How hackers are breaking into ATMs, stealing money

Kaspersky Lab's experts recently performed a forensic investigation into cyber-criminal attacks targeting ATMs around the world.

During the course of the investigation, the company's researchers discovered a piece of malware infecting ATMs that allows attackers to empty the cash machines via direct manipulation.

They work at night - only on Sundays and Mondays. Without inserting a card into the ATM slot, they enter a combination of digits on the ATM's keyboard, make a call to receive further instructions from an operator, enter another set of numbers, and the ATM starts giving out cash, lots of cash. Then they leave.

How the attacks played out

The criminals work in two stages. First, they get physical access to the ATMs and insert a bootable CD to install the malware - code named Tyupkin by Kaspersky Lab. After they reboot the system, the infected ATM is under their control.

After a successful infection, the malware runs in an infinite loop waiting for a command. To make the scam harder to spot, Tyupkin malware only accepts commands at specific times on Sunday and Monday nights. During those hours the attackers are able to steal money from the infected machine.

Video footage obtained from security cameras at the infected ATMs showed the methodology used to access cash from the machines.

A unique digit combination key based on random numbers is freshly generated for every session. This ensures that no person outside the gang can accidentally profit from the fraud.

The malicious operator then receives instructions by phone from another member of the gang who knows the algorithm and is able to generate a session key. This ensures that the mules collecting the cash do not try to go it alone.

When the key is entered correctly, the ATM displays details of how much money is available in each cash cassette, inviting the operator to choose which cassette to rob. After this, the ATM dispenses 40 banknotes at a time from the chosen cassette.

The Tyupkin Malware

At the request of a financial institution, Kaspersky Lab's Global Research and Analysis Team performed a forensic investigation into this cyber-criminal attack.

The malware identified and named by Kaspersky Lab as Backdoor.MSIL.Tyupkin, has so far been detected on ATMs in Latin America, Europe, and Asia.

This is what banks can do to mitigate the risk:

Review the physical security of their ATMs and consider investing in quality security solutions. Replace all locks and master keys on the upper hood of the ATM machines and ditch the defaults provided by the manufacturer. Install an alarm and ensure it is in good working order. The cyber-criminals behind Tyupkin only infected ATMs that had no security alarm installed. Change the default BIOS password. Ensure the machines have up-to-date antivirus protection. South Africa

Kaspersky Lab said that due to the nature of the devices where Tyupkin malware is run (ATMs), they do not have Kaspersky Security Network data to determine the extent of the infections and the full list of the infected countries.

'However, based on statistics culled from VirusTotal, we have seen malware submissions from a number of specific countries,' the company said.

'South Africa is not in the list that we have. However it doesn't mean that ATMs in the countries that are not in the list are not infected. This is a very sensitive zone for banks, and for this reason this information may not be disclosed by them.'

More on card security Don't trust your ATM Card fraud scammer sentenced