Attack The Machines: The lucrative business of ATM malware

Growth and Innovation of ATMs
          Globally we've seen a steady growth of ATMs that is predicted to increase to 4 million by 2021, however in the United States we've seen only nominal growth probably due to several things including EMV migration. Well that trend appears to be shifting.
          According to new analysis by the ATM Industry Association (ATMIA), we've reached a new milestone – there are now between 475,000 and 500,000 ATMs operating in the U.S.
          ATM innovation around new capabilities and services is growing, as well. This will have a direct impact on brick-and-mortar banks. The result will be fewer and smaller branches using more and more capable ATMs. The machines already offer person-to-person (P2P) money transfer capabilities that provide advantages including increased availability of cash, lower transaction costs, accessibility across currencies, and buying and selling crypto-currencies. According to Coin ATM Radar, there are nearly 1,600 Bitcoin ATMs globally.
          In the future we'll see cardless cash transactions enabled by Near Field Communication (NFC), Bluetooth and iBeacon-enabled mobile phones. Additionally, we'll have application-based services that are more personal and customizable. However, greater connectivity and app driven services also introduces greater risk. It is critical that similar innovation occurs around the physical and network security of ATMs to keep ahead of the risk evolution.

Physical vs Network
          Physical and network-based malware attacks on ATMs are on the rise. In the physical attack section of the report, our researchers break down the common denominator of many ATM malware – the XFS (extensions for financial services) middleware. Middleware providers use the XFS standard to create client-server architecture for financial applications on Microsoft Windows platforms. Financial applications through the XFS manager using XFS APIs communicate with peripherals such as PIN pads, cash dispensers, and receipt printers. This middleware is the connective tissue within many ATMs regardless of make, model or vendor. Exploiting the universality of XFS to "jackpot" ATMs equates to a huge ROI for malware developers as they can conduct one to many campaigns.
          In the network-based attack section our researchers analyze recent noteworthy attacks. In July 2016, Eastern European cybercriminals used malware to withdraw 2.5 million in cash from 41 ATMS in three cities in Taiwan. Others are also described in the report such as Cobalt Strike, Anunak/Carbanak, Ripper and ATMitch. All these attacks and campaigns highlight the systemic vulnerability of insecure corporate networks that ultimately serve as the gateways to exploiting global ATM infrastructure.
Securing ATMs 
          Mitigating the risks posed by ATMs to banks and consumers is a significant task. Here are a few tips to help security administrators in financial organizations get started.
          •Keep your operating system, software stack and security configuration up to date
          •Apply timely patches to corporate network infrastructure and ATMs
          •Use whitelisting technology to protect your environment because most machines are "fixed function devices"
          •Introduce intrusion prevention and Breach detection mechanisms to identify malicious system behavior to protect ATMs during operation
          •Ensure real-time monitoring of security relevant hardware and software events
          •Deploy and actively use anti-malware solutions on technician's notebooks and USB devices
          •Train service technicians to handle USB removable media devices with due care

          For financial institutions and law enforcement agencies interested in detecting ATM malware and protecting against it, we once again have a private version of the paper. To request a copy, please email [email protected].