ATM malware plagues Russia

By Marcia Savage | Jun 5, 2009

1 comments

Facebook

LinkedIn

Digg

Trustwave investigators said malware used in several ATM breaches in Eastern Europe allows attackers to take over the machines and dump cash from them.

Trustwave, a Chicago-based provider of information security and payment card industry compliance services and products, uncovered the malware while investigating ATM breaches in Russia and Ukraine over the past few months. About 20 ATMs were infected with sophisticated malware that allowed attackers to not only steal track data and PINs but cash, said Nicholas Percoco, vice president and head of Trustwave's SpiderLabs security team.

The breaches appear to be inside jobs since an attacker needs physical access to the ATM in order to install and execute the malware, according to Trustwave. Percoco said an attacker could be someone who gets a copy of the keys to the ATM, opens the machine and loads the malware onto the system.

Attackers can then use a card at the infected machine that looks like an ATM card but with track data that triggers the malware, which has a built-in user interface, he said. "You insert this modified ATM card, remove it and up comes an interface screen that asks you what you want to do," Percoco said.

Depending on the number of functions available on the controller card, a criminal could view the number of transactions on the machine or print harvested card data onto the ATM's receipt printer. A multi-function card could allow the attacker to dispense cash from the machine, which could be up to $600,000 on large ATMs, Percoco said. That gives attackers a potentially bigger haul than stealing card track data and PINs, which limits them to the amount of money of money in a person's account, he said.

"With this, they can walk up with a bag and let the machine empty into it," he said.

The compromised ATMs ran Microsoft's Windows XP, but Trustwave can't disclose the ATM software the malware targets, Percoco said. He said researchers believe the malware is related to the malware used in attacks on Diebold ATMs in Russia earlier this year, but said it targets multiple vendors, is much more advanced and continues to evolve and spread. Trustwave collected multiple versions of the malware.

1 comments

Facebook

LinkedIn

Digg