Infected ATMs Give Away Millions of Dollars Without Credit Cards

An anonymous reader writes: Kaspersky Lab performed a forensic investigation into cybercriminal attacks targeting multiple ATMs around the world. During the course of this investigation, researchers discovered the Tyupkin malware used to infect ATMs and allow attackers to remove money via direct manipulation, stealing millions of dollars. The criminals work in two stages. First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware. After they reboot the system, the infected ATM is now under their control and the malware runs in an infinite loop waiting for a command. To make the scam harder to spot, the Tyupkin malware only accepts commands at specific times on Sunday and Monday nights. During those hours, the attackers are able to steal money from the infected machine.

Comments

This doesn't add up

[drsquare]

If you have access to the ATM physically, why not just take the cash there and then?

Re:This doesn't add up

[BitterOak]

If you have access to the ATM physically, why not just take the cash there and then?

Because there would only be a finite amount of cash in the machine. By installing this software, you can steal a little bit at a time, and the cash would be reloaded periodically.

Re:This doesn't add up

[Anonymous Coward]

It's also easier to tie cash loss to an event where a bad actor had special physical access. I'd be willing to bet the cash box itself has monitors/procedors/audit trails to prevent theft/tampering from people who normally service it.

The trojan bypasses all that, hiding cash loss in an event that does not require special physical access (Normal walk-up transactions carried out by customers) The trojan also cleans up all the auditing logs so you less sure about when the loss occurred.

If, say, the bad actor is a crooked service man the gang of crooks can bribe him to slip their CD in and install the trojan. That way the cash gets taken when he's nowhere near the machine, and he has nothing to do with taking the cash all together. Or if, say, you're picking locks and breaking in to the machine to slip in your CD there's nothing suspicious (like an empty cash box) to point to the time where you could have broken in to the machine. You put the risk of the actual cash theft (Taking money from trojan compromised machines) on low rent thugs and suckers in your gang.

Re:This doesn't add up

[nojayuk]

Going back repeatedly isn't going to work -- the bank or financial company maintaining the ATMs does actually count the money going into the machines and the amounts legally withdrawn and if they don't balance then investigations are carried out. Put in 10000 quatloos, 7000 quatloos withdrawn by customers over a few days, 1000 quatloos left when the next refill is carried out = something fishy. Cookie jar accountancy rules apply, eventually Mom will notice the distinct lack of cookies and eventually catch you cookie-crumb-handed.

Re:This doesn't add up

[jtownatpunk.net]

You can have a locked box inside a locked box. Just because they can easily get into the outer layer doesn't mean they can easily get into the inner layer.

Re:This doesn't add up

[PRMan]

You can actually punch a hole in many popular ATMs and there is a live USB port right behind it. This has been discussed repeatedly as a security problem. I don't know if they fixed that one, but there could be more or it could be really slow to be fixed. http://www.extremetech.com/ext...

Re:This doesn't add up

[sg_oneill]

If you have access to the ATM physically, why not just take the cash there and then?

Not as easy as you think. A guy who used to live in the apartments across from me was a retired burglar. Found god in prison, went straight, yada yada. One of his old tricks was burglaring ATM machines. Apparently his trick was he'd tie a chain to the ATM and the other side to stolen truck and take off down the road with the ATM in tow. He'd then get out with a few men and lift the ATM into the truck and make a run for it.

It would take them about 4-5 days to extract the money. Apparently the cash reserves are booby-trapped so that tampering with the mechanism would destroy the cash. As a result removing the money was a complicated procedure involving slow dismantling and a lot of welding.

After his third attempt at it, they got a newer one, that was battery backed and had some sort of radio thing in it. Cops tracked it and they where done.

Re:This doesn't add up

[tlhIngan]

If you have access to the ATM physically, why not just take the cash there and then?

Because it's easier to get to the electronics than the cashbox.

Inside these little ATMs is a steel box. Get that steel box open and you have full access to the electronics. But to get to the cash requires opening said box, then opening the safe holding the cash, which is vastly more protected.

The cash is dispensed from within the safe and exits out a slot in the safe (basically the safe carries a number of cash cassettes and the electronics count out the cash, which is why if they mis-load the cassettes, you can be short changed or given more than you expect.

Oh yeah, and the safe has all sorts of safeguards to destroy the cassettes should they be tampered with, making it even harder to get the cash out.

Of course, they assumed the electronics were secure, so the other way to get the cash out is via the front door. Bypasses all the safe security systems and everythign else.

Re:This doesn't add up

[davester666]

yeah. those are called "atm fee's". Oh wait, we're talking about different criminals.

Re:This doesn't add up

[LordWabbit2]

They rotate all servicing of the machines, George the serviceman does not have a fixed route, it would be too easy to set up an ambush if the routines were fixed. They do log everything of course, but there is nothing stopping George from going to the ATM six months later to withdraw some money when he will never be suspected. This kind of hack requires a lot of collaboration between parties.
a) The programmer(s) working for the bank
b) The people servicing the ATM's
Unless of course the ATM's in question are one of those generic cash machines instead of custom made bank ATM's

Re:This doesn't add up

[jeauxkewl]

In most ATMs it is stored in sealed, tamper-proof trays which have a security mechanism that the ATM allows to dispense. When the ATMs are stocked, the courier company simply exchanges cassettes. There are no wrapped stacks of cash visible. So essentially what happens is, the ATM is initially loaded with x amount of cash. When the level drops below a certain level, the courier is dispatched to refill the ATM. They go exchange the cassettes and the pulled cassettes are taken to a secure location where the remaining cash is counted and the totals reconciled with what the ATM says it dispensed. If the totals don't match, they WILL find out why via surveillance tapes and security seals. The secure part of the ATM where the cash is built inside a safe which is alarmed and actively monitored. That is why you see reports of ATM theft. You're less likely to get caught if you steal the entire ATM and take it to a location where you have time and privacy to force entry. Historical fact - before the ATMs moved to Windows XP, nearly all of them ran on OS/2, as recently as 2004.

These on XP?

[cyberjock1980]

I remember back when XP was officially discontinued there was some article that said something like 70% of ATM machines worldwide still ran XP. Anyone able to confirm if this is the case? If so, are they exploiting some vulnerability in XP that is never-to-be-patched?

Re:These on XP?

[mythosaz]

Many, yes.

Some kiosk versions of XP are still getting patched.

Windows XP Professional for Embedded Systems. This product is identical to Windows XP, and Extended Support will end on April 8, 2014.
Windows XP Embedded Service Pack 3 (SP3). This is the original toolkit and componentized version of Windows XP. It was originally released in 2002, and Extended Support will end on Jan. 12, 2016.
Windows Embedded for Point of Service SP3. This product is for use in Point of Sale devices. It’s built from Windows XP Embedded. It was originally released in 2005, and Extended Support will end on April 12, 2016.
Windows Embedded Standard 2009. This product is an updated release of the toolkit and componentized version of Windows XP. It was originally released in 2008; and Extended Support will end on Jan. 8, 2019.
Windows Embedded POSReady 2009. This product for point-of-sale devices reflects the updates available in Windows Embedded Standard 2009. It was originally released in 2009, and extended support will end on April 9, 2019.

Re:These on XP?

[Obfuscant]

If so, are they exploiting some vulnerability in XP that is never-to-be-patched?

They are exploiting a vulnerability that is found in almost every operating system, and which has yet to be patched by any vendor. It's called "running a program". As the summary says:

First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware.

Re:These on XP?

[MoonlessNights]

That isn't an operating system flaw but a hardware flaw: loads data from device into memory and points the CPU at it.

What is actually surprising is that they don't use some kind of DRM-esque bootloader (much like you find in many phones) where it only boots an image with a matching signature.

Re:These on XP?

[tqk]

True. There's also, "Physical access means no security."

Re:They must a film out of this...

[mythosaz]

These ATMs are probably the kind you find in smaller stores - about the size of a internet kiosk at a hotel - they're not made to be all-weather unsupervised secure, just "secure inside a store with an employee around."

So many ways this could've been prevented?

[Anonymous Coward]

Why does an ATM have a cd drive, let alone usb ports or anything else? Why does it boot off of media without altering the BIOS and requiring a password? Why isn't the OS encrypted making modification require more difficult techniques like bootkits which has other protection mechanisms?

Re:So many ways this could've been prevented?

[mythosaz]

Cost, ease of deployment, maintenance and updates.

Can we stop using Cyber

[Spy Handler]

these weren't cybercriminals, just criminals. They physically broke open ATM machines.

Re:Can we stop using Cyber

[93 Escort Wagon]

Except the criminals are Cybermen.

Re:"Without attracting attention"

[PRMan]

Speed. In the old days, telephone lines were EXTREMELY slow and they wanted to limit that to just the actual transaction details. Also, they would only call a modem when that transaction actually happened.

But you're right, for modern operations, they should just be dumb terminals.

Re:"Without attracting attention"

[mythosaz]

The bank is disconnected from the ATM during this process. Money isn't being removed from an account. Bills are being removed from a mechanical hopper, because the software on the kiosk has a service mode, accessible outside of normal service because the real software on the ATM has been replaced by a modified version that allows it without the normal controls.

This is small potatoes.

[fahrbot-bot]

If you want to steal BIG, you have to own the bank - just ask those guys on Wall Street.

The stupidity of an overspec device

[dbIII]

So a dumb terminal has an entire copy of MS Windows instead of WinCE or a cast of thousands of non-MS options, and due to that it has a huge attack surface despite only doing a very limited job. An ATM should be simple and locked down since all it's doing is being an input device to a server and getting instructions from the server to spit out cash. It's obvious. Sleazy deals where one bit of MS cuts into the market of a different bit of MS are the only reason why such stupidity happens and you get a desktop computer doing the job of an embedded device.