Sticking It To The ATM

Ever since Barnaby Jack leapt on stage at Black Hat USA and had ATMs spew money as if it were going out of style, hackers around the globe have been busy trying to replicate the research before banks and ATM vendors get the vulnerabilities fixed. You’d have thought that after three-and-a-half years both vendors and banks would have fixed the bugs and dealt with the physical attack vectors long ago. Unfortunately, that doesn’t seem to be the case.

A pair of security researchers speaking in Hamburg at last week’s Chaos Communication Congress provided new insight and demonstrated some USB-based malware that had been crafted by criminals and used earlier in the year to siphon money from several unpatched ATMs. The original malware authors had taken steps to remove many of the installation traces that forensic investigators would have found useful, so the researchers had to piece together many parts of a complex puzzle.

While it hasn’t been disclosed which type of ATM were targeted (or which bank was affected), it seems that the criminals had uncovered physical flaws in the bank’s ATM devices that allowed them to cut access holes through which they could slip in their infector USB device. Once the USB device was in place, the ATMs could be rebooted and the malware automatically installed.

via Sticking It To The ATM — Dark Reading.

———————————————-

Journal of Law & Cyber Warfare | www.jlcw.org The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners.  The Journal of Law & Cyber Warfare provides a public peer-reviewed law publication to foster open discussion and education of technology, government and legal stakeholder in relation to the complex issue of cyber warfare.  Journal of Law & Cyber Warfare accepts articles written by military, technology, judges, government officials, academic and legal practitioners. The Journal of Law & Cyber Warfare is honored by the world class caliber editorial board that is involved with the Journal. Thought leaders from forensics, law, warfare, and cyber security are on the Board. The Journal is always looking for interested thought leaders who believe they can contribute in a meaningful fashion to the development of cyber warfare scholarship.