{"id":11323,"date":"2016-02-17T09:00:00","date_gmt":"2016-02-17T14:00:00","guid":{"rendered":"https:\/\/www.kaspersky.com.au\/blog\/?p=11323"},"modified":"2017-09-24T11:21:13","modified_gmt":"2017-09-24T15:21:13","slug":"atm-jackpotting-explained","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com.au\/blog\/atm-jackpotting-explained\/11323\/","title":{"rendered":"7 reasons why it&#8217;s oh so easy for bad guys to hack an ATM"},"content":{"rendered":"<p>Automated teller machines (ATM) have always a been a big target for criminals. In the past hunting for ATMs included some heavy tools like a cutting torch or explosives. However with the dawn of the Digital Age, everything has changed. Nowadays culprits can \u2018jackpot\u2019 an ATM without such special effects.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022941\/atm-jackpotting-FB.jpg\" rel=\"attachment wp-att-11328\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022941\/atm-jackpotting-FB.jpg\" alt=\"7 reasons why it's oh so easy for bad guys to hack an ATM\" width=\"1280\" height=\"1280\" class=\"aligncenter size-full wp-image-11328\"><\/a><\/p>\n<p>At the recent SAS 2016 conference <a href=\"https:\/\/twitter.com\/_endless_quest_\" target=\"_blank\" rel=\"noopener nofollow\">Olga Kochetova<\/a>, a penetration-testing specialist at Kaspersky Lab explained why ATMs are so vulnerable, in her talk entitled \u2018Malware and non-malware ways for ATM jackpotting.\u2019<\/p>\n<p>1. First of all, ATMs are basically computers. They consist of a number of electronic subsystems, including some exotic industrial controllers, but there\u2019s always a conventional PC in the very center of ATM\u2019s system.<br>\n<a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022948\/atm-jackpotting-winxp.jpg\" rel=\"attachment wp-att-11324\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022948\/atm-jackpotting-winxp.jpg\" alt=\"7 reasons why it's oh so easy for bad guys to hack an ATM\" width=\"1280\" height=\"720\" class=\"aligncenter size-full wp-image-11324\"><\/a><\/p>\n<p>2. Moreover, it\u2019s very likely that this PC is controlled by a rather old operating system like Windows XP. You probably know what is wrong with Windows XP: it is not supported by Microsoft anymore, so any vulnerability found after support was killed off is a perpetual zero-day that nobody will ever patch. And you can bet that there\u2019s A LOT of these vulnerabilities.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Microsoft?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Microsoft<\/a> is ending support for Windows XP. Learn what this means for your Kaspersky Lab products. <a href=\"http:\/\/t.co\/j90rhV8wY3\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/j90rhV8wY3<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/425697300200304640?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 21, 2014<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>3. Besides, it\u2019s also very likely, that there\u2019s a lot of vulnerable software running in ATM\u2019s system. From some outdated flash players with over 9000 widely known bugs inside to remote administration tools and more.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022946\/atm-jackpotting-malware.jpg\" rel=\"attachment wp-att-11325\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022946\/atm-jackpotting-malware.jpg\" alt=\"7 reasons why it's oh so easy for bad guys to hack an ATM\" width=\"1280\" height=\"720\" class=\"aligncenter size-full wp-image-11325\"><\/a><\/p>\n<p>4. ATMs manufacturers tend to believe that ATMs are always operating in \u2018normal conditions\u2019 and nothing ever goes wrong. Hence there\u2019s usually no software integrity control, no antivirus solutions, no authentication of an app that sends commands to cash dispenser.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022944\/atm-jackpotting-intcontrol.jpg\" rel=\"attachment wp-att-11326\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/102\/2016\/02\/06022944\/atm-jackpotting-intcontrol.jpg\" alt=\"7 reasons why it's oh so easy for bad guys to hack an ATM\" width=\"1280\" height=\"720\" class=\"aligncenter size-full wp-image-11326\"><\/a><\/p>\n<p>5. In contrast to cash deposit unit and money dispenser, which are always pretty carefully armored and locked, the PC part of an ATM is easily accessible. Its enclosure is usually made of plastic, thin metal at best, and secured with locks too simple to keep criminals at bay. The logic of ATMs manufacturers is as following: if there\u2019s no money in this part of an ATM, why bother to keep it secure?<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">RT <a href=\"https:\/\/twitter.com\/GrzegorzBr?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@GrzegorzBr<\/a>: Dozens of banks lose millions to cybercriminals attacks <a href=\"https:\/\/twitter.com\/hashtag\/theSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#theSAS2016<\/a>: <a href=\"https:\/\/t.co\/9lOgLiRMd6\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/9lOgLiRMd6<\/a> via <a href=\"https:\/\/twitter.com\/kaspersky?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@kaspersky<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/696687815065804801?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 8, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>6. Modules of ATMs are interconnected with standard interfaces, such as COM and USB ports. Sometimes these interfaces are accessible from outside of the cabinet. Even if not, you still need to keep in mind previous issue.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Infected USB drive idled power plant for 3 weeks <a href=\"http:\/\/t.co\/3TwQFxNr\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/3TwQFxNr<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/292173087108124672?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 18, 2013<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>7. By their very nature, ATMs must be connected \u2014 and they always are. Since the Internet is the cheapest way of communicating these days, banks use it to connect ATMs to processing centers. And guess what? Yes, you can find ATMs on <a href=\"https:\/\/en.wikipedia.org\/wiki\/shodan_(website)\" target=\"_blank\" rel=\"noopener nofollow\">Shodan<\/a>!<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\"><a href=\"https:\/\/twitter.com\/hashtag\/Shodan?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Shodan<\/a> shows thousands of exposed ATMs potentially vulnerable to a network attack <a href=\"https:\/\/twitter.com\/_Endless_Quest_?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@_endless_quest_<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/TheSAS2016?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#TheSAS2016<\/a> <a href=\"https:\/\/t.co\/9E3SSYwG89\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/9E3SSYwG89<\/a><\/p>\n<p>\u2014 Eugene Kaspersky (@e_kaspersky) <a href=\"https:\/\/twitter.com\/e_kaspersky\/status\/697078900187332608?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 9, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Considering all the above mentioned issues, there are a plenty of opportunities for criminals. For example, they can write a piece of malware, install it on the ATM\u2019s system and cash out. Such trojans specially crafted for ATMs emerge regularly. For example, about a year ago <a href=\"https:\/\/www.kaspersky.com.au\/blog\/tyupkin-atm-malware\/6246\/\" target=\"_blank\" rel=\"noopener\">we discovered one of them called Tyupkin<\/a>.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/QZvdPM_h2o8?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>Another way is to use some additional hardware that can be attached to ATM\u2019s USB port. For their proof-of-concept Olga Kochetova and Alexey Osipov used a cheap and tiny single-board computer <a href=\"https:\/\/en.wikipedia.org\/wiki\/Raspberry_Pi\" target=\"_blank\" rel=\"noopener nofollow\">Raspberry Pi<\/a> equipped with a Wi-Fi adapter and a battery. Watch the video below to see what happens next.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/ksEmXuV324I?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n<p>The attack through the World Wide Web can be even more dangerous. Culprits can establish fake processing centers, or seize a real one. In this case criminals can rob lots of ATMs without even getting physical access to their hardware. That is exactly what <a href=\"https:\/\/www.kaspersky.com.au\/blog\/billion-dollar-apt-carbanak\/7519\/\" target=\"_blank\" rel=\"noopener\">One-Billion-Hackers<\/a> from the Carbanak group managed to achieve: they had obtained control over critical PCs in banks\u2019 networks and after that they were able to send commands to ATMs directly.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Full report on the <a href=\"https:\/\/twitter.com\/hashtag\/Carbanak?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Carbanak<\/a> APT is now live <a href=\"http:\/\/t.co\/KRmjD1GhyL\" target=\"_blank\" rel=\"noopener nofollow\">http:\/\/t.co\/KRmjD1GhyL<\/a> via <a href=\"https:\/\/twitter.com\/Securelist?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">@Securelist<\/a> <a href=\"http:\/\/t.co\/5OMzJE0DgS\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/5OMzJE0DgS<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/567359162536194048?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">February 16, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>All in all, banks and ATMs manufacturers should be more concerned about security of banking machines. They need to reconsider both software and hardware security measures, make a safer network infrastructure and so on. It\u2019s also important for banks and manufacturers to react quicker to threats and to intensively collaborate with law enforcement agencies and security companies.<\/p>\n<p><span class=\"embed-youtube\" style=\"text-align:center; display: block;\"><iframe class=\"youtube-player\" type=\"text\/html\" width=\"640\" height=\"390\" src=\"https:\/\/www.youtube.com\/embed\/ZeSSNgMtYZA?version=3&amp;rel=1&amp;fs=1&amp;showsearch=0&amp;showinfo=1&amp;iv_load_policy=1&amp;wmode=transparent\" frameborder=\"0\" allowfullscreen=\"true\"><\/iframe><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>What\u2019s wrong with ATMs\u2019 security and what should the banks do about it<\/p>\n","protected":false},"author":421,"featured_media":11327,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2646],"tags":[1431,722,963,1432,1435,36,1434,1410,1424,1433,600],"class_list":{"0":"post-11323","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-atms","10":"tag-banks","11":"tag-carbanak","12":"tag-financial-threats","13":"tag-jackpotting","14":"tag-malware-2","15":"tag-raspberry-pi","16":"tag-sas-2016","17":"tag-thesas2016","18":"tag-tyupkin","19":"tag-windows-xp"},"hreflang":[{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/atm-jackpotting-explained\/11323\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/atm-jackpotting-explained\/6777\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/atm-jackpotting-explained\/6706\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/atm-jackpotting-explained\/7757\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/atm-jackpotting-explained\/7512\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/atm-jackpotting-explained\/10890\/"},{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/atm-jackpotting-explained\/11323\/"},{"hreflang":"de","url":"https:\/\/www.kaspersky.de\/blog\/atm-jackpotting-explained\/7027\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/atm-jackpotting-explained\/10436\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/atm-jackpotting-explained\/10890\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/atm-jackpotting-explained\/11323\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com.au\/blog\/tag\/atms\/","name":"ATMs"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11323","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/users\/421"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/comments?post=11323"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11323\/revisions"}],"predecessor-version":[{"id":18099,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/posts\/11323\/revisions\/18099"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media\/11327"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/media?parent=11323"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/categories?post=11323"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com.au\/blog\/wp-json\/wp\/v2\/tags?post=11323"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}