Kaspersky Lab and INTERPOL Alert: Infected ATMs Give Away Millions of Dollars Without Credit Cards Around the Globe

Kaspersky Lab’s experts performed a forensic investigation into cybercriminal attacks targeting multiple ATMs around the world. During the course of this investigation, the company’s researchers discovered a piece of malware infecting ATMs that allowed attackers to empty the cash machines via direct manipulation, stealing millions of dollars. INTERPOL alerted the affected member countries and is assisting with ongoing investigations.

Free Download: Is An Outright Ban On Workplace Social Networking A Good Idea?

The criminals work at night – only on Sundays and Mondays. Without inserting a credit card into the ATM slot, they enter a combination of digits on to the ATM’s keyboard, make a call to receive further instructions from an operator, enter another set of numbers, and the ATM starts giving out cash. Lots of cash. Then they leave.

How the attacks played out

The criminals work in two stages. First, they gain physical access to the ATMs and insert a bootable CD to install the malware – code named Tyupkin, by Kaspersky Lab. After they reboot the system,  the infected ATM is under their control.

After a successful infection, the malware runs in an infinite loop waiting for a command. To make the scam harder to spot, Tyupkin malware only accepts commands at specific times on Sunday and Monday nights. During those hours, the attackers are able to steal money from the infected machine.

Video footage obtained from security cameras at the infected ATMs revealed the methodology used to access cash from the machines. A unique digit-combination key based on random numbers is freshly generated for every session. This ensures that no person outside the gang can accidentally profit from the fraud. Then the malicious operator receives instructions by phone from another member of the gang who knows the algorithm and is able to generate a session key based on the number shown. This ensures that the mules collecting the cash do not try to go it alone.

When the key is entered correctly, the ATM displays details of how much money is available in each cash cassette, inviting the operator to choose which cassette to rob. After this the ATM dispenses 40 banknotes at a time from the chosen cassette.

The Tyupkin Malware

At the request of a financial institution, Kaspersky Lab’s Global Research and Analysis Team performed a forensic investigation into this cybercriminal attack. The malware identified and named by Kaspersky Lab as Backdoor.MSIL.Tyupkin has so far been detected on ATMs in Latin America, Europe and Asia.

“Over the last few years, we have observed a major upswing in ATM attacks using skimming devices and malicious software. Now we are seeing the natural evolution of this threat with cybercriminals moving up the chain and targeting financial institutions directly. This is done by infecting ATMs themselves or launching direct Advanced Persistent Threat (APT)-style attacks against banks. The Tyupkin malware is an example of the attackers taking advantage of weaknesses in the ATM infrastructure,” said Vicente Diaz, Principal Security Researcher at Kaspersky Lab’s Global Research and Analysis Team.

“We strongly advise banks to review the physical security of their ATMs and network infrastructure and consider investing in quality security solutions,” Diaz added.

“Offenders are constantly identifying new ways to evolve their methodologies to commit crimes, and it is essential that we keep law enforcement in our member countries involved and informed about current trends and modus operandi,” said Sanjay Virmani, Director of the INTERPOL Digital Crime Centre.

What banks can do to mitigate the risk:

·         Review the physical security of their ATMs and consider investing in quality security solutions.
·         Replace all locks and master keys on the upper hood of the ATM machines and ditch the defaults provided by the manufacturer.
·         Install an alarm and ensure it is in good working order. The cybercriminals behind Tyupkin only infected ATMs that had no security alarm installed.
·         Change the default BIOS password.
·         Ensure the machines have up-to-date antivirus protection.
·         For advice on how to verify that your ATMs are not currently infected, please contact us at intelreports@kaspersky.com. To make a full scan of the ATM’s system and delete the backdoor, please use the free Kaspersky Virus Removal Tool (available to download here).

A video showing how this attack works on a real ATM is available here.

Read more about Tyupkin ATM malware on Securelist.com.

About Kaspersky Lab

Kaspersky Lab is the world’s largest privately held vendor of endpoint protection solutions. The company is ranked among the world’s top four vendors of security solutions for endpoint users. Throughout its more than 17-year history Kaspersky Lab has remained an innovator in IT security and provides effective digital security solutions for large enterprises, SMBs and consumers. Kaspersky Lab, with its holding company registered in the United Kingdom, currently operates in almost 200 countries and territories across the globe, providing protection for over 300 million users worldwide. Learn more at www.kaspersky.com.