Feeds

Card-sniffing trojans target Diebold ATM software

Innovations in cybercrime

5 things you didn’t know about cloud backup

Security researchers from Sophos have discovered sophisticated malware that siphons payment card information out of automatic teller machines made by Diebold and possibly other manufacturers.

Sophos researcher Vanja Svajcer found three samples after combing through VirusTotal and a similar online database earlier this month. If installed, all three trojans contained functions that allowed them to log information recorded by an ATM's magnetic card reader.

They also appeared to include routines for encrypting the stolen data and instructions for retrieving the captured passwords using the ATM's printing capabilities. That would allow mules outfitted with the proper codes to fetch the pilfered information from the targeted machines, Svajcer told The Register.

Diebold became aware of the trojans in January, after an incident "isolated in Russia" attempted to use the malware to intercept sensitive information, according to an advisory the company sent its customers. Suspects in the incident have been apprehended, and Diebold is working with authorities "to assist with the investigation into these recent crimes," the advisory added.

Diebold has also offered a software update as a precautionary measure.

The Sophos researcher said this appears to be the first time malware has been uncovered that specifically targets banking ATMs. That said, it's not unusual for cybercriminals to steal payment card information by tampering with point-of-sale terminals. In October, for example, organized crime syndicates managed to doctor hundreds of card swipers used by UK-based retail outlets. The attack resulted in the estimated loss of tens of millions of pounds.

The trojans uncovered by Svajcer target Diebold software known as Agilis 91x, which can manage large fleets of ATMs made by Diebold and other manufacturers. Little is known about the malware's authors. Functionality that converts currency between US dollars, Russian roubles, and Ukrainian grivna leads him to believe they have ties to Eastern Europe.

Both Svajcer and Zacheroff stressed the trojan could only be installed by someone who had physical access to an ATM, since the devices, obviously, don't have floppy drives and typically run only on private isolated networks. That means the malware could most likely be installed only with help of an insider or in the event passwords weren't managed properly.

More from Svajcer is available here. ®

Next gen security for virtualised datacentres

More from The Register

next story
Snowden on NSA's MonsterMind TERROR: It may trigger cyberwar
Plus: Syria's internet going down? That was a US cock-up
Who needs hackers? 'Password1' opens a third of all biz doors
GPU-powered pen test yields more bad news about defences and passwords
Microsoft: We plan to CLEAN UP this here Windows Store town
Paid-for apps that provide free downloads? Really
e-Borders fiasco: Brits stung for £224m after US IT giant sues UK govt
Defeat to Raytheon branded 'catastrophic result'
Hear ye, young cyber warriors of the realm: GCHQ wants you
Get involved, get a job and then never discuss work ever again
Chinese hackers spied on investigators of Flight MH370 - report
Classified data on flight's disappearance pinched
Microsoft cries UNINSTALL in the wake of Blue Screens of Death™
Cache crash causes contained choloric calamity
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Top 10 endpoint backup mistakes
Avoid the ten endpoint backup mistakes to ensure that your critical corporate data is protected and end user productivity is improved.
Top 8 considerations to enable and simplify mobility
In this whitepaper learn how to successfully add mobile capabilities simply and cost effectively.
Rethinking backup and recovery in the modern data center
Combining intelligence, operational analytics, and automation to enable efficient, data-driven IT organizations using the HP ABR approach.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.