Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ATM in China.

http://krebsonsecurity.com/2014/05/thieves-planted-malware-to-hack-atms/

We actively discuss this topic in Russia.

http://www.plusworld.ru/daily/ustroystvo-dlya-zarajeniya-bankomatov-vredonosnim-kodom-obnarujeno-v-kitae/

Stanislav Shevchenko, CTO of SafenSoft, company that develops information security solutions for ATMs, says the following. In order to infect the ATM software, you need to have an access to computer. This device cannot allow it. Interacting with card reader doesn’t let the criminal intrude the computer itself and the report doesn’t mention opening up any parts of ATM. Device itself looks strange compared to its function as it was described. No other incidents with usage of it are reported so far. All this makes us think that this information should be approached with caution because it’s either missing key parts of isn’t credible at all. The NCR expert says that their company doesn’t know about this way of infection. So the possibility of the attack is very low. Igor Korolev, Wincor Nixdorf expert, has another opinion. He would doubt this if the information was about ATMs in Russia, but this attack could be real in China. The main task was to transfer files from the card to HDD at the ATM. This task was divided into two subtasks: 1) where to take files from and 2) how to transfer them. For example, to а) write files to USB drive and b) use non-disabled autorun service to copy files to HDD. In the Chinese case they decided to write the files to the card but memory needed to be expanded using the laptop because the card didn’t have enough space for Trojan. Next, the question is how to transfer files to the system unit. There are a lot of ways to do it, but the easiest way is to secretly make a backdoor in ATM software. It’s less likely that they exploited vulnerabilities in card reader driver or firmware, but it is definitely possible.

What do you think about it? Is it possible?

share|improve this question
    
Looks decent enough. The board is likely to be long enough to fit in the reader and then be able to connect to exposed points on a board inside the reader or similar. Likely to work with specific readers only, but an OK hack nevertheless. –  Dmitry Yanushkevich Jul 2 at 14:25

1 Answer 1

I don't see why it wouldn't be possible.

Related, and demonstrated on various security events:

Jon and Nils of MWR played with mobile point of service (mPoS) terminals (https://www.mwrinfosecurity.com/media/press-releases/mobile-point-of-sale-devices-could-leave-millions-worldwide-open-to-attack/), and they could exploit a terminal by just a custom bank card which had the exploit.

Example exploits were:

  • install firmware that logs credit card numbers
  • extract those logged credit card numbers
  • play snake on a PoS terminal :)
share|improve this answer
    
Note that mPoS != ATM. I don't think you read the question well enough. You can't use those devices mentioned in the question on mPoS without appearing ridiculously suspicious. You also don't explain how the ATM would be attacked by a device like that, which is the gist of the question. Posting a link to videos of now late Barnaby Jack hacking ATMs during Black Hat USA 2010 would be closer to what's being asked. –  TildalWave Jul 2 at 15:19
    
I know mPoS != ATM. I wrote this as an example of something similar being successfully done. The exploit delivery system was a bank card, which is also an entry point into ATM. The question was "is it possible?", my answer is "why not" + some of my reasoning why. –  domen Jul 2 at 15:33
    
Thanks a lot for your answer but what you brought up refers to POS terminals and we are talking about ATMs. The card reader in the ATM is a separate, connectable device and it will be hard to transfer and start Trojan from it. But the question isn’t in possibility of device infection, we know it really exists. The question is how can ATM be infected without access to CD-ROM or USB? –  Safensoft Jul 10 at 11:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.