ATM malware spreading around the world

The software could become even more dangerous if engineered to behave like a network worm

Cash machines around the world are hosting malware that can harvest a person's card details for use in fraud, a situation that could worsen as the malware becomes more sophisticated, according to a security researcher.

Analysts at Trustwave's SpiderLabs research group were surprised earlier this year when it obtained the ATM malware sample from a financial institution in Eastern Europe, said Andrew Henwood, vice president of SpiderLabs's Europe, Middle East and Africa operation. Trustwave does forensic investigations for major credit card companies and financial institutions as well as penetration tests.

"It's the first time we have come across malware of this type," Henwood said.

The malware records the magnetic stripe information on the back of a card as well as the PIN (personal identification number). That data can be printed out on the ATM's receipt roll when a special master card is inserted to the ATM that launches a user interface. It can also be recorded on the magnetic stripe of that master control card.

"We were surprised at the level of sophistication," Henwood said. "It does make us generally pretty nervous."

Most ATMs run security software, but financial institutions haven't focused on their security as much as other systems, Henwood said.

"ATMs were kind of an afterthought and were considered to be fairly stable," Henwood said. "I'd say there's not been enough focus in the past on ATM infrastructure."

Those who wrote the malware have detailed knowledge about how ATMs work, Henwood said. The sample they tested ran on ATMs using Microsoft's Windows XP operating system.

The sample did not have networking capabilities, but that may be a natural evolution. That's particularly dangerous since most ATM machines in developed countries are networked. The danger is that the malware could be engineered into a worm that, once on one ATM, spreads through all ATMs on a network, Henwood said.

To install the malware, a person would need access to inside of the ATM or a port in which software could be uploaded. That means insiders could be involved, or cybercriminals have picked a lock on an ATM in order to install the software, Henwood said.

SpiderLabs has received information that similar malware has been found on ATMs now outside of Eastern Europe, Henwood said. Since then, the lab has provided detailed information on the malware to financial institutions and law enforcement, he said.

In March, security vendor Sophos found it had captured three ATM malware samples customized to target machines made by Diebold, around the same time SpiderLabs saw its first sample.

Join the CSO newsletter!

Error: Please check your email address.

Tags securityATMmalware

More about e-SecurityMicrosoftSophos

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Jeremy Kirk

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts