ATM malware coughs up cash on demand

Powered by SC Magazine
 

Spotted in Mexico, but unlikely to hit Oz.

Malware has been discovered infecting ATMs in Mexico but the attack vector isn't likely to come Down Under.

The Ploutus malware was loaded via a CD drive onto an automatic teller machine where it would then spew cash by accepting remote commands from an attacker.

The .Net executable was installed as a service dubbed NCRDRVPS and would hook the keyboard to monitor for specific attacker commands, according to Spiderlabs researcher Josh Grunzweig who obtained a copy of Ploutus.

Authors had code the malware with a simple graphical user interface written in Spanish. Once activated, attackers could choose the amount of cash to dispense and the required denominations.

"I suspect the reason ATM malware is rare is because it's difficult to install because an attacker typically requires access to the machines,” Grunzweig said. “That being said, it's still very much a real threat and should not be taken lightly.”

Credit: Spiderlabs

A local security expert who worked with ATM security but who had not seen Ploutus said it would be difficult to run such malware on new ATMs in Australia like those operated by the big four banks.

"Many modern ATMs utilise software that stops arbitrary code execution, and you'd need administration rights to run it,” the expert said on the condition of anonymity.

But third-party ATMs commonly found in convenience stores would have less security mechanisms in place.

He agreed that it would be still more profitable for attackers to install tried-and-tested skimmers on ATMs.

Copyright © SC Magazine, Australia


ATM malware coughs up cash on demand
 
 
 
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
 
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
 
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  25%
 
Sourcing and strategy
  12%
 
IT infrastructure (servers, storage, networking)
  22%
 
End user computing (desktops, mobiles, apps)
  15%
 
Software development
  26%
TOTAL VOTES: 329

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  57%
 
No
  43%
TOTAL VOTES: 136

Vote