How simple life was three years ago when we last wrote about ATM malware. Back then, security researchers classified ATM attacks into two broad categories: ones that used skimming hardware devices attached to the outside of card readers, and ones that used various techniques to open ATMs’ cabinets and cash drawers. The skimmers were crude but effective in collecting credit and debit card numbers from customers. The latter methods exploited vulnerabilities created by the ATMs’ outdated operating systems (OS) and their functionality. In one case, some criminals blew up the ATMs themselves, as The Daily Mirror reported. Crude, but certainly effective.

XP Marks the Spot

For many years, almost all of the world’s ATMs ran on Windows XP. Banks have been making upgrades to more modern Windows versions, but there are many places around the world where XP still rules, such as India. Criminals are well-aware of this fact and have targeted their malware accordingly.

ATMs are popular targets because they are less secure than the average home. The internal systems of many ATMs are controlled by a hardware lock that can be opened by using a common key. Once the ATM enclosure has been breached and the malware products installed, the malware typically forces a reboot. Malicious actors count on the fact that ATMs often don’t check for the presence of any external media, making it easier to insert a DVD or USB flash drive to control how the OS operates and force the cash drawer to open.

ATM Malware Changes With the Times

But times are changing. First, ATM malware is becoming more subtle. Because security researchers have thoroughly analyzed several ATM malware families, criminals have started using code obfuscation methods such as software packers and virtual machine and sandbox detectors — something that has been common practice in the general malware world for many years.

Another code obfuscation method is reusing common libraries that are part of the legitimate OS. This is how the ATMii malware operates. ATMii is clever enough to be responsive to the Windows OS version on which it is running.

While physical attacks are still popular, researchers are seeing a rise in more subtle malware infections designed to attack the banking networks themselves. These attacks are more difficult to execute because they require the actor to understand how to access the ATM network from the main bank’s networks, but they remain possible because institutions don’t take extra steps to protect themselves. Many banks still don’t segment their networks, for example. If they do, the attacker relies on a banking insider — either a willing participant or someone whose account was compromised — to help bridge the two.

No Signs of Slowing Down

Network attacks have increased and have received a lot of publicity over the past several years. One of the first was the Carbanak attack, a large-scale advanced persistent threat (APT) that occurred in February 2015 and used spear-phishing emails to compromise banking staffers’ accounts.

Then came two infamous attacks in 2016: The first targeted Taiwanese banks, and the second was the discovery of the Ripper malware. Both of these attacks used a compromised administrator’s password to navigate across the banking networks. Another notable threat was the Cobalt Strike attack, which took mere minutes to compromise banking networks.

What these attacks have shown, as one research report noted, is that “we are now at a point where ATM malware is becoming mainstream.” ATM malware authors are adopting the same techniques and methods that other cyberattackers are using to target the general population.

More from Banking & Finance

Cost of a Data Breach: Banking and Finance

The importance of cybersecurity has touched almost every industry. Beyond that, robust cybersecurity is table stakes for several sectors, particularly health care and the banking and finance industry. Not only is financial data at risk, but so is customer trust. In banking and finance, trust means everything. Yet, consumers are hesitant to share their confidential data. A recent McKinsey survey revealed that no industry achieved a trust rating of 50% for data protection. Here’s the most sobering stat: 87% of…

What Do Financial Institutions Need to Know About the SEC’s Proposed Cybersecurity Rules?

On March 9, the U.S. Securities and Exchange Commission (SEC) announced a new set of proposed rules for cybersecurity risk management, strategy and incident disclosure for public companies. One intent of the rule changes is to provide “consistent, comparable and decision-useful” information to investors. Not yet adopted, these new rules – published in the Federal Register on March 23 – could change reporting requirements. Take a look at some of the big-ticket items and what your organization needs to know.…

SEC Proposes New Cybersecurity Rules for Financial Services

Proposed new policies from the Securities and Exchange Commission (SEC) could spell changes for how financial services firms handle cybersecurity. On Feb. 9, the SEC voted to propose cybersecurity risk management policies for registered investment advisers, registered investment companies and business development companies (funds). Next, the proposal will go through a public comment period until May 9.  The Importance of Cybersecurity in Finance The 2021 X-Force Threat Index found that financial services were the most targeted industry. Manufacturing beat out…

Top Security Concerns When Accepting Crypto Payment

From Microsoft to AT&T to Home Depot, more companies are accepting cryptocurrency as a way to pay for products and services. This makes perfect sense as crypto coins are a viable revenue source. Perhaps the time is ripe for businesses to learn how to receive, process and convert crypto payments into fiat currency. Still, many questions remain. How can you safely enable customers to pay with Bitcoin or other digital currency? What are the security risks that come with cryptocurrency? Let’s…