Attack The Machines: The lucrative business of ATM malware

Information Technology Press Releases Thursday November 23, 2017 14:56
Bangkok--23 Nov--Mind PR
by: Ed Cabrera, Chief Cybersecurity Officer, Trend Micro

Trend Micro and Europol's European Cybercrime Centre (EC3) today released a publicly available report on the ATM malware landscape. This builds on the 2016 report that was privately released to financial institutions and law enforcement agencies globally. The report digs into the depth and breadth of malware targeting ATMs, as well as the perpetrators behind the attacks.

Growth and Innovation of ATMs

Globally we've seen a steady growth of ATMs that is predicted to increase to 4 million by 2021, however in the United States we've seen only nominal growth probably due to several things including EMV migration. Well that trend appears to be shifting.

According to new analysis by the ATM Industry Association (ATMIA), we've reached a new milestone – there are now between 475,000 and 500,000 ATMs operating in the U.S.

ATM innovation around new capabilities and services is growing, as well. This will have a direct impact on brick-and-mortar banks. The result will be fewer and smaller branches using more and more capable ATMs. The machines already offer person-to-person (P2P) money transfer capabilities that provide advantages including increased availability of cash, lower transaction costs, accessibility across currencies, and buying and selling crypto-currencies. According to Coin ATM Radar, there are nearly 1,600 Bitcoin ATMs globally.

In the future we'll see cardless cash transactions enabled by Near Field Communication (NFC), Bluetooth and iBeacon-enabled mobile phones. Additionally, we'll have application-based services that are more personal and customizable. However, greater connectivity and app driven services also introduces greater risk. It is critical that similar innovation occurs around the physical and network security of ATMs to keep ahead of the risk evolution.

Physical vs Network

Physical and network-based malware attacks on ATMs are on the rise. In the physical attack section of the report, our researchers break down the common denominator of many ATM malware – the XFS (extensions for financial services) middleware. Middleware providers use the XFS standard to create client-server architecture for financial applications on Microsoft Windows platforms. Financial applications through the XFS manager using XFS APIs communicate with peripherals such as PIN pads, cash dispensers, and receipt printers. This middleware is the connective tissue within many ATMs regardless of make, model or vendor. Exploiting the universality of XFS to "jackpot" ATMs equates to a huge ROI for malware developers as they can conduct one to many campaigns.

In the network-based attack section our researchers analyze recent noteworthy attacks. In July 2016, Eastern European cybercriminals used malware to withdraw 2.5 million in cash from 41 ATMS in three cities in Taiwan. Others are also described in the report such as Cobalt Strike, Anunak/Carbanak, Ripper and ATMitch. All these attacks and campaigns highlight the systemic vulnerability of insecure corporate networks that ultimately serve as the gateways to exploiting global ATM infrastructure.

Securing ATMs
Mitigating the risks posed by ATMs to banks and consumers is a significant task. Here are a few tips to help security administrators in financial organizations get started.
•Keep your operating system, software stack and security configuration up to date
•Apply timely patches to corporate network infrastructure and ATMs
•Use whitelisting technology to protect your environment because most machines are "fixed function devices"
•Introduce intrusion prevention and Breach detection mechanisms to identify malicious system behavior to protect ATMs during operation
•Ensure real-time monitoring of security relevant hardware and software events
•Deploy and actively use anti-malware solutions on technician's notebooks and USB devices
•Train service technicians to handle USB removable media devices with due care

For financial institutions and law enforcement agencies interested in detecting ATM malware and protecting against it, we once again have a private version of the paper. To request a copy, please email

Latest Press Release

GOAL to Broadcast UEFA Champions League LIVE on Twitter in Global First

Goal, the world's largest online football destination, today announced a new collaboration with Twitter to broadcast the UEFA Champions League Round of 16 games live to Twitter users in Thailand, Philippines, Cambodia, and Laos. The four games will be...

AIS maintains Thailand#s Fastest Mobile Network Wins the top award from Ookla Speedtest for the fourth consecutive year

- Ookla, the company behind Speedtest is the global leader in internet performance and network diagnostics, has revealed that in the second half of 2018, AIS successfully maintained the fastest mobile network in Thailand for the fourth consecutive...

Fuji Xerox Affirms Its Leadership in Digital Document Solutions with Digital Intelligence Strategy

Launches 14 New Multifunction Printers under Smart Work Innovation Concept, Empowering Businesses with Innovations beyond Printing Picture (from left): Mr. Hideyuki Moritada, Director, Business Planning & Marketing; Mr. Pichai Thunyawacharakul,...

Artificial intelligence unlocks the true power of analytics

2020. Amanda, director of marketing, is watching two important campaigns unfold. Both are vital to her success— and to her bid for the VP slot. If she can keep revenue growing and inventory where it needs to be, all while launching a new line of...

JOOX Celebrates 3rd Anniversary with Over 3 Billion Streams in 2018, Moves Forward to the Total Entertainment Platform

JOOX music application celebrates its entering the fourth year as a total "entertainment platform", connects people with all music moment for all digital lifestyles. The company also deploys O2O2O strategy (Online to Offline and back to Online...

Related Topics