Card-sniffing trojans target Diebold ATM software Security researchers from Sophos have discovered sophisticated malware that siphons payment card information out of automatic teller machines made by Diebold and possibly other manufacturers. Sophos researcher Vanja Svajcer found three samples after combing through VirusTotal and a similar online database earlier this month. …
"since the devices, obviously, don't have floppy drives and typically run only on private isolated networks. "
I work in security and have worked in the past on secure "airgapped" networks that because of some misconfig or deliberate action were anything but.
I used to house share with a guy who worked for diebold, and we used to have some interesting conversations about virii and other things managing to get onto the "closed atm network". I believe they have a division who continually goes around trying to plug gateways between the atm network and the internet...
Theres also the possibility of a bank teller in a priviledged position deliberately compromising the atm intentionally , since they do have access to do this. There apparently has been instances...
If SCADA systems are having issues, you can bet diebold is firefighting their albeit a bit more stealthily....
Mines the coat stuffed full of real money out of paranoia about atm's...
I've never heard of Gasper before so checked Wikipedia.... I don't think you're referring to a marijuana cigarette, or a type of adjustable ventilation outlet used in aircraft or even a river in southwestern Kentucky, U.S.
Are you therefore referring to someone who engages in erotic asphyxiation...?!! If so, I demand to know more.
I could be naive, as well, but my suspicion is that the ATMs in question are the privately owned NoNameCashSpot™ machines often found at gas stations and convenience stores, rather than bank-owned machines. (G**gle "own an ATM" and see how many companies are willing to sell one to any Tom, Dick, or Vladiszlav with cash in hand...) Someone comes in every so often to put cash in and unload the records (electronic or paper), and the store owners don't pay any attention 'cause it's not their machine.
Buy one, install the sniffer software and put it out someplace, upgrade the software whenever you go in to service it, and no one gives a rodent's rectum 'cause "it's just the guy servicing his machine."
It's why I try to avoid using those particular machines if at all possible.
I'm curious about the operating system (s) used for these ATMs and what privileges the typical technicians have on them. With such relatively static configurations, it would seem quite straightforward to lock these machines down and perform regular audits to counter these risks, even if the techs have admin rights.
Eirik Iverson
http://www.blueridgenetworks.com/products/edgeguard.htm
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
