Taiwanese authorities are trying to understand how hackers managed to trick a network of bank ATMs, withdrawing over two million dollars in a few hours.
Police suspect two Russian nationals wearing masks. The suspects managed to visit dozens of First Bank ATMs in Taiwan on Sunday as the country was hit by a typhoon. The fraudsters stole an estimated $2.2 million, just hours after the typhoon hit Taipei, the capital of Taiwan.
The two (or maybe three) crooks who carried out the thefts did not use bank cards, as shown by security cameras. The hackers appear to have gained control of the ATMs with a “connected device,” possibly a smartphone, according to police.
The compromised ATMs were manufactured by German company Wincor Nixdorf, which admits that some of its Taiwan-based machines were hacked. Three different types of malware were found on the machines.
First Bank and other banks in Taiwan stopped withdrawals from their ATMs as a precautionary measure after the attack, and are awaiting audits that will try to determine how the attack took place.
However, security experts have already come up with some theories trying to explain the hack.
Craig Young, a security researcher in the Vulnerability and Exposures Research team at security firm Tripwire, said:
“The attackers may have found another way to hack ATMs on a massive scale, like the technique Barnaby Jack demonstrated at Black Hat USA 2010. These attacks use malware that reprograms the machine. That’s how the cash comes out.
“Some ATMs have network management systems with known default passwords, and in many cases, thieves can and do access USB ports to load malware from a flash drive. From the description, it sounds like the thieves likely installed malware by enabling wireless connectivity on the ATMs. It is also very possible that a vulnerable wireless service could allow unauthorized access to hackers.”
