The latest malware innovation: Infect ATMs and have them pump out cash

[Axon]

Hackers in Europe managed to target several cash machines from an unnamed bank earlier last year by infecting them with malware from USB drives, BBC News reports. The researchers who discovered the hack detailed their findings at the Chaos Computing Congress in Hamburg, Germany recently. According to their report, the ATM thefts were discovered in July after a bank noticed how its machines were emptied of cash even though the cash should have been protected inside safes. The bank then discovered how criminals were cutting holes into ATMs in order to transfer malware from the USB to the ATM. Once the data transfer was complete, the holes would be patched up to conceal the attack.


http://bgr.com/2014/01/01/atm-hacking-malware-attack/

[Kulverstukas]

haha this is really clever I wonder how did know where to cut the holes and how did they do it and then conceal the cuts? this interesting, they couldn't of had just used an angle grinder...? sawing steel with a hacksaw would take too much time.

[vezzy]

Barnaby Jack (may he rest in peace) gave a famous talk on hacking ATMs: https://www.youtube.com/watch?v=Ss_RWctTARU

[youpi]

I wonder how people do to study the ATMs to craft there attacks ?
Surely they must be working in the branch or something ?

[Kulverstukas]

I wonder how people do to study the ATMs to craft there attacks ?
Surely they must be working in the branch or something ?

It probably involves stealing an ATM to investigate, however I think the information goes hand in hand... that being one way.

[hppd]

I saw somebody do this in a defcon 18 video a while ago. They even made the thing pop up a jackpot logo remotely and let it dump all the cash.

http://www.youtube.com/watch?v=w1KfSSDh3gU

EDIT: Whoops scrolled through the thread and somebody already posted it only the blackhat version

[bluechill]

This remembers of hacking atms from Hackers (1995) :p it's not clever it's just old.

[Stackprotector]

This news article is kinda surfing on the death of the hacker who worked on this. Defcon vids are from 2010.