The United States Secret Service issued a warning on Friday to financial institutions citing “credible information” about “planned” attacks against U.S. cash machines using malware that can quickly drain ATM machines dry of cash. The warning came a day after ATM maker Diebold Nixdorf also warned its customers of “potential” ATM Jackpotting attacks moving from Mexico to the U.S.
But journalist Brian Krebs, who runs the site KrebsOnSecurity, is reporting that U.S.-based attacks have already begun. Krebs cites sources at ATM maker NCR Corp. that say an undisclosed number of ATM Jackpotting attacks (otherwise known as logical attacks) have already hit U.S. shores.
“While at present these appear focused on non-NCR ATMs, logical attacks are an industry-wide issue. This represents the first confirmed cases of losses due to logical attacks in the US,” read the NCR advisory, quoted by Krebs.
While the U.S. Secret Service is mum on what the nature of the attacks are, Krebs’ sources within that agency claim recent attacks include the use of Jackpotting malware Ploutus.D.
“The source said the Secret Service is warning that thieves appear to be targeting Opteva 500 and 700 series Dielbold ATMs using the Ploutus.D malware in a series of coordinated attacks over the past 10 days, and that there is evidence that further attacks are being planned across the country,” according to the Krebs report.
Dielbold and NCR did not immediately return requests for comment for this story.
The Secret Service said in its advisory, threat actors are targeting mostly stand-alone ATMs. “ATMs are routinely located in pharmacies, big box retailers, and drive thru ATMs. Criminals range from individual suspects to large organized groups, from local criminals to international organized crime syndicates,” the Secret Service said.
The agency is crediting the U.S. Electronic Crimes Task Force for identifying the “credible” threats. “Subsequently, we alerted other law enforcement partners and
financial institutions who could potentially be impacted by this crime,” it said.
ATM jackpotting is hardly a novel, but attacks in the U.S., until now, have not been reported. Previous attacks have targeted ATMs in Mexico, Japan, Thailand and Europe. Jackpotting malware used in those attacks has ranged from Ploutus, Prilex, Green Dispenser and Ice5.
In the case of Ploutus, the malware has been on the scene since 2013. In Oct. 2017 the malware had accounted for 64M USD in losses, according to a paper presented at Virus Bulletin by Thiago Marques, researcher at Kaspersky Lab.
Ploutus requires physical access via a USB or CD to deploy the malware in order to steal the ATM ID used to activate and identify an ATM before cashing out, according to Marques.
In the case of the most recent attacks, Krebs is reporting that a source at the Secret Service said attackers were using medical equipment such as an endoscope to navigate the inside of the ATM in order to intercept the cash machine’s dispenser communication port, sync with the ATM’s computer and to begin the malware infection.
“At this point, the crook(s) installing the malware will contact co-conspirators who can remotely control the ATMs and force the machines to dispense cash,” according to Krebs.
Post infection, a remote attacker can instruct the ATM to dispense thousands of dollars in cash in just minutes, according a Jan. 2017 FireEye report on Jackpotting.
FireEye researchers note that Ploutus-D typically targets Diebold ATM equipment which runs the multi-vendor Kalignite platform. “The samples we identified target the ATM vendor Diebold. However, minimal code change to Ploutus-D would greatly expand its ATM vendor targets since Kalignite Platform runs on 40 different ATM vendors in 80 countries,” researchers said.
“What’s interesting about these attacks is that they require considerable physical access to the ATM itself, meaning that there is a high risk of getting caught, and there are far less complex attack vectors that could have been chosen,” said Leigh-Anne Galloway, cybersecurity resilience lead at Positive Technologies.
Krebs is reporting that the Secret Service is warning financial institutions that ATMs still running on Windows XP are vulnerable to attack.
Past ATM heists have used different strains of malware. In Aug. 2016, the malware family known as RIPPER is was blamed for a rash of ATM robberies in Thailand. Attackers are able to penetrate targeted ATMs with a specially crafted EMV (EuroPay, MasterCard and Visa) chip-enabled ATM card. The card serves as an authentication mechanism that interacts with the RIPPER malware that already exists on the ATM. Crooks in that incident made off with $378,000.
“We have seen quite an increase in logical attacks over the last couple of years and this is certainly one of the most novel. ATMs are still a critical link in communities, providing access to banking services for many people who may never visit a branch itself,” Galloway said.
