ATM malware coughs up cash on demand

Powered by SC Magazine
 

Spotted in Mexico, but unlikely to hit Oz.

Malware has been discovered infecting ATMs in Mexico but the attack vector isn't likely to come Down Under.

The Ploutus malware was loaded via a CD drive onto an automatic teller machine where it would then spew cash by accepting remote commands from an attacker.

The .Net executable was installed as a service dubbed NCRDRVPS and would hook the keyboard to monitor for specific attacker commands, according to Spiderlabs researcher Josh Grunzweig who obtained a copy of Ploutus.

Authors had code the malware with a simple graphical user interface written in Spanish. Once activated, attackers could choose the amount of cash to dispense and the required denominations.

"I suspect the reason ATM malware is rare is because it's difficult to install because an attacker typically requires access to the machines,” Grunzweig said. “That being said, it's still very much a real threat and should not be taken lightly.”

Credit: Spiderlabs

A local security expert who worked with ATM security but who had not seen Ploutus said it would be difficult to run such malware on new ATMs in Australia like those operated by the big four banks.

"Many modern ATMs utilise software that stops arbitrary code execution, and you'd need administration rights to run it,” the expert said on the condition of anonymity.

But third-party ATMs commonly found in convenience stores would have less security mechanisms in place.

He agreed that it would be still more profitable for attackers to install tried-and-tested skimmers on ATMs.

Copyright © SC Magazine, Australia


ATM malware coughs up cash on demand
 
 
 
Top Stories
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
 
What InfoSec can learn from the insurance industry
[Blog post] Another way data breach laws could help manage risk.
 
A ten-point plan for disrupting security
[Blog post] How can you defend the perimeter when it’s in the cloud?
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  29%
 
Application integration concerns
  3%
 
Security and compliance concerns
  27%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  21%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  4%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 1032

Vote