Has been for years. Our country pretty votes 50/50 for the two parties. The only exception was the 92 election in which periot got a significant amount. It has been this way since the 60s. Even the 'landslide' of Regan vs Mondale was by ~2%.
Accept it. Both dudes lost by a narrow margin. You are clinging to conspiracies because your dude lost. Even the 'crushing victory' in the last two was by ~1%. Voter fraud does exist. However, statistically it is negligible. Even Nate Silver accepts that...
Successful voter fraud is undetectable, and thus immeasurable.
You cannot quantify it without verifying individual votes, and you can't do that without tracking each individual vote and removing voter's anonymity.
I am not claiming that it is rampant. I am merely stating the fact that you cannot know how much of a problem it is. Saying it's very rare is as much bullshit as saying it's very frequent.
Yeah, I'd be complaining if there were no soldiers on the inside to protect a wall breach.
The emperor really doesn't have any clothes.
There are two types of people in the world: Those who crave closure
FWIW, the magic number '5449610000583686' mentioned in the article passes the Luhn Algorithm, and is therefore valid as a credit card number. The BIN indicates the card was/would be issued by the following bank, transcribed from this site:
Bin: 544961
Card Brand: MASTERCARD
Issuing Bank: HSBC BANK (PANAMA) S.A.
Card Type: CREDIT
Card Level: PLATINUM
Iso Country Name: PANAMA
Iso Country A2: PA
Iso Country A3: PAN
Iso Country Number: 591
Tiller's Rule: Never use a word in written form that you've only heard and never read. You will end up looking foolish.
...if you want an ATM open, you smash it on a methhead's head.
You mean loaned out to banks. Banks either paid that back or they failed. Most of it was paid back.
You are repeating the banks' talking points. Some of it loaned out. Some of it was given out. Some of it was exchanged for worthless assets. In the end the bottom line is most people were screwed and the the banks profited.
Were you offered extremely low interest loans which you immediately were allowed to profit massively off of by selling higher interest loans and dissolving your bad investments?
Why didn't the Fed do the right think and allow the irresponsible banks to fail and instead invest those trillions on paying directly to the consumers the raised 250k FDIC insurance? Why weren't the bad actors weeded out? Instead the banks were told quite clearly they must stay large so they become too big to fail and in a couple years they can start aggressively find new games to play with peoples life savings.
people still use cash?
Yes, people still use cash. People still use phones to make voice calls. People still commute to work. People still play CDs and DVDs. People still have standard def televisions. People still use cars powered exclusively by internal combustion engines. People still buy things in actual physical stores. People still wear baseball caps with the bills pointed forward. People still take an entire television season to watch a season's worth of television shows. And some people still actually converse with other people live and in person, in real time. I know that some of these things are hard for you to believe, and hard for you to relate to. But they persist nonetheless.
It would be irrelevant, considering there shouldn't even be a wall breach (physical access to the I/O ports of the hardware).
You should be able to insert a card, receive cash, and enter PINs. That's it.
Knowing Diebold though, you can probably buffer overrun the machine with a malformed track 3 on the card.
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
They sure aren't very fast or dependable at replacing any money that is stolen through a debit card (such as debt card being used in a fraudulent ATM to skim the PIN).
Similarly we all pay increased costs through fees being spread out through the whole customer base for credit card fraud.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
If the banks were truly too big to fail, they should have been nationalized, senior management at least fired, preferably arrested and charged and the banks broken into small pieces and sold.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
If the banks were truly too big to fail, they should have been nationalized, senior management at least fired, preferably arrested and charged and the banks broken into small pieces and sold.
Yes, completely. Whether it was fraud or incompetence it is sheer lunacy that we permitted such behavior.
Funny thing is all the people who scream "socialist" about Obama and the Democrats and even obvious things like nationalizing the failing banks they don't do, rather instead supporting them.
Newest American Ambassador to my country is a former Wells Fargo big shot, which shows their true stripes.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
You can set up systems where it is hard to do fraud and systems where fraud is trivial. That is the problem with most electronic voting so far. How do you ever know if Diebold has a way to flip 1% of the votes? In a close election it doesn't take much to flip the results.
Then there is the other types of election fraud, often legal. Gerrymandering, strategic placement of polling station, limiting the number of polling booths in areas are some examples.
https://en.wikipedia.org/wiki/Inverted_totalitarianism
ATM's make heavy use of encryption. Sensitive data (eg customer PIN) is encrypted so that you can not decode it. Unencrypted data is not sensitive (eg the dollar amount of the transaction). Each packet sent to the bank host is digitally signed. Each packet received from the host is also checked for its digital signature. The digital signatures have the time as part of the generation algorithm, so replay attacks don't work. If you monitored traffic on that cable then you would get a log of who took out money, the account number, the amount, the time and possibly how much was left in their account. You would get similar information by ransacking the receipt bin. If you tried to inject or replay packets in either direction then they would be rejected. I used to design EFTPOS credit card terminals. We designed them with the understanding that malicious people would be listening to everything on the cable and they would be trying to inject malicious data at every opportunity. Note that the cable might be ethernet, phone (ie modem), X.25, serial or a handful of less common types but the above applies to all of them. The worst you could really do is to cut that cable and deny the service to the customers.
I worked for a bank back in the day, was told to make code changes to the online screens to add an extra 'service fee' to the clients account, had to add a checkbox so that it could be switched off if the client complained. Checked it a couple months later, not many people even noticed it or complained, netted them an extra half a mil a month.
Don't trust banks / bankers / insurance / sales people. They do not have your own best interests at heart.
There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
Fill up the ATM with propane gas through the money slot.
Set up a fuse.
Pick up money and run.
Some photos.
Quite impressive, though the success ratio isn't too high.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
None of it was simply given to banks; it was all loaned to them. The banks had to pay that back. People love to mention the fact that the banks received trillions of dollars. The fail to mention that those banks also paid trillions back. Those same people also failed to mention that this happens on a smaller scale every second of every day between the banks and the federal reserve.