{"id":6777,"date":"2016-02-17T08:58:58","date_gmt":"2016-02-17T13:58:58","guid":{"rendered":"https:\/\/kasperskydaily.com\/uk\/?p=6777"},"modified":"2020-04-10T19:04:55","modified_gmt":"2020-04-10T18:04:55","slug":"atm-jackpotting-explained","status":"publish","type":"post","link":"https:\/\/www.kaspersky.co.uk\/blog\/atm-jackpotting-explained\/6777\/","title":{"rendered":"7 reasons why it&#8217;s &#8216;oh so easy&#8217; for bad guys to hack an ATM"},"content":{"rendered":"<p>Automated teller machines (ATM) have always a been a big target for criminals. In the past, hunting for ATMs included some heavy duty tools like a cutting torch or explosives. However with the dawn of the Digital Age, everything has changed. Today,\u00a0criminals\u00a0can \u2018jackpot\u2019 an ATM\u00a0without the need for special equipment.<\/p>\n<p>At the recent SAS 2016 conference <a href=\"https:\/\/twitter.com\/_endless_quest_\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Olga Kochetova<\/a>, a penetration-testing specialist at Kaspersky Lab explained why ATM\u2019s are so vulnerable, in her talk entitled \u2018Malware and non-malware ways for ATM jackpotting.\u2019<\/p>\n<p>1. First of all, ATM\u2019s are basically computers. They consist of a number of electronic subsystems, including some exotic industrial controllers, but there\u2019s always a conventional PC in the very centre of ATM\u2019s system.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6779\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2016\/02\/05194225\/atm-jackpotting-winxp.jpg\" alt=\"atm-jackpotting-winxp\" width=\"1024\" height=\"576\"><\/p>\n<p>2. Moreover, it\u2019s very likely that this PC is controlled by a rather old operating system like Windows XP. You probably know what is wrong with Windows XP: it is not supported by Microsoft any more, so any vulnerability found after support was killed off is a perpetual zero-day that no-body will ever patch. And you can bet that there\u2019s A LOT of these vulnerabilities.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Microsoft?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Microsoft<\/a> is ending support for Windows XP. Learn what this means for your Kaspersky Lab products. <a href=\"http:\/\/t.co\/j90rhV8wY3\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/j90rhV8wY3<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/425697300200304640?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 21, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>3. Besides, it\u2019s also very likely, that there\u2019s a lot of vulnerable software running in ATM\u2019s system. From some outdated flash players with over 9000 widely known bugs inside to remote administration tools and more.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6780\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2016\/02\/05194224\/atm-jackpotting-malware.jpg\" alt=\"atm-jackpotting-malware\" width=\"1024\" height=\"576\"><\/p>\n<p>4. ATMs manufacturers tend to believe that ATM\u2019s are always operating in \u2018normal conditions\u2019 and nothing ever goes wrong. Hence there\u2019s usually no software integrity control, no antivirus solutions, no authentication of an app that sends commands to cash dispenser.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-large wp-image-6781\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/86\/2016\/02\/05194222\/atm-jackpotting-intcontrol.jpg\" alt=\"atm-jackpotting-intcontrol\" width=\"1024\" height=\"576\"><\/p>\n<p>5. In contrast to cash deposit unit and money dispenser, which are always pretty carefully armoured and locked, the PC part of an ATM is easily accessible. Its enclosure is usually made of plastic, thin metal at best, and secured with locks too simple to keep criminals at bay. The logic of ATM\u2019s manufacturers is as following: if there\u2019s no money in this part of an ATM, why bother to keep it secure?<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">RT <a href=\"https:\/\/twitter.com\/GrzegorzBr?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@GrzegorzBr<\/a>: Dozens of banks lose millions to cybercriminals attacks <a href=\"https:\/\/twitter.com\/hashtag\/theSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#theSAS2016<\/a>: <a href=\"https:\/\/t.co\/9lOgLiRMd6\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/9lOgLiRMd6<\/a> via <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@kaspersky<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/696687815065804801?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 8, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>6. Modules of ATM\u2019s are interconnected with standard interfaces, such as COM and USB ports. Sometimes these interfaces are accessible from outside of the cabinet. Even if not, you still need to keep in mind previous issue.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Infected USB drive idled power plant for 3 weeks <a href=\"http:\/\/t.co\/3TwQFxNr\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/3TwQFxNr<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/292173087108124672?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 18, 2013<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>7. By their very nature, ATM\u2019s must be connected \u2014 and they always are. Since the Internet is the cheapest way of communicating these days, banks use it to connect ATM\u2019s to processing centres. And guess what? Yes, you can find ATM\u2019s on <a href=\"https:\/\/en.wikipedia.org\/wiki\/shodan_(website)\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Shodan<\/a>!<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Shodan?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Shodan<\/a> shows thousands of exposed ATMs potentially vulnerable to a network attack <a href=\"https:\/\/twitter.com\/_Endless_Quest_?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@_endless_quest_<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2016<\/a> <a href=\"https:\/\/t.co\/9E3SSYwG89\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/9E3SSYwG89<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/697078900187332608?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 9, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Considering all the above mentioned issues, there are a plenty of opportunities for criminals. For example, they can write a piece of malware, install it on the ATM\u2019s system and cash out. Such trojans specially crafted for ATM\u2019s emerge regularly. For example, about a year ago <a href=\"https:\/\/www.kaspersky.com\/blog\/tyupkin-atm-malware\/6246\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">we discovered one of them called Tyupkin<\/a>.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/QZvdPM_h2o8?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>Another way is to use some additional hardware that can be attached to ATM\u2019s USB port. For their proof-of-concept Olga Kochetova and Alexey Osipov used a cheap and tiny single-board computer <a href=\"https:\/\/en.wikipedia.org\/wiki\/Raspberry_Pi\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Raspberry Pi<\/a> equipped with a Wi-Fi adapter and a battery. Watch the video below to see what happens next.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/ksEmXuV324I?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>The attack through the World Wide Web can be even more dangerous. Culprits can establish fake processing centres, or seize a real one. In this case criminals can rob lots of ATM\u2019s without even getting physical access to their hardware. That is exactly what <a href=\"https:\/\/www.kaspersky.com\/blog\/billion-dollar-apt-carbanak\/7519\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">One-Billion-Hackers<\/a> from the Carbanak group managed to achieve: they had obtained control over critical PCs in banks\u2019 networks and after that they were able to send commands to ATM\u2019s directly.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Full report on the <a href=\"https:\/\/twitter.com\/hashtag\/Carbanak?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Carbanak<\/a> APT is now live <a href=\"http:\/\/t.co\/KRmjD1GhyL\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/KRmjD1GhyL<\/a> via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a> <a href=\"http:\/\/t.co\/5OMzJE0DgS\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/5OMzJE0DgS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/567359162536194048?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>All in all, banks and ATM\u2019s manufacturers should be more concerned about security of banking machines. They need to reconsider both software and hardware security measures, make a safer network infrastructure and so on. It\u2019s also important for banks and manufacturers to react quicker to threats and to intensively collaborate with law enforcement agencies and security companies.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/ZeSSNgMtYZA?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What\u2019s wrong with ATMs\u2019 security and what should the banks do about it<\/p>\n","protected":false},"author":421,"featured_media":6778,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[2026],"tags":[1305,697,1138,1306,1309,36,1308,1285,1299,1307,579],"class_list":{"0":"post-6777","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-threats","8":"tag-atms","9":"tag-banks","10":"tag-carbanak","11":"tag-financial-threats","12":"tag-jackpot-ting","13":"tag-malware-2","14":"tag-raspberry-pi","15":"tag-sas-2016","16":"tag-thesas2016","17":"tag-tyupkin","18":"tag-windows-xp"},"hreflang":[{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/atm-jackpotting-explained\/6777\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/atm-jackpotting-explained\/6706\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/atm-jackpotting-explained\/7757\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/atm-jackpotting-explained\/7512\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/atm-jackpotting-explained\/10890\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/atm-jackpotting-explained\/11323\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/atm-jackpotting-explained\/7027\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/atm-jackpotting-explained\/10436\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/atm-jackpotting-explained\/10890\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/atm-jackpotting-explained\/11323\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/atm-jackpotting-explained\/11323\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.co.uk\/blog\/tag\/atms\/","name":"ATMs"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6777","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/users\/421"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/comments?post=6777"}],"version-history":[{"count":5,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6777\/revisions"}],"predecessor-version":[{"id":19676,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/posts\/6777\/revisions\/19676"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media\/6778"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/media?parent=6777"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/categories?post=6777"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.co.uk\/blog\/wp-json\/wp\/v2\/tags?post=6777"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}