Hackers inserted a specialized device which was connected to the notebook into the card reader slot on the ATM and installed malicious software. 100 thousand US dollars were stolen from at least seven ATM in China.

We actively discuss this topic in Russia. http://www.plusworld.ru/daily/ustroystvo-dlya-zarajeniya-bankomatov-vredonosnim-kodom-obnarujeno-v-kitae/

Stanislav Shevchenko, CTO of SafenSoft, company that develops information security solutions for ATMs, says the following. In order to infect the ATM software, you need to have an access to computer. This device cannot allow it. Interacting with card reader doesn’t let the criminal intrude the computer itself and the report doesn’t mention opening up any parts of ATM.

Device itself looks strange compared to its function as it was described. No other incidents with usage of it are reported so far. All this makes us think that this information should be approached with caution because it’s either missing key parts of isn’t credible at all.

The NCR expert says that their company doesn’t know about this way of infection. So the possibility of the attack is very low.

Igor Korolev, Wincor Nixdorf expert, has another opinion. He would doubt this if the information was about ATMs in Russia, but this attack could be real in China. The main task was to transfer files from the card to HDD at the ATM. This task was divided into two subtasks:

  1. Where to take files from, and;
  2. How to transfer them. For example:
    • Write files to USB drive, and;
    • Use non-disabled autorun service to copy files to HDD.

In the Chinese case they decided to write the files to the card but memory needed to be expanded using the laptop because the card didn’t have enough space for Trojan.

Next, the question is how to transfer files to the system unit. There are a lot of ways to do it, but the easiest way is to secretly make a backdoor in ATM software. It’s less likely that they exploited vulnerabilities in card reader driver or firmware, but it is definitely possible.

What do you think about it? Is it possible?

  • Looks decent enough. The board is likely to be long enough to fit in the reader and then be able to connect to exposed points on a board inside the reader or similar. Likely to work with specific readers only, but an OK hack nevertheless. Jul 2, 2014 at 14:25

1 Answer 1


I don't see why it wouldn't be possible.

Related, and demonstrated on various security events:

Jon and Nils of MWR played with mobile point of service (mPoS) terminals (https://www.mwrinfosecurity.com/media/press-releases/mobile-point-of-sale-devices-could-leave-millions-worldwide-open-to-attack/), and they could exploit a terminal by just a custom bank card which had the exploit.

Example exploits were:

  • install firmware that logs credit card numbers
  • extract those logged credit card numbers
  • play snake on a PoS terminal :)
  • Note that mPoS != ATM. I don't think you read the question well enough. You can't use those devices mentioned in the question on mPoS without appearing ridiculously suspicious. You also don't explain how the ATM would be attacked by a device like that, which is the gist of the question. Posting a link to videos of now late Barnaby Jack hacking ATMs during Black Hat USA 2010 would be closer to what's being asked.
    – TildalWave
    Jul 2, 2014 at 15:19
  • 2
    I know mPoS != ATM. I wrote this as an example of something similar being successfully done. The exploit delivery system was a bank card, which is also an entry point into ATM. The question was "is it possible?", my answer is "why not" + some of my reasoning why.
    – domen
    Jul 2, 2014 at 15:33
  • Thanks a lot for your answer but what you brought up refers to POS terminals and we are talking about ATMs. The card reader in the ATM is a separate, connectable device and it will be hard to transfer and start Trojan from it. But the question isn’t in possibility of device infection, we know it really exists. The question is how can ATM be infected without access to CD-ROM or USB?
    – Safensoft
    Jul 10, 2014 at 11:31
  • @Safensoft I doubt there is a great deal of separation between the ATM card reader and the rest of the ATM. The actual card data still needs to be sent to the PC in the ATM, which may open buffer overflows. As for without access to CD-ROM or USB, the serial data line in a chip card seems like a pretty good alternative. Mar 26, 2016 at 22:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .