ATM malware coughs up cash on demand

Malware has been discovered infecting ATMs in Mexico but the attack vector isn't likely to come Down Under.

The Ploutus malware was loaded via a CD drive onto an automatic teller machine where it would then spew cash by accepting remote commands from an attacker.

The .Net executable was installed as a service dubbed NCRDRVPS and would hook the keyboard to monitor for specific attacker commands, according to Spiderlabs researcher Josh Grunzweig who obtained a copy of Ploutus.

Authors had code the malware with a simple graphical user interface written in Spanish. Once activated, attackers could choose the amount of cash to dispense and the required denominations.

"I suspect the reason ATM malware is rare is because it's difficult to install because an attacker typically requires access to the machines,” Grunzweig said. “That being said, it's still very much a real threat and should not be taken lightly.”

A local security expert who worked with ATM security but who had not seen Ploutus said it would be difficult to run such malware on new ATMs in Australia like those operated by the big four banks.

"Many modern ATMs utilise software that stops arbitrary code execution, and you'd need administration rights to run it,” the expert said on the condition of anonymity.

But third-party ATMs commonly found in convenience stores would have less security mechanisms in place.

He agreed that it would be still more profitable for attackers to install tried-and-tested skimmers on ATMs.

Copyright © SC Magazine, Australia