Dozens of European ATMs rooted, allowing criminals to easily cash out

[A Guy]

Criminals are installing fairly sophisticated malicious programs on banks' ATMs, allowing them to control access to the machines and easily steal cash, security firms Kaspersky and Interpol said in a joint statement released on Tuesday.

The malware, which Kaspersky dubbed 'Tyupkin,' allows low-level thieves, known as money mules, access to the machines at certain times of day using an intermittently changing code, similar to the six-digit electronic tokens used for security in the financial industry. More than 50 ATMs in Eastern Europe and Russia were found to have been infected with the malware to date, leading to the theft of currency equivalent to millions of dollars, according to the statement.

The attack shows that criminals are improving their tactics and appear to be able to gain enough access to ATMs to install code, Vicente Diaz, principal security researcher at Kaspersky Lab, said.

Source

A Guy

 

[andrew129260]

All ATMS need to get away from windows and move to Linux.

 

[NoelDP]

- so they can be infected by cracks in 20-year-old code?

 

[andrew129260]

- so they can be infected by cracks in 20-year-old code?

? Linux by default is way more secure than windows. There are even more additional things you can do to lock it down (just like windows).

 

[lehnerus2000]

The question is, "how are they being accessed?"

The standard security mantra is, "prevent physical access".
Are ATMs connect to the internet (like a lot of other vital infrastructure controllers) instead of using dedicated lines?

When I was studying Networking my Linux instructor showed us how to gain "root" access to any Linux system (if you can bring up a Terminal).
Unfortunately I've forgotten what he showed us.

 

[Golden]

- so they can be infected by cracks in 20-year-old code?

? Linux by default is way more secure than windows. There are even more additional things you can do to lock it down (just like windows).

I think Noel is referring to the BASH bug.....there may be lots of those sorts of issues still about.

 

[andrew129260]

- so they can be infected by cracks in 20-year-old code?

? Linux by default is way more secure than windows. There are even more additional things you can do to lock it down (just like windows).

I think Noel is referring to the BASH bug.....there may be lots of those sorts of issues still about.

AH. Now that makes sense. Thanks golden.

Yes certainly the bash bug is bad, but as far as I know every distro has been patched with it. Now whether or not they patched there systems yet that is the question. (They might still be testing the patch making sure it does not break anything.)

And true, regardless of OS physical access is end game. That's why they need to not have ports sticking out like they do at some ATMS here in the US.

 

[lehnerus2000]

???

That's why they need to not have ports sticking out like they do at some ATMS here in the US.

I guess it is understandable.
It might cost the bank $1 or $2 to cover it.

 

[Anak]

Ports? Ports?? We don't need no stinkin' ports, we have compensating controls!

The Payment Card Industry Security Standards Council (PCI SSC), which is responsible for overseeing security standards in the payments industry, has already noted that ATMs still on Windows XP after April 8 will need to have certain compensating controls in place to be considered PCI compliant. The PCI SSC estimates that Windows XP powers 95% of ATMs in the world.

Source: Most ATMs will remain on Windows XP after Microsoft pulls plug on OS support | Computerworld

 

[jimbo45]

All ATMS need to get away from windows and move to Linux.

Hi there

Let's get away from ATM's and PHYSICAL CASH altogether. Less robberies - less stuff to move around.

Even Credit Cards are getting a bit unnecessary if we can do it all from Mobile phones.

For those that don't have mobiles - maybe some sort of Card pre-payment schemes -- or even the debit card system.

In any case going to an ATM in a cold and miserable place or in a busy metro station like Oxford Circus in London just encourages "losers" or "Chancers" wanting some money for drugs, booze etc. If your phone gets stolen a block is very easy and the newer phones have hardware to ensure that only the OWNER can use it.

No physical cash would eliminate a lot of begging in the streets in such places as central Paris etc too.

Some emergency facilities will have to exist if you lose / break your phone - that could be taken easily enough by these pre-payment cards / debit cards .

Cheers

jimbo

 

[lehnerus2000]

No physical cash would eliminate a lot of begging in the streets in such places as central Paris etc too.

In principle I agree with this idea.
It's the first step towards the total elimination of the money-based economy.

However certain religious types would kick up a massive stink about it (e.g. "Mark of the Beast").

...
It also forced all people, great and small, rich and poor, free and slave, to receive a mark on their right hands or on their foreheads,so that they could not buy or sell unless they had the mark, which is the name of the beast or the number of its name.

BibleGateway
Revelation 13:15-18

 

[sparx96]

- so they can be infected by cracks in 20-year-old code?

(Cough) Maybe not quite 20 years but 95% of the way there...

4 Mega-Vulnerabilities Hiding in Plain Sight

● Winshock: existent for 19 years
● Kerberos Checksum Vulnerability: existent for 14 years

Of course, the first bullet from the list above is:
● Shellshock: existent for 25 years

However, no serious security-aware unix admin ever used bash for non-interactive scripting, so it was a moot point and couldn't be exploited on suitably secured unix systems in any event. FreeBSD blocked the bash exploit by default, for example... Many sites claimed all unix systems were vulnerable - this is simply not true.

FYI: Bash has too much 'surface area' and is really designed as an interactive shell vs one used for scripting, and thus it also uses considerably more memory than plain old sh (the basic shell for those unfamiliar). No flames from Linux ppl please, that is not my intent. Just ironing out some misunderstandings for the unaware. I use it myself interactively, but never for writing scripts...

Note that shellshock might get you to full root access on a single system, vs kerberos take over the entire domain...

From the horses mouth: Additional information about CVE-2014-6324 - Security Research & Defense - Site Home - TechNet Blogs

"According to Microsoft, if an attacker gets Admin rights to your Active Directory environment, it’s game over.
Remediation
The only way a domain compromise can be remediated with a high level of certainty is a complete rebuild of the domain."

So even then they really cannot be compared to each other. Notably recovery requires rebuilding the *entire domain*, so I'm sure the big global players are really happy about that. It also seemed to require the krbtgt passwd being changed twice, so if you haven't done that then you'd better start rebuilding your domain *again* (link below well worth reading for anyone administering MS domains, or just wanting to understand more about Kerberos in general):
SANS Digital Forensics and Incident Response Blog | Kerberos in the Crosshairs: Golden Tickets, Silver Tickets, MITM, and More | SANS Institute

Unless the 'krbtgt' account was reset twice, then consider that domain to still be compromised.

I *do* have a high respect for your knowledge of MS systems, Noel, but snide remarks can come back to haunt you. I see you help many ppl on this site (myself included at one point) and I thank you on behalf of the community and myself. If only MS gave a useful error messages, most of us wouldn't need to come here in the first instance (exhibit a: Error Code 13EC installing latest .Net update - why didn't it check to see if 3GB disk space was free before trying the installation, why didn't it say "not enough disk space, you need 3+GB free" instead of error 13EC. Poor coding, at best.)

 

[andrew129260]

No physical cash would eliminate a lot of begging in the streets in such places as central Paris etc too.

In principle I agree with this idea.
It's the first step towards the total elimination of the money-based economy.

However certain religious types would kick up a massive stink about it (e.g. "Mark of the Beast").

...
It also forced all people, great and small, rich and poor, free and slave, to receive a mark on their right hands or on their foreheads,so that they could not buy or sell unless they had the mark, which is the name of the beast or the number of its name.

BibleGateway
Revelation 13:15-18

The world would be much better off without that nonsense. Let's live in the past constantly and never evolve or grow. Yup great plan.

And +1 to sparx96

 

[Layback Bear]

If I may just some of my thoughts.

**post # 10 by jimbo45

Even Credit Cards are getting a bit unnecessary if we can do it all from Mobile phones.

Let's get away from ATM's and PHYSICAL CASH altogether. Less robberies - less stuff to move around.

Doing everything on Mobile Phones; I don't thinks so. I do believe most know how unsecured most Mobile Phone are. Most users have no idea what phone security is nor do they want to know.

Remove all physical cash. Less robberies is B/S.
More money is stole using computing device than any other methods. Physically taking of money is a very small part of moneys stolen. Walking into a bank and robing it might get the thief a few thousand dollars. Using a computing device can get the thief hundreds of millions and if caught the penalties are less than the thief going into the bank.

post # 4 by andrew129260

? Linux by default is way more secure than windows. There are even more additional things you can do to lock it down (just like windows).

More Bull Bananas.
The only reason Linux is safer at this point is because very few use Linux. It's not worth hacking.
If Linux was used just half as much as a Microsoft system the hackers would be all over Linux like stink on Bull Bananas.
Hacking thieves are business people. They use some of the basic rules of business.

Time and money spent and what return they received. The return on hacking Linux is poor at this time so they go for the big dog in town; Microsoft.
Microsoft systems is where the big money is so, go figure that is where the thieves attack.

These types of thieves are not dumb. When and if Linux ever gets to be a big part of the market share then they will hack it.
Remember that big time thieves are business people. They will use a P and L statement like anybody else in business.

What is the investment compared to the income.

To me the best way of stopping such hacking is the punishment when caught and convicted.
Make the punishment so sever that a hacker would rather bite the pill than be punished.

 

[andrew129260]

I see your point on Linux. Yes of course the market share is the main reason some platforms are more "secure" than others. However, Linux was built from the ground up with security in mind, windows was not. And that does help.

The argument on money could go both ways. If all money was digital, security would have to evolve. On the other hand, if things stay the way they are now, money will become useless and invaluable.

 

[Alejandro85]

Market share don't makes system more or less secure, the systems will be the same regardless. The difference lies in the targeting, more used systems will get more interest in finding vulnerabilities and then it will have greater chances of people actually meeting them, and develop exploits. Nothing in it points that one system is more secure than the other, but rather how much attention they would get.

That being said, the market share is not that inclined into Windows really. Windows only dominates the desktop market. On the server side, Linux rules the world. That makes it an interesting target for big datastores, websites, big corporations and even governments. Those gigantic password list that leak everywhere are possible mostly because the specialized hacking of Unix-based systems.
Mobile phones also use Unix derivatives mostly, where Windows has little share against both Android and iOS.

But with all that, I still have to say that there is something true in that Windows is much more insecure than Linux, at least by default. A nice example is that the initial user account after install. Windows always creates it with administrator privileges, while Linux by default uses a standard one. That and many other examples show that Linux is very oriented towards security, while Windows has always focused on usability at the expense of security. Recent versions of Windows includes many security options, almost everything being disabled by default for the sake of being "easy to use".

 

[A Guy]

Not just Security by Obscurity

Why Linux Is More Secure Than Windows | PCWorld

A Guy

 

[NoelDP]

This one is more recent - and much more realistic!
Your Linux PC isn't as secure as you think it is | PCWorld

 

[jimbo45]

No physical cash would eliminate a lot of begging in the streets in such places as central Paris etc too.

In principle I agree with this idea.
It's the first step towards the total elimination of the money-based economy.

However certain religious types would kick up a massive stink about it (e.g. "Mark of the Beast").

...
It also forced all people, great and small, rich and poor, free and slave, to receive a mark on their right hands or on their foreheads,so that they could not buy or sell unless they had the mark, which is the name of the beast or the number of its name.

BibleGateway
Revelation 13:15-18

Hi there

Not carrying cash doesn't actually stop beggars any more !!!!!!!!!!

I was accosted by a beggar in Central Brussels recently (Brussels isn't as bad as Paris for beggars by a long way but they do exist). When I said I don't carry cash he fumbled around in an old plastic black bin liner for a while and pulled out one of those old Manual Credit card machines with the payment slips !!!!!!

Shows you what having the EU commission and a load of the Eurocrats based in Brussels has done for the City --Even the Beggars take American Express / Visa cards now !!!.

I got a friend of mine to give him 10 EUR just for showing imagination. !

Cheers
jimbo

 

[andrew129260]

This one is more recent - and much more realistic!
Your Linux PC isn't as secure as you think it is | PCWorld

So the biggest thing in that article is mention of a government malware? It doesn't matter what platform you're on, government will find a way.

When People I know that have linux distros start getting malware, keyloggers and pups and all the god awful stuff that appears on windows, I will be sure to let you know.

All I know is this, install linux, never hear from them again.

It is a godsend. Will that change later? Sure. But for now, I am happy.