ATM hacking is nothing new. Like any human-designed system, it is only natural that it will have one or more flaws, or simply, over time, fall short of faster and better technologies. Unlike most hardware, ATMs seem to hold a special place in the minds of hackers who aim to make as much money as possible “easy and fast.”
In the past, to hack an ATM, one had to gain physical access to a USB port – an act that was all too obvious in broad daylight, as it usually involved destroying some part of the machine. Even network-based attacks, which are more rare and remote, seem particularly dangerous. Breaking into a bank directly and then finding a way to hack an ATM would require a much more extensive skill set. After all, it is difficult to remain unnoticed in a highly protected environment.
Read also: Italy: Hackers stole €800,000 from 35 ATMs with a Black Box attack!
However, as Wired, at least one researcher has found a way to circumvent most of this problem, magically withdrawing cash from ATMs with just a flick of the wrist. The magazine reported on June 24 that Josep Rodriguez, a researcher and consultant at security firm IOActive, has compiled a collection of bugs affecting NFC (near-field communication) systems that many modern devices rely on to wirelessly transmit data, including debit and credit card information.
See also: Hackers target large defense organizations by breaching small and medium-sized companies
Rodriguez, who has been hired to test legitimate machines to improve their security, was able to use NFC readers to cause what developers call a “buffer overflow,” or excess data, which corrupts a machine’s memory. This decades-old attack technique allowed Rodriguez to exploit ATMs and other point-of-sale machines — think retail store checkout machines — in a variety of ways: capturing payment card information, injecting malware , and even in one case “jackpotting” an ATM.
Specifically, Rodriguez created an Android app that allows his smartphone to “mimic” these credit card radio communications and exploit flaws in the firmware of NFC systems. With a shake of his phone, he can exploit a variety of bugs to destroy point-of-sale devices, hack them to collect and transmit credit card data, “secretly” modify transactions, and even lock the devices while displaying a ransomware message.
Suggestion: Hackers combine ransomware and DDoS attacks to target victims
According to Wired, Rodriguez kept his findings secret for a year, and is legally bound not to reveal the identities of the companies he worked for. However, because it is concerning that an old technique still affects a large number of modern machines, he plans to reveal more technical details in the coming weeks, in an effort to draw attention to the security of these devices.
