6 ms·
Trojan.Skimer.18 infects ATMs
- JimmaDaRustla 13y agoMany countries with EMV standards implemented (Canada, European countries, Japan, etc.) will use chip over the mag stripe on the back. When this article refers to Track 2 data, it is referring to the magnetic stripe. Of course, if your card has a mag stripe, it is still susceptible to this attack if you use it in an ATM which reads the track data and has the virus.
- brazzy 13y agoThe malware reaches extremely deep into the ATM software to decrypt the PIN - it could easily also capture the data which the machine got from the chip.
- JimmaDaRustla 13y agoYou obviously don't understand how chip cards work. Unlike mag-stripe, data elements are not accessible on the chip. The PIN check is performed on the chip card itself, and a PIN cryptogram returned for use in the online transaction. The PIN does not get decrypted at the ATM.
- brazzy 13y agoActually I didn't know the details but had thought that would be the safest method to deal with the PIN. But I assumed you were talking about the equivalent of the "Track 2 data", i.e. issuer ID, account number, etc. Is that also kept away from the ATM? As for the PIN - if the encryption happens in the chip card, how does it get from the PIN pad to the card in a way that cannot be intercepted? And finally, what prevents compromised ATM software from displaying "please enter PIN now" while keeping the PIN pad int the direct mode used to enter the amount?
- viraptor 13y agoI'm still really surprised every time I see a windows-based ATM. Why would a full, general-purpose OS be included in those machines that need to do just under 10 operations? I know it's easier to deal with it that way, but just to limit the exposed code, it could be based on something much more restricted. If it was small enough, it could even reboot / netboot itself between each operation to prevent any modifications being stored locally.
- ianhawes 13y agoThey need a full stack OS with TCP/IP, crypto, UI, etc... Plus with Windows they can reuse a lot of their libs which are written in C# or Java.
- anonymfus 13y agoBut why they use outdated consumer oriented versions of Windows? Why they all are XP Home Edition?
- jboggan 13y agoBecause it was probably cheaper that way. The manufacturers are passing the security buck to the banks themselves, and folks who work in banking IT/infrastructure don't generally know enough to understand what these machines do. As long as the cash counts in the cassettes matches up with the receipt at the end of the week no one is worried.
- cbhl 13y agoBesides, insurance!
- kalmi10 13y agoWhy home? Because home editions are cheaper, and they really don't need any extra features of the more pro editions. So in one word: cost
- drdaeman 13y ago
- nwh 13y agoThat's an incredibly bad job at blurring the sample. It's both visible through the blur.. and on the text view on the right. http://st.drweb.com/static/news/20131216-trojan.skimer.18/1g.png http://st.drweb.com/static/news/20131216-trojan.skimer.18/1g...
- jboggan 13y agoThe screenshot shows APTRA which means this is an NCR machine. I've commented on threads here before about how freaking vulnerable and buggy many of the NCR machines are, since they are essentially running Windows XP and are infrequently manually patched with the monthly fixes. There's only three major lock types for the older machines and the internal cage has several PS/2 and USB drives open. There's a manufacturer admin password (one for APTRA Advance and one for APTRA Edge) that lets you get into XP and then you can do whatever you want.
- mschuster91 13y agoWhy implement a card skimmer? It 'd be far more profitable to write a program which dumps the whole cash in the ATM upon insertion of a special card... saves the cloning costs.
- drdaeman 13y agoI don't think dumping tens of ATMs is more profitable and less risky than stealing thousands of cards (and who knows for how many months an infection of ATMs could remain undetected, so it maybe even tens of thousands or more). Cards can be safely resold on black market, and riding all over the city robbing ATMs sounds much more risky activity.
- acallaghan 13y agoThat's an obvious way of stealing money, just by taking the cash. I'm assuming the serial numbers of the money in an ATM is noted, or known by the distributor, so proving a criminal used stolen money after the fact is not too hard to prove. The operation of this trojan is much more subversive and discreet, whereby it waits and skims card details to be sold on to a third party (assumedly), and is then able to revert the ATM back to a factory state, so it's much more difficult to detect if there's an audit on the machine, or it breaks and sent for repair. NOTE TO THE NSA/GCHQ: These are educated guesses, I'm not a thief/trojan writer etc
- ChuckMcM 13y agoPersonally, I consider this the real problem 'fire and forget' systems based on large complex code bases. The US Military invested a ton of money in the development of Ada to try to address some common issues (like you can verify the code still meets the specification).
- warfangle 13y agoHow can I tell if an ATM I'm about to use is vulnerable to this?