Malware is Turning ATMs into Skimmers

Remember the old ATM skimmers that can be identified by looking closely at an ATM? Now, making a comeback is a technology that makes the entire ATM a card skimmer. This family of malware was extensively distributed between 2010 and 2013 and caused a drastic increase in ATM attacks. Nine different malware families were identified by Kaspersky Lab and included the Tyupkin family found in 2014. That one became the most widespread at the time. However, it seemed to take a break until now.

There are 49 identified modifications of the malware with 37 of them specifically targeting one major manufacturer of ATMs. It is so stealthy, that it is nearly undetectable because there is nothing physical attached to the machine. Instead, malware makes the internal workings of the ATM do all the dirty work. It not only can steal data off the users’ cards, but it can also allow a thief to dispense all the cash out of the ATM.

There are some ways to proactively determine if it is in your organization’s network. Kaspersky Lab recommends performing regular anti-virus scans on the network for one. Also, use whitelisting technologies, use full disk encryption, implement a good device management policy, protect the ATM BIOS with a strong password, and allow only HDD booting. In addition, isolate the ATM network from the other internal systems. When creating a device management policy, it should include a requirement for all systems that attach to the network to have anti-malware software installed and kept updated. It should also include a plan for patching and updating systems on a regular and emergency schedule. When critical and security patches are released, install them right away, rather than waiting for a regularly scheduled time.

The attack begins when a file called Backdoor.Win32.Skimmer is installed and executes malware that hides in the ATM code. With special cards and commands, the hacker can open a menu and perform various functions. Kaspersky explained “The Skimmer’s graphic interface appears on the display only after the card is ejected and if the criminal inserts the right session key from the pin pad into a special form in less than 60 seconds.”

Subsequently, using the menu the criminal(s) can activate 21 different commands, including dispensing money, self-deleting, performing updates, and collecting details of cards that are inserted into the ATM. With this last action, Skimmer can save the file with dumps and PINs. It can also print the card details onto the ATM’s receipts.

Financial institutions where “Skimmer” was found are dispersed all across the globe. They include the U.S., United Arab Emirates, France, China, Germany, Spain, Russia, Poland, Brazil, and several other countries.