Attack The Machines: The lucrative business of ATM malware

Information Technology Press Releases Thursday November 23, 2017 14:56
Bangkok--23 Nov--Mind PR
by: Ed Cabrera, Chief Cybersecurity Officer, Trend Micro

Trend Micro and Europol's European Cybercrime Centre (EC3) today released a publicly available report on the ATM malware landscape. This builds on the 2016 report that was privately released to financial institutions and law enforcement agencies globally. The report digs into the depth and breadth of malware targeting ATMs, as well as the perpetrators behind the attacks.

Growth and Innovation of ATMs

Globally we've seen a steady growth of ATMs that is predicted to increase to 4 million by 2021, however in the United States we've seen only nominal growth probably due to several things including EMV migration. Well that trend appears to be shifting.

According to new analysis by the ATM Industry Association (ATMIA), we've reached a new milestone – there are now between 475,000 and 500,000 ATMs operating in the U.S.

ATM innovation around new capabilities and services is growing, as well. This will have a direct impact on brick-and-mortar banks. The result will be fewer and smaller branches using more and more capable ATMs. The machines already offer person-to-person (P2P) money transfer capabilities that provide advantages including increased availability of cash, lower transaction costs, accessibility across currencies, and buying and selling crypto-currencies. According to Coin ATM Radar, there are nearly 1,600 Bitcoin ATMs globally.

In the future we'll see cardless cash transactions enabled by Near Field Communication (NFC), Bluetooth and iBeacon-enabled mobile phones. Additionally, we'll have application-based services that are more personal and customizable. However, greater connectivity and app driven services also introduces greater risk. It is critical that similar innovation occurs around the physical and network security of ATMs to keep ahead of the risk evolution.

Physical vs Network

Physical and network-based malware attacks on ATMs are on the rise. In the physical attack section of the report, our researchers break down the common denominator of many ATM malware – the XFS (extensions for financial services) middleware. Middleware providers use the XFS standard to create client-server architecture for financial applications on Microsoft Windows platforms. Financial applications through the XFS manager using XFS APIs communicate with peripherals such as PIN pads, cash dispensers, and receipt printers. This middleware is the connective tissue within many ATMs regardless of make, model or vendor. Exploiting the universality of XFS to "jackpot" ATMs equates to a huge ROI for malware developers as they can conduct one to many campaigns.

In the network-based attack section our researchers analyze recent noteworthy attacks. In July 2016, Eastern European cybercriminals used malware to withdraw 2.5 million in cash from 41 ATMS in three cities in Taiwan. Others are also described in the report such as Cobalt Strike, Anunak/Carbanak, Ripper and ATMitch. All these attacks and campaigns highlight the systemic vulnerability of insecure corporate networks that ultimately serve as the gateways to exploiting global ATM infrastructure.

Securing ATMs
Mitigating the risks posed by ATMs to banks and consumers is a significant task. Here are a few tips to help security administrators in financial organizations get started.
•Keep your operating system, software stack and security configuration up to date
•Apply timely patches to corporate network infrastructure and ATMs
•Use whitelisting technology to protect your environment because most machines are "fixed function devices"
•Introduce intrusion prevention and Breach detection mechanisms to identify malicious system behavior to protect ATMs during operation
•Ensure real-time monitoring of security relevant hardware and software events
•Deploy and actively use anti-malware solutions on technician's notebooks and USB devices
•Train service technicians to handle USB removable media devices with due care

For financial institutions and law enforcement agencies interested in detecting ATM malware and protecting against it, we once again have a private version of the paper. To request a copy, please email

Latest Press Release

Mobvoi and Innovation etc. launches TicWatch Pro in Thai market

Premium smartwatch powered with Wear OS by Google(TM). Layered Display technology extends battery life to 30 days on a single charge. Mobvoi Inc., and Innovation etc. is launching TicWatch Pro, premium smartwatch powered with Wear OS by Google(TM)....

Dahua Technology Opens Regional Supply Centre in Europe

Dahua Technology, a leading solution provider in the global video surveillance industry, celebrated the opening of its European Supply Centre in Zalaegerszeg, Hungary with an official opening ceremony on September 18th. Jason Zheng & Dr. Petra...

ODEM Activates Smart Contracts on the Ethereum Blockchain

ODEM, creator of the world's first On-Demand Education Marketplace, is pleased to announce the successful activation of smart contracts on the Ethereum Blockchain in support of the ODEM Platform. Dr. Adel ElMessiry, ODEM's Chief Technology Mentor,...

Shaky Video is Dead. GoPro HERO7 Black Features Gimbal-Like Video Stabilization In-Camera

- 14,500 THB Flagship GoPro also Features Live Streaming, TimeWarp Video, SuperPhoto, Improved Audio, and Face, Smile and Scene Detection - 'HERO7 Black Million Dollar Challenge' to Reward Customers for Shooting Product Highlight Reel - HERO7 Silver...

Makeblock Builds Creative Kit for Learning Apple#s Swift Programming Language with Neuron

Makeblock, the world leading STEAM education solution provider, announces that its Neuron Explorer Kit is boarding Apple Swift Playgrounds to help students unleash their creativity and thrive in the age of technology. Swift Playgrounds is a revolutionary...

Related Topics