Attack The Machines: The lucrative business of ATM malware

Information Technology Press Releases Thursday November 23, 2017 14:56
Bangkok--23 Nov--Mind PR
by: Ed Cabrera, Chief Cybersecurity Officer, Trend Micro

Trend Micro and Europol's European Cybercrime Centre (EC3) today released a publicly available report on the ATM malware landscape. This builds on the 2016 report that was privately released to financial institutions and law enforcement agencies globally. The report digs into the depth and breadth of malware targeting ATMs, as well as the perpetrators behind the attacks.

Growth and Innovation of ATMs

Globally we've seen a steady growth of ATMs that is predicted to increase to 4 million by 2021, however in the United States we've seen only nominal growth probably due to several things including EMV migration. Well that trend appears to be shifting.

According to new analysis by the ATM Industry Association (ATMIA), we've reached a new milestone – there are now between 475,000 and 500,000 ATMs operating in the U.S.

ATM innovation around new capabilities and services is growing, as well. This will have a direct impact on brick-and-mortar banks. The result will be fewer and smaller branches using more and more capable ATMs. The machines already offer person-to-person (P2P) money transfer capabilities that provide advantages including increased availability of cash, lower transaction costs, accessibility across currencies, and buying and selling crypto-currencies. According to Coin ATM Radar, there are nearly 1,600 Bitcoin ATMs globally.

In the future we'll see cardless cash transactions enabled by Near Field Communication (NFC), Bluetooth and iBeacon-enabled mobile phones. Additionally, we'll have application-based services that are more personal and customizable. However, greater connectivity and app driven services also introduces greater risk. It is critical that similar innovation occurs around the physical and network security of ATMs to keep ahead of the risk evolution.

Physical vs Network

Physical and network-based malware attacks on ATMs are on the rise. In the physical attack section of the report, our researchers break down the common denominator of many ATM malware – the XFS (extensions for financial services) middleware. Middleware providers use the XFS standard to create client-server architecture for financial applications on Microsoft Windows platforms. Financial applications through the XFS manager using XFS APIs communicate with peripherals such as PIN pads, cash dispensers, and receipt printers. This middleware is the connective tissue within many ATMs regardless of make, model or vendor. Exploiting the universality of XFS to "jackpot" ATMs equates to a huge ROI for malware developers as they can conduct one to many campaigns.

In the network-based attack section our researchers analyze recent noteworthy attacks. In July 2016, Eastern European cybercriminals used malware to withdraw 2.5 million in cash from 41 ATMS in three cities in Taiwan. Others are also described in the report such as Cobalt Strike, Anunak/Carbanak, Ripper and ATMitch. All these attacks and campaigns highlight the systemic vulnerability of insecure corporate networks that ultimately serve as the gateways to exploiting global ATM infrastructure.

Securing ATMs
Mitigating the risks posed by ATMs to banks and consumers is a significant task. Here are a few tips to help security administrators in financial organizations get started.
•Keep your operating system, software stack and security configuration up to date
•Apply timely patches to corporate network infrastructure and ATMs
•Use whitelisting technology to protect your environment because most machines are "fixed function devices"
•Introduce intrusion prevention and Breach detection mechanisms to identify malicious system behavior to protect ATMs during operation
•Ensure real-time monitoring of security relevant hardware and software events
•Deploy and actively use anti-malware solutions on technician's notebooks and USB devices
•Train service technicians to handle USB removable media devices with due care

For financial institutions and law enforcement agencies interested in detecting ATM malware and protecting against it, we once again have a private version of the paper. To request a copy, please email

Latest Press Release

SiS joined forces with Interlink Telecom introducing cloud service business, aiming to become a leading cloud service provider within three years

Capitalizing on its strength in customization that allows organizations to fine-tune their own cloud systems and its unique business model that offers solutions and services through over 2,000 business partners, targeting enterprise markets SiS...

Master of Eternity สงครามข้ามจักรวาล อัพเดท Frame Arms Girl แล้วจ้า

ตัวละครจาก Frame Arms Girl บุก Master of Eternity แล้ววันนี้ เปิดศึกลุยเลย ทั้งบน iOS และ Android แฟนๆ Frame Arms Girl เฮลั่น Master of Eternity อัพเดท FA Girl แล้วจ้า เกมหุ่นยนต์วางแผนการรบ SRPG จาก Nexon Korea บริษัทในเครือ NEXON Co., Ltd. ("Nexon")...

Uniview Opens Manufacturing Base in China and Branch Office in South Korea

Uniview, the global pioneer and leader of IP video surveillance, is committing to providing high-quality and professional services to global customers. Uniview has a nearly 100% growth rate in overseas markets, covers over 145 regions and countries, and...

BLR Airport Launches Self-Bag-Drop

Just 45 seconds! This will be the time taken to complete your baggage check-in at the Kempegowda International Airport, Bengaluru. The Bangalore International Airport Limited - operator of the BLR Airport - has, once more, raised the bar for passenger...

Element AI Announces Strategic Partnerships with GIC, SGInnovate, and Singapore Management University

- Element AI expands its successful collaborative approach and existing ties to Singapore with new agreements to develop cutting edge products in the financial sector, enhance local talent, scale commercial Artificial Intelligence solutions, and embark...

Related Topics