In April, researchers at security and computer forensics firm Group-IB said they’d discovered new strain of malware designed to target card data stored on or transmitted through point-of-sale devices. While the Group-IB’s report notes ATMs, the company says the malware it had identified had only, so far, been affecting POS systems. The mention of ATMs related more to cultural differences in Eastern Europe. The terms ATM and POS are more often used interchangeably there, Group I-B states.
However, since publishing the report, the company has noted that ATMs could be vulnerable, if the networks that process their transactions are attacked by malware.
But Gary Warner, director of research for computer forensics at the University of Alabama at Birmingham and chief technologist at online security firm Malcovery, says ATM networks are actually very secure. While Trojans aimed at retailer POS systems and networks, such as those that targeted MAPCO Express, Bashas’ Family of Stores and Schnucks Markets Inc. are increasingly common, attacks on ATMs are rare, he says.
Warner contends the real worry for banking institutions is not attacks on ATMs, but the insiders who often facilitate the compromises. «The most vulnerable POS systems are the ones where insiders, or worse yet, customers, have the ability to insert a USB drive to a Windows-based register that has an attached card reader,» he says. «Mall kiosks are perhaps the most likely place to see this type of software, as the kiosks are often left logged-in and unattended.»
Nevertheless, some security consultants say banks and credit unions should view new malware as a serious threat to ATMs.
«It’s the logical evolution of skimming,» says Al Pascual, a financial fraud expert at consultancy Javelin Strategy & Research. «How the malware functions is nothing new, but hackers have leveraged their experience in compromising Windows-based POS systems to now do the same with ATMs.»
Pascual says banking institutions in the U.S. and abroad have reported increases in ATM fraud. «Unfortunately, that increase is likely to persist with the advent of this new threat,» he says.
Dump Memory Grabber
The malware identified by Group-IB, called Dump Memory Grabber by Ree[4], can attack any Windows-based system, the firm’s researchers say. The typical attack uses an .exe file for RAM memory scanning of credit card data when the network is attacked and then transmits logs containing intercepted card data through FTP gateways, researchers say.
Group IB says attacks using Dump Memory Grabber have been successful through remote access against POS devices and systems running on Windows XP and Windows Embedded. The firm’s researchers also point out that the malware could exploit similar vulnerabilities in ATMs that are connected through virtual private networks or wireless Global System for Mobile, or GSM, and General Packet Radio Service, or GPRS, networks.
But Warner believes that assumption is a bit of a leap. «I see absolutely nothing to indicate infections of ATMs,» Warner says.
«In the past, it has been shown that certain ATM machines were actually managed through some form of remote terminal, including remote desktop or VNC [virtual network computing],» he says. «The implication here is that it would be possible to install this malware onto an ATM machine directly if the ATM machine was running remote desktop on Windows and the hackers either had credentials or the ability to acquire, brute force, or hack the RDP/VNC installation on the ATM.» But those scenarios aren’t likely, Warner says.
The researcher believes that the Dump Memory Grabber is not really new. «My belief right now is that Dump Memory Grabber by Ree — the malware by Wagner Richard that Group-IB talked with — is actually the same malware that Symantec calls vSkimmer and that others call BlackPOS,» he says.
vSkimmer is believed by some to have been the malware used in the February attack on Bashas’ corporate network that allowed hackers to gain access to the retailer’s internal systems and capture sensitive payment information.
Serious Threat?
Jerome Segura, a senior researcher at malware-detection provider Malwarebytes, says the threats outlined by Group-IB should not be taken lightly.
«I’ve obtained a copy of an actual malware file and it pretty much does what it’s supposed to do: hook onto the system, then call back the command-and-control server located in Russia,» he says. «Probably the most difficult part might be to get the malware onto an ATM or point-of-sale machine. But since everything is wired, one could think that hacking into a company’s network could give them access.»
Segura acknowledges, however, that an attack on an ATM would more likely occur through an insider — someone who is able to intentionally load malware while servicing the machine.
Like Warner and Segura, fraud analyst Shirley Inscoe, who works for the consultancy Aite, says employees and contractors are often the sources of attacks that compromise systems and devices, such as ATMs.
«Fraud rings have been known to target institutions and have members of their rings apply for certain positions in an effort to facilitate their crimes,» she says. «They also have been known to do everything from paying employees to do certain things — or not to do certain things, such as comply with policies — to threatening members of employees’ families to gain their cooperation. So, in a nutshell, while I have no substantive proof that employees may be enabling much of this fraud, I would be very surprised if they are not enabling some portion of it.»
