Forest Global Training Partners

Cyber Risks · Krebs on Security

First ‘Jackpotting’ Attacks Hit U.S. ATMs

Summary: The U.S. Secret Service warned financial institutions in January 2018 that jackpotting attacks, long seen in Europe and Asia, had reached U.S. ATMs, and NCR told customers on Jan. 26 that these were the first confirmed U.S. losses from logical attacks. A source said organized gangs used the Ploutus.D malware against front-loading Diebold Nixdorf Opteva 500 and 700 series machines in coordinated attacks over 10 days, with thieves posing as technicians, using an endoscope to attach a cord, and forcing the ATM to dispense 40 bills every 23 seconds until the cash was gone.

Key Takeaway: The attack needs only physical access and a laptop, and the machine dispenses 40 bills every 23 seconds until someone presses cancel on the keypad - a cash-out crew can empty it in minutes while the ATM reads Out of Service. FireEye warned that small code changes could turn Ploutus.D against 40 ATM vendors in 80 countries, and the Secret Service said machines still on Windows XP are especially exposed.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related