ATM MALWARE

Recommendations

Info

TABLE OF CONTENTS EXECUTIVE SUMMARY .......................................................................... 3 ATM MALWARE SUB-FAMILIES ............................................................. 3 1.1 BACKDOOR.PLOUTUS ........................................................................................................................................... 3 1.2 BACKDOOR.TYUPKIN ........................................................................................................................................... 4 1.3 BACKDOOR.ATM.SUCEFUL .................................................................................................................................... 4 1.4 BACKDOOR.ATM.GREENDISPENSER ..................................................................................................................... 4 1.5 TESTED SAMPLES ................................................................................................................................................. 5 2. ATTACK OVERVIEW .......................................................................... 5 3. CASH THEFT METHODS ..................................................................... 6 3.1 TROJANSPY:ATM/PLOUTUS ................................................................................................................................. 6 3.2 BACKDOOR.ATM.TYUPKIN .................................................................................................................................... 7 3.3 BACKDOOR.ATM.SUCEFUL .................................................................................................................................... 7 3.4 BACKDOOR.ATM.GREENDISPENSER ..................................................................................................................... 7 4. DETECTION ....................................................................................... 8 4.1 BEST PRACTICES TO PROTECT ATM SYSTEMS ...................................................................................................... 8 4.2 NETWORK VISIBILITY THROUGH RSA SECURITY ANALYTICS .............................................................................. 8 4.3 SYSTEM VISIBILITY THROUGH RSA ECAT ............................................................................................................ 9 4.4 RSA ECAT DETECTION: TROJANSPY:ATM/PLOUTUS ........................................................................................... 10 4.5 RSA ECAT DETECTION: BACKDOOR.ATM.TYUPKIN ............................................................................................. 10 4.6 RSA ECAT DETECTION: BACKDOOR.ATM.SUCEFUL ............................................................................................. 10 4.7 RSA ECAT DETECTION: BACKDOOR.GREENDISPENSER ...................................................................................... 11 5. CONCLUSION .................................................................................. 11 6. APPENDIX ...................................................................................... 12 6.1 ECAT SAMPLE’S ANALYSIS ................................................................................................................................. 12 6.2 YARA RULES ....................................................................................................................................................... 12
EXECUTIVE SUMMARY The famous American bank robber, Willie Sutton, was credited for having said, “Because that’s where the money is.” (Although, he denied saying this.) Sutton died in 1980, so we can only ponder what he would have thought of the vast Automated Teller Machine (ATM) network that has all-but-replaced the bank branches he preyed upon in the early 20th Century. Most of these ATMs are actually tiny banks, stacked with cash and merely protected by a lock, a camera, and software. It’s no wonder that ATMs have been attractive criminal targets for quite some time. In recent years, new ATM-focused cyber attacks have been discovered. The newer techniques do not require skimmers or other traditional, physical tools; rather these attacks use malicious code, frequently leveraging unsupported operating systems with unpatched vulnerabilities. The code may be loaded directly to the terminal itself, or remotely from a system with network access. The spoils of these endeavors range from sensitive data to large cash withdrawals. Often the attacks blend the physical and cyber realms, using accomplices (mules) who physically collect the money after the terminal has been infected. A security professional may ask: Why not a more current operating system? Why not regular patching? Why not preventive tools such as anti-virus (AV)? The answers mostly lie in the costs of upgrading, and the stability of these systems. A bad AV update or virus removal could catastrophically upend millions of transactions. Upgrades are coming, slowly. And it’s reported that many institutions have privately entered into agreements with Microsoft to extend the lives of their XP machines.¹ Microsoft ended public support for Windows XP in 2014. So, unlike many IT security professionals who struggle to respond as preventive security technologies continually fail, ATM network security administrators have a much more acute challenge – how to identify malware and other intrusions when conventional preventive approaches are ineffective. Fortunately, pervasive visibility and analytics for these systems are available. Malicious activity can be detected. Security teams can be alerted quickly, before the worst damage can occur. This report explores four subfamilies of malware, specifically tailored for ATMs: 1. Backdoor.Ploutus 2. Backdoor.Tyupkin 3. Backdoor.ATM.Suceful 4. Backdoor.GreenDispenser The report then discusses and demonstrates how these attacks can be detected using RSA ® Security Analytics and RSA ECAT. ATM MALWARE SUB-FAMILIES BACKDOOR.PLOUTUS TrojanSpy:ATM/Backdoor.Ploutus was one of the first ATM malware variants to be disclosed publically 2 . Installation requires physical access to the ATM, however if the attacker has the opportunity to remotely access the system from the internal 3 banking network (presumably with the help of a malicious insider or an unknowing user’s machine), the malware could also be installed remotely. Ploutus is typically installed via USB and operated by a mobile phone tethered to the ATM. The malware then sends or receives data via the cellular phone, and the attacker can control the ATM’s operating system (OS) using SMS messages. There can be two separate SMS commands: The first contains an activation ID to enable the Ploutus malware on the ATM. The second contains a command to dispense money. The phone forwards valid SMS messages as TCP or UDP packets to the ATM OS. The ATM network packet module receives the TCP/UDP packet and (if valid) executes, potentially resulting in the machine immediately dispensing cash. In the cases where the Remote Desktop Protocol (RDP) is used, the malware can be managed via TCP or UDP packets. The amount of cash dispensed is often pre-configured in the malware, and the cash is often collected using money mules. 1 http://money.cnn.com/2014/03/04/technology/security/atm-windows-xp 2 The first public article about Backdoor.Ploutus was released by Symantec in August 2013: http://www.symantec.com/security_response/writeup.jsp?docid=2013-101123-2819-99&tabid=2 3 Some Banking networks use internal network segments to remotely administer ATM devices.
Page 1: RSA ® INCIDENT RESPONSE REPORT: TH
Page 5 and 6: speed the response time, reducing o
Page 7 and 8: Figure 4: Ploutus Attack Scenario B
Page 9 and 10: Figure 6 below illustrates the way
Page 11 and 12: passwords as they are entered. In a
Page 13 and 14: condition: all of them and // MZ si

ATM MALWARE

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?