Slashdot Mirror

← Back to Stories (view on slashdot.org)

Infected ATMs Give Away Millions of Dollars Without Credit Cards

Posted by Soulskill on from the i'll-order-a-dozen dept.

An anonymous reader writes: Kaspersky Lab performed a forensic investigation into cybercriminal attacks targeting multiple ATMs around the world. During the course of this investigation, researchers discovered the Tyupkin malware used to infect ATMs and allow attackers to remove money via direct manipulation, stealing millions of dollars. The criminals work in two stages. First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware. After they reboot the system, the infected ATM is now under their control and the malware runs in an infinite loop waiting for a command. To make the scam harder to spot, the Tyupkin malware only accepts commands at specific times on Sunday and Monday nights. During those hours, the attackers are able to steal money from the infected machine.

4 of 83 comments (clear)

  1. So many ways this could've been prevented? by Anonymous Coward · · Score: 2, Insightful

    Why does an ATM have a cd drive, let alone usb ports or anything else? Why does it boot off of media without altering the BIOS and requiring a password? Why isn't the OS encrypted making modification require more difficult techniques like bootkits which has other protection mechanisms?

  2. Re:This doesn't add up by nojayuk · · Score: 5, Insightful

    Going back repeatedly isn't going to work -- the bank or financial company maintaining the ATMs does actually count the money going into the machines and the amounts legally withdrawn and if they don't balance then investigations are carried out. Put in 10000 quatloos, 7000 quatloos withdrawn by customers over a few days, 1000 quatloos left when the next refill is carried out = something fishy. Cookie jar accountancy rules apply, eventually Mom will notice the distinct lack of cookies and eventually catch you cookie-crumb-handed.

  3. Re:These on XP? by Obfuscant · · Score: 5, Insightful

    If so, are they exploiting some vulnerability in XP that is never-to-be-patched?

    They are exploiting a vulnerability that is found in almost every operating system, and which has yet to be patched by any vendor. It's called "running a program". As the summary says:

    First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware.

  4. Re:This doesn't add up by davester666 · · Score: 4, Insightful

    yeah. those are called "atm fee's". Oh wait, we're talking about different criminals.

    --
    Sleep your way to a whiter smile...date a dentist!