Infected ATMs Give Away Millions of Dollars Without Credit Cards

An anonymous reader writes: Kaspersky Lab performed a forensic investigation into cybercriminal attacks targeting multiple ATMs around the world. During the course of this investigation, researchers discovered the Tyupkin malware used to infect ATMs and allow attackers to remove money via direct manipulation, stealing millions of dollars. The criminals work in two stages. First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware. After they reboot the system, the infected ATM is now under their control and the malware runs in an infinite loop waiting for a command. To make the scam harder to spot, the Tyupkin malware only accepts commands at specific times on Sunday and Monday nights. During those hours, the attackers are able to steal money from the infected machine.

Comments

This doesn't add up

[drsquare]

If you have access to the ATM physically, why not just take the cash there and then?

Re:This doesn't add up

[BitterOak]

If you have access to the ATM physically, why not just take the cash there and then?

Because there would only be a finite amount of cash in the machine. By installing this software, you can steal a little bit at a time, and the cash would be reloaded periodically.

Re:This doesn't add up

[Anonymous Coward]

It's also easier to tie cash loss to an event where a bad actor had special physical access. I'd be willing to bet the cash box itself has monitors/procedors/audit trails to prevent theft/tampering from people who normally service it.

The trojan bypasses all that, hiding cash loss in an event that does not require special physical access (Normal walk-up transactions carried out by customers) The trojan also cleans up all the auditing logs so you less sure about when the loss occurred.

If, say, the bad actor is a crooked service man the gang of crooks can bribe him to slip their CD in and install the trojan. That way the cash gets taken when he's nowhere near the machine, and he has nothing to do with taking the cash all together. Or if, say, you're picking locks and breaking in to the machine to slip in your CD there's nothing suspicious (like an empty cash box) to point to the time where you could have broken in to the machine. You put the risk of the actual cash theft (Taking money from trojan compromised machines) on low rent thugs and suckers in your gang.

Re:This doesn't add up

[nojayuk]

Going back repeatedly isn't going to work -- the bank or financial company maintaining the ATMs does actually count the money going into the machines and the amounts legally withdrawn and if they don't balance then investigations are carried out. Put in 10000 quatloos, 7000 quatloos withdrawn by customers over a few days, 1000 quatloos left when the next refill is carried out = something fishy. Cookie jar accountancy rules apply, eventually Mom will notice the distinct lack of cookies and eventually catch you cookie-crumb-handed.

Re:This doesn't add up

[PRMan]

You can actually punch a hole in many popular ATMs and there is a live USB port right behind it. This has been discussed repeatedly as a security problem. I don't know if they fixed that one, but there could be more or it could be really slow to be fixed. http://www.extremetech.com/ext...

Re:This doesn't add up

[sg_oneill]

If you have access to the ATM physically, why not just take the cash there and then?

Not as easy as you think. A guy who used to live in the apartments across from me was a retired burglar. Found god in prison, went straight, yada yada. One of his old tricks was burglaring ATM machines. Apparently his trick was he'd tie a chain to the ATM and the other side to stolen truck and take off down the road with the ATM in tow. He'd then get out with a few men and lift the ATM into the truck and make a run for it.

It would take them about 4-5 days to extract the money. Apparently the cash reserves are booby-trapped so that tampering with the mechanism would destroy the cash. As a result removing the money was a complicated procedure involving slow dismantling and a lot of welding.

After his third attempt at it, they got a newer one, that was battery backed and had some sort of radio thing in it. Cops tracked it and they where done.

Re:This doesn't add up

[tlhIngan]

If you have access to the ATM physically, why not just take the cash there and then?

Because it's easier to get to the electronics than the cashbox.

Inside these little ATMs is a steel box. Get that steel box open and you have full access to the electronics. But to get to the cash requires opening said box, then opening the safe holding the cash, which is vastly more protected.

The cash is dispensed from within the safe and exits out a slot in the safe (basically the safe carries a number of cash cassettes and the electronics count out the cash, which is why if they mis-load the cassettes, you can be short changed or given more than you expect.

Oh yeah, and the safe has all sorts of safeguards to destroy the cassettes should they be tampered with, making it even harder to get the cash out.

Of course, they assumed the electronics were secure, so the other way to get the cash out is via the front door. Bypasses all the safe security systems and everythign else.

Re:This doesn't add up

[davester666]

yeah. those are called "atm fee's". Oh wait, we're talking about different criminals.

Re:These on XP?

[mythosaz]

Many, yes.

Some kiosk versions of XP are still getting patched.

Windows XP Professional for Embedded Systems. This product is identical to Windows XP, and Extended Support will end on April 8, 2014.
Windows XP Embedded Service Pack 3 (SP3). This is the original toolkit and componentized version of Windows XP. It was originally released in 2002, and Extended Support will end on Jan. 12, 2016.
Windows Embedded for Point of Service SP3. This product is for use in Point of Sale devices. It’s built from Windows XP Embedded. It was originally released in 2005, and Extended Support will end on April 12, 2016.
Windows Embedded Standard 2009. This product is an updated release of the toolkit and componentized version of Windows XP. It was originally released in 2008; and Extended Support will end on Jan. 8, 2019.
Windows Embedded POSReady 2009. This product for point-of-sale devices reflects the updates available in Windows Embedded Standard 2009. It was originally released in 2009, and extended support will end on April 9, 2019.

Re:These on XP?

[Obfuscant]

If so, are they exploiting some vulnerability in XP that is never-to-be-patched?

They are exploiting a vulnerability that is found in almost every operating system, and which has yet to be patched by any vendor. It's called "running a program". As the summary says:

First, they gain physical access to the ATMs and insert a bootable CD to install the Tyupkin malware.

Re:"Without attracting attention"

[mythosaz]

The bank is disconnected from the ATM during this process. Money isn't being removed from an account. Bills are being removed from a mechanical hopper, because the software on the kiosk has a service mode, accessible outside of normal service because the real software on the ATM has been replaced by a modified version that allows it without the normal controls.

Re:These on XP?

[MoonlessNights]

That isn't an operating system flaw but a hardware flaw: loads data from device into memory and points the CPU at it.

What is actually surprising is that they don't use some kind of DRM-esque bootloader (much like you find in many phones) where it only boots an image with a matching signature.

This is small potatoes.

[fahrbot-bot]

If you want to steal BIG, you have to own the bank - just ask those guys on Wall Street.