‘Jackpotting’ Attacks Hit U.S. ATMs

https://krebsonsecurity.com/2018/01/first-jackpotting-attacks-hit-u-s-atms/

by larrymcp • 8 years ago

247 168 8 years ago

rhexs• 8 years ago

Embedded software is easy to hack. Spend quite a bit of money getting access to the binary running a common ATM platform. Reverse engineer it. Find a vulnerability. Trigger it. Done!

The age of (common) embedded system exploitation is finally upon us.

cjensen• 8 years ago

The "hack" in question involves replacing the hard drive.

This isn't an embedded issue. This is a physical access to OS issue.

polishninja• 8 years ago

It doesn't help that almost all the fascia locks on each vendor's machines are a standard key. With that standard key, you have full access to the computer or embedded device drive.

Nowadays the communication link to the dispenser is encrypted, making swapping the hard drive useless. The real problem is the machines aren't replaced very often so there are quite a few old models out in the field that are susceptible to these sort of attacks.

icebraining2• 8 years ago

The "hack" in question involves replacing the hard drive.

Secure Boot should be able to prevent this even with physical access.

sergers• 8 years ago

I am guessing the pulled an unencrypted hard drive from the ATM, analyzed it and the commands. Found the one that spits out cash.

They pop in one with modified code and reboot it to read the new drive.

Only similar ATM I can guess in Canada would already be suspect, in convenience stores, clubs, weed shops, strip clubs lol... The none bank name brand.

Had one bluescreened after taking money from account but before outputting money.

Was running Windows.

Didn't give any money, but kept the money from the account.

Had to call my bank.

herodotus• 8 years ago

The Reuters article is very low on detail. https://krebsonsecurity.com is much more informative.

dang• 8 years ago

OK, we've changed to that from https://www.reuters.com/article/us-cyber-atms-usa/atm-makers....

SyneRyder• 8 years ago

Direct link to the Krebs story:

https://krebsonsecurity.com/2018/01/first-jackpotting-attack...

Nice little punchline at the end too:

"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack."

rapnie• 8 years ago

first? the late Barnaby Jack did it in 2010 :)

https://en.wikipedia.org/wiki/Barnaby_Jack

speedie2• 8 years ago

And it seems to follow his suite. The "jackpot" part. Seeing those bells on the atm gave me a good laugh ..

p1mrx• 8 years ago

Wow, I always thought the ATM scene from Terminator 2 seemed unrealistic, but now people are literally doing that:

https://www.youtube.com/watch?v=3cfQKxUffqA

shaunpud• 8 years ago

How does it work with posting short scenes from a movie on YT, and possibly monetising? Is it just a case of the Studio not reacting or there's a grey area where you're able to do it?

ipince• 8 years ago

The studio (content-owner) is who receives the proceeds of monetization, even if they didn't upload the video themselves.

smnscu• 8 years ago

Perhaps not entirely applicable in this case, but check out this humorous but informative video on fair use https://www.youtube.com/watch?v=H5ZmVheuxpo

ZenoArrow4• 8 years ago

That was possible in the 1990s:

https://www.theregister.co.uk/2005/10/21/phantoms_and_rogues...

I also remember seeing a report that was aired on UK TV by Channel 4 back in the 1990s that showed how easy ATM fraud was. I can't seem to find the clip, but if anyone has better luck than me I'd be interested to see it again. The only other clue I can think of was that I believe the report was presented by Krishnan Guru-Murthy, but I think it might have been on a different show than the Channel 4 News.

lwhi• 8 years ago

I remember the programme .. was on Janet Street Porters 'yoof' entertainment show Network 7, and involved puttjng VHS tape on the back of a debit card.

userbinator• 8 years ago

According to FireEye, the Ploutus attacks seen so far require thieves to somehow gain physical access to an ATM — either by picking its locks, using a stolen master key or otherwise removing or destroying part of the machine.

ATMs need to be more physically secure, like bank safes, if they are to be resistant to such attacks. The software part is mostly immaterial here, IMHO --- it doesn't matter what the software is, if you can get access to the physical money.

amenghra• 8 years ago

There have been several cases of stolen construction equipment (fork lifts, wheel loader, etc.) being used to steal ATMs. For example: https://www.youtube.com/watch?v=K05LT-WpN5I

Achieving 100% physical security is going to be hard.

ZenoArrow4• 8 years ago

In the UK at least it's common for ATMs at banks and supermarkets to be built into the wall. You still have freestanding ones too (including in bank branches), but if the solution to this issue is to get rid of the freestanding ones, it's not likely to be a major inconvenience, especially as many stores offer cash back on request (e.g. buy a pack of gum on card, request £30 cash back, get charged for the gum and the cash, resulting in obtaining £30 cash taken from the till).

eps• 8 years ago

I used to work with various ATMs and the cash dispenser _is_ a hardened safe, with a combination lock and all. If you are to steal an ATM, you will still need to open the safe and the simplest option would indeed be to try and persuade it to just dispense the money.

The thing is that ATMs from larger vendors (IBM, NCR, Bull, Siemens, etc.) have layer upon layers of protection features. For example, you can configure a secondary combination for the safe which will open it and also send an emergency alert. This is for the cases when someone is being forced to open the safe at gunpoint. There are batteries for secondary power supply. There are options for physical lock-down in case of a power loss. Tilt and movement sensors. Redundant communication options, including exotics like x.28 radio.

I mean that all of this was readily available even 20 years ago. ATMs are not designed by amateurs. The issue is that all these are _options_. They need to be bought first and then they also need to be properly configured and enabled, which falls on the banks or their IT service providers to do. The smaller the bank, the less willing they are to spend even more money on configuring secondary stuff and setting up an infrastructure for it, so many of these options will remain off even if they are available.

Tempest1981• 8 years ago

You explain more about the x.28 radio, and its purpose? Communication between where?

ilikeATMs4• 8 years ago

If you ever open up an ATM you'll realise that the majority of things are controlled by serial interfaces (upto 6 of them) for all the motors and pneumatic hardware. If the operating system becomes hardened enough, you'll eventually have people interface with the serial ports directly to manipulate the cash-drawers directly.

I'm not sure why this hasn't really been done in practice but it shouldn't be to difficult to figure out how to do correctly.

In most ATM's the computer hardware and interface connectors are also all housed in the top (mostly plastic or low-quality cast metal) shrouds (as opposed to the currency locked in a safe). Traditionally wafer locks were also used to secure this section however they are slowly migrating to higher security locks like Abloys.

ATM manufacturers may want to take a look at slot machine manufacturers for clues on how to harden machines against tampering.

colejohnson663• 8 years ago

Don’t some ATMs spray ink on the bills if they detect tampering?

jutaz• 8 years ago

They do, if they detect tampering to the currency safe. However I'm not sure if they are really equipped to detect tampering to electronics.

xg154• 8 years ago

Somehow I'm not surprised that hardening is a higher priority for slot machines than for ATMs...

mcny• 8 years ago

I've read (though have no first hand experience) that slot machines have better security and better vetting than electronic voting machines do so I'm not surprised either.

coding1232• 8 years ago

I remember like 20 years ago on the internet there was a lot of cool video/audio tech always being created and it was funny because it didn't really make sense at the time given bandwidth - but everyone joked it was the porn industry pushing all that money/development (fk, even my dad said that once - ok ok I think I turned out ok). It's funny how we get where we get.

ScottBurson• 8 years ago

The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack.

I think this applies, mutatis mutandis: https://xkcd.com/463/

perl4ever3• 8 years ago

At least they aren't running OS/2 Warp.

the-dude• 8 years ago

Actually, OS/2 has been used for ATMs ( I've seen them in the EU, long time ago ).

Simulacra• 8 years ago

It seems the ATM has not evolved very much over the past 20 years. Any ideas why?

netsharc• 8 years ago

Why should it? Its function is to spit out money and it functions well enough for that.

Obviously they do add features, like topping up phone credit or bill paying. But I would guess nowadays the bankers would rather pay smartphone app developers rather than the ATM developers...

chrischen• 8 years ago

By that definition you can say it's doing it's job even better now!

tomalpha2• 8 years ago

If $X million is stolen every year by thieves, but it would cost[0] $2X to upgrade ATMs to prevent it then there might be a rational justification for the status quo. Or at least, one that the person(s) making the decision might use to rationalize it to themselves.

[0]depending whether you do (or even consciously don’t) include indirect costs such as law enforcement and knock-on effects such as funding other areas of crime with the proceeds

oculusthrift• 8 years ago

fiat wallets hacked. this is good for bitcoin.

markbnj• 8 years ago

I people didn't need cash this problem would go away. I think of this occasionally when I visit our local bagel shop, which like many bagel shops in the area does not take cards and has an atm onsite.

aaronblohowiak• 8 years ago

Tax fraud and/or transaction fees.

KozmoNau72• 8 years ago

On the other hand, if you pay by card everywhere, your moments and spending habits will be tracked and catalogued.

A lot of people are not comfortable with that.

grey-area3• 8 years ago

The vast majority carry an internet connected gps tracker with microphone, Wifi, Bluetooth, sms and email all in one place with them at all times, and bank accounts, sms, emails are already accessible to the state on the server side. Shops are using facial recognition and Bluetooth to advertise and track customers. So I honestly think privacy in what you purchase is a ship that has sailed, this data will be recorded in future.

What we should be agitating for is proper control over the use of this info, not trying to limit ways to collect it.

blensor• 8 years ago

I strongly hope that paper money is not completely replaced by electronic payments because it may be convenient as long as it works but I would like to still be able to buy food even when the service stops working.

We had this in Austria a few months ago where one if the biggest providers for electronic payment terminals stopped working for 1 1/2 days

chiph• 8 years ago

I'd rather use cash than have my card info stolen (again).

eikenberry• 8 years ago

I assume this will end with there being fewer ATMs. That they will become more expensive to run in due to costs of hardened physical devices and insurance. If they become too rare it could result in a reduction of cash usage, maybe significantly.

StudentStuff• 8 years ago

Good luck with that, outside of a handful of Nordic oddballs, cash is still king in most of the world (US included). We have a massive unbanked population that isn't going to start using banks or digital payments anytime soon, no matter what politicians or economists may desire.

Symbiote• 8 years ago

If they don't have a bank account, presumably they also don't use ATMs.

rorykoehler• 8 years ago

There is a huge push in SE Asia to get these people banked asap. Startups like Grab are leading the way. I don't think it will be long as much of the other low hanging fruit is already picked. This is literally one of the last untapped markets.

belorn2• 8 years ago

The way that Sweden did it was in small steps, some which other nations has already done.

Encourage companies to only pay employees through banks by making it practically impossible to pay through cash. Expand money laundering laws so that banks are liable if they give out or take in physical cash, with short and hard limits to ATM's. Make it acceptable to have police confiscate money if a person carry more than a few hundred dollars. Just to give examples of those, a person was stopped by a routine police stop when they saw $350 and confiscated it on the concept that such huge amount of money was a sign of money laundering. A few further months ago a elderly couple (70+) had sold their car but could not put the 10 grand into the bank since the sale papers (including government signed transfer) was not enough to prove definitively that the money was still not part of any money laundering. Sweden invalidated all bills and coins made before 2015, forcing everyone to have them exchanged or put it in the bank which was why the elderly couple needed to put the money in the bank.

Add to that a heavy joint campaign between banks and government to paint any physical cash transaction as putting employees at stores at risk and that its a moral responsibility that everyone only use banks, and a strong decline in the availability of bank offices that handles cash.

nicoburns• 8 years ago

The US isn't exactly a leader in banking technology. While I agree that cash is here to stay for the time being, the introduction of contactless payments in the UK has made the conversation around dropping cash seem realistic (with he lower fees almost everywhere now accepts contactless, and unlike chip and pin, transaction times are faster than using cash...)

philipodonnell• 8 years ago

Nah, you'll just see more of the "charge extra and give you cash" checkout options that were in vogue before ATMs where everywhere.

hocuspocus• 8 years ago

Interestingly you start seeing cash back at big chains in some European countries where the concept used to be completely foreign.

With a combination of new online banks that have no physical presence, credit and debit card fees capped by EU laws, and businesses who are happy to pay those fees to get rid of cash, it makes a lot of sense.

pferde• 8 years ago

Several years ago, I've had an ATM crash and reboot after pressing one of the screen side buttons when the machine was waiting for PIN entry via the numeric pad. It rebooted, and I could see that it was running MSDOS, not even Windows. Luckily, after the reboot completed and the ATM frontend program started, it spit out my card again.

With one of offices of my bank being nearby (to be able to block my card if I couldn't get it back), I tried it two more times, just to check that it wasn't a random occurrence.

While it was probably nothing that could further be escalated into gaining access without additional hardware, it gave me a chuckle (and a bit of fear for my card, initially).

dtech• 8 years ago

I'd rather have a ATM running MS-DOS than Windows. At least the attack surface is small. God nows how many ATM's are running Windows 98 and XP, which contain major security holes which will never be patched.

sytelus• 8 years ago

The details:

The attackers typically use an endoscope so they can attach a cord to the computer and install malware. This makes ATM remotely controllable!

In previous Ploutus.D attacks, the ATM continuously dispensed at a rate of 40 bills every 23 seconds. Once the dispense cycle starts, the only way to stop it is to press cancel on the keypad. Otherwise, the machine is completely emptied of cash.

Jackpotting it is.

glaberficken• 8 years ago

"The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack."

I had no idea ATMs ran Windows!

colejohnson663• 8 years ago

To be specific, it’s most likely Windows Embedded.

willtim• 8 years ago

I am regularly surprised by the contrary. Our lifts at work once displayed a popup from the "Desktop cleanup wizard".

caf• 8 years ago

The one I saw the other day was wedged at a Windows 7 Professional "Shutting Down..." screen.

skocznymroczny• 8 years ago

In Poland, few years back, I caught several ATMs rebooting to Windows NT 5.0.

slipstream-• 8 years ago

...win2000 pre-release? or did you mean NT 4?

vultour• 8 years ago

You'd be surprised how many things are running Windows. I always wonder if the manufacturer just hires cheap contractors that haven't seen anything apart from Windows in their entire life, or if there is an actual reason it can't run on linux.

Hendrikto2• 8 years ago

OpenBSD would be perfect for the job, wouldn‘t it?

dboreham• 8 years ago

One reason would be that the vendors require support. Of course there are supported embedded versions of Linux that they could use..

_Understated_• 8 years ago

Could be to do with adding and controlling them from an Active Directory Domain perhaps.

A bank I worked for years ago had ATM domains (in different forests) and had policies applied to the ATM's.

They ran XP at the time.

isostatic3• 8 years ago

It's not unknown to see windows crash screens on atms.

I've never seen one like this though: https://www.betaarchive.com/imageupload/1182228936.or.19648....

kalleboo• 8 years ago

I've seen an ATM stuck on the Windows XP boot screen, and one frozen with a Windows 9x "out of virtual memory" dialog box.

toomanybeersies2• 8 years ago

If you really want a blast from the past, a lot of them (used to?) run OS/2.

0xcde4c3db• 8 years ago

OS/2 derivatives are still being developed and marketed [1] [2].

[1] http://www.ecomstation.com/

[2] https://www.arcanoae.com/arcaos/

heywire• 8 years ago

The same with most point-of-sale machines. I worked for a point-of-sale vendor for a while that had both Windows and Linux versions of our software. All but one retailer chose the Windows version because they felt it was much easier to manage 10,000 Windows machines than 10,000 Linux machines.

BTW, that one retailer that used the Linux version? They replaced it with the Windows version on their next hardware refresh.

ams61104• 8 years ago

OS/2 was another common one, at least up until the current decade. Not sure there are many of those left at this point.

ojosilva• 8 years ago

If you, like me, were wondering what the Secret Service (widely recognized for their duties as presidential bodyguards) has to do with ATM fraud, there's a comment below the article from the author:

I didn’t mention it in the story, but perhaps I should have: The original mission of the Secret Service when it was created in the 1800s was to safeguard the U.S. currency from counterfeiters. Only after a few presidents were assassinated did their mission grow to include protection of the president and other dignitaries. Both are their dual roles today.

https://www.secretservice.gov/about/history/events/

thaumasiotes• 8 years ago

How does that relate to ATM fraud? The ATMs are, presumably, issuing legitimate currency?

JumpCrisscross• 8 years ago

How does that relate to ATM fraud?

“In 1984, the US Congress passed the Comprehensive Crime Control Act, which extended the Secret Service's jurisdiction over credit card fraud and computer fraud.”

https://en.m.wikipedia.org/wiki/United_States_Secret_Service...

bgribble• 8 years ago

The Secret Service is the law enforcement branch of the Treasury Department, like the FBI is the law enforcement branch of the Justice Department and ICE is of the Dept of Homeland Security. The President-protecting stuff is the weird part of their duties, not the other way around :)

_asummers• 8 years ago

If you deposit more than 10k in cash, a bank is obligated to inform the Secret Service's money laundering division per the PATRIOT Act. Secret Service has jurisdiction in a few places you wouldn't expect.

DrJokepu• 8 years ago

FinCEN is part of the Department of the Treasury, not the Secret Service (which has been a part of the Department of Homeland Security since 2003).

DINKDINK• 8 years ago

per the PATRIOT Act

You're mistaken. That's the "Bank Secrecy Act" https://en.wikipedia.org/wiki/Bank_Secrecy_Act

FTL: "Specifically, the act requires financial institutions to keep records of cash purchases of negotiable instruments, and file reports of cash purchases of these negotiable instruments of more than $10,000 (daily aggregate amount), and to report suspicious activity that might signify money laundering, tax evasion, or other criminal activities."

coding1232• 8 years ago

I totally hope this plot line is going in the next "Has Fallen" movie....

celticninja• 8 years ago

I found it interesting that this was not widely known. I am from the UK and was fully aware that this was their other role but it seems many in the US are unfamiliar with this information. I am pretty sure that I have just picked up that information from US film/TV which is why it is surprising to me.

the_watcher• 8 years ago

Really? When reminded, I know that I learned this at some point, but US film/TV is definitely responsible for the perception that the Secret Service is entirely around to protect the President.

exikyut2• 8 years ago

I just read through the comments and was VERY surprised to see noone call this out:

At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash.

Realize what this means. The ATMs are connected directly to the internet, with a VPN (hopefully...) sitting over the top of that. The ATM can still call out to the internet directly!!

That is, honestly, shocklingly insecure. I'm stunned.

I read https://news.ycombinator.com/item?id=16250498 and how ATMs have different options for security, but "allow anything except the VPN software access to the NIC default route" doesn't sound like something _anything_ should be able to disable.

I mean... I know nothing about networking, and I was able to configure this exact behavior on FreeBSD - which I'd never used before - in a day. I set it up so a torrent program was physically incapable of doing DNS/anything outside of the VPN tunnel interface.

Anthony-G• 8 years ago

When I read that part, I figured that the crooks were using their own mobile Internet connection on the laptop or mobile device that they had connected to the ATM.

exikyut2• 8 years ago

....Ah. That is a very real possibility. Thanks for pointing that out.

icebraining2• 8 years ago

That configuration only works if the attacker can't re-configure the system, but considering they're suggesting that many ATMs are still running Windows XP, I'm guessing that finding a privilege escalation exploit is not that hard.

Hendrikto2• 8 years ago

The Secret Service alert says ATMs still running on Windows XP are particularly vulnerable, and it urged ATM operators to update to a version of Windows 7 to defeat this specific type of attack.

I would argue that Windows isn‘t at all the right OS for this.

gkgicccj• 8 years ago

What is? And do you have an OS that you are comfortable calling "secure"? Remember security through obscurity as enjoyed by Mac and Linux doesn't apply here because there is actual money and hence incentive to find vulnerability at stake.

speleding• 8 years ago

It should be much easier to secure a small OS targeted at the job at hand rather than a general purpose OS that supports everything from mouse drivers to webcams which gives it a huge attack surface.

JohnStrangeII• 8 years ago

VMS or Symbolics GENERA. Security by obscurity works.

kuschku• 8 years ago

seL4? Other microkernels optimized for secure use cases?

If you wish, you can put the actual UI in a separate chip, with more modern hardware, handling rendering and input.

But please, do not run the control logic for the ATM on a desktop OS

toomanybeersies2• 8 years ago

I would argue that any embedded OS (e.g. FreeRTOS) would probably be more appropriate.

You don't need a fully featured OS, with the massive attack surface that it provides.

behringer• 8 years ago

Linux employs security by obscurity now?

dannypgh• 8 years ago

I don't think I've heard anyone make that Linux relies on security through obscurity in at least 15 years or so. Linux pretty much won in the server market, and if you consider the volume of e-commerce transactions by the big players on Linux alone... ATMs seem like the small stuff in comparison.

speedie2• 8 years ago

Overeheared a smalltak about something similar in croatia couple days ago . I tought guy was drunk and bs-ing the waitress . Now I hope I bump into him again ;)

_cerv• 8 years ago

One of the first unethical “hacker” things I did was to attempt to change the bill output to larger bill. I got so incredibly nervous when I went into the debug screen that I power walked out of the corner store when the clerk noticed I had been at the machine for several minutes and had not inserted a card.

You find a lot of these ATMs that are even more insecure than the larger WinXP machines. Those little kiosks are perfect for skimmers, manipulation, or just fucking around with.

londons_explore• 8 years ago

Hah - the old "swap the tray configs around" trick...

skc2• 8 years ago

I worked for Diebold on their ATM's for a while.

I was surprised to learn that they run full Windows. In fact, one of the projects I was on had a requirement that we upgrade the OS from XP to Windows 7 for security reasons.

Regardless though, you can make an ATM do whatever you want if you have enough time and access to it. One of our low level debugging tools allowed you to effectively control every aspect of the device, so it could spit out whatever denominations you liked without talking to the banks mainframe.

We used to have fun printing out ATM receipts showing our fake balances of millions of dollars etc.

Someone1234• 8 years ago

A full version of Windows or Windows Embedded ("Windows IoT")?

skc2• 8 years ago

Full version of Windows.

And want to know something else? The UI layer was html + javascript and some funky css that ran on a custom modified version of ie6.

Beneath that, to handle fetching of data, comms, navigation, window management and other business logic etc, we used good old .Net and C#.

It was a bizarre setup from a dev perspective but once you got used to it you could crank out new features incredibly quickly as you had a heavily regimented workflow (Usability trumps _everything_ with these machines).

If you open up an ATM you will find your standard run of the mill beige PC inside it and in fact in many of the older machines they _literally_ stuff an _entire_ PC case in there simply laid on it's side.

There is also an extra monitor back there with a little keyboard attached.

The only impressive aspect of ATM's is the engineering that goes into all of the supporting hardware and peripherals such as the stackers, the cash acceptors, the cheque validators, the printers, the recycling cash canisters, the electronic pin pads, the various fraud detection features etc. I found that stuff much more interesting than the dev work I did day to day.

Massacr3• 8 years ago

I read that the software for the diebold model being targeted is built by Kal. Is this true?

http://www.kal.com/en/video/multi-vendor

This article states that other manufacturers using Kal's software can be targeted as well with some alteration to the code. How possible could that be?

https://arstechnica.com/information-technology/2018/01/in-a-...

oldpond• 8 years ago

I guess diebold makes their atms just like their voting machines. https://www.unhackthevote.com/

amelius• 8 years ago

To carry out a jackpotting attack, thieves first must gain physical access to the cash machine.

Ok, like breaking the machine open, but that's cheating, and hasn't got a lot to do with software security.

‘Jackpotting’ Attacks Hit U.S. ATMs

Related Stories