Avoiding credit card fraud is easy as long as you use cash. But what if you get hacked while withdrawing cash from a bank?
If you live in Germany or are traveling there, then think twice before using your payment cards at bank ATMs.
And here's why:
A security researcher in Germany managed to hack into Sparkasse Bank's ATMs and self-service terminals and reveal the information from the payment card inserted into the machine.
Benjamin Kunz-Mejri, CEO of the Germany-based Vulnerability Lab, discovered a vulnerabilitywhen he was using a Sparkasse machine when his card suddenly ejected, and the screen changed to “temporarily unavailable.”
Meanwhile, the machine automatically started running the software update process in the background. However, Benjamin used a special key combination to trick the ATM into another state.
Benjamin's trick forced the ATM system to place the console's update process (CMD) in the foreground, where the warning message was located.
“At that moment the researcher realized there was a loophole and used his iPhone to capture the output of the branch manager’s bootChkN (Wincor Nixdorf) console ,” says a blog post on Vulnerability-Lab
After saving the data and reviewing the record, Benjamin was able to discover a lot of sensitive information, including the bank branch's main information:
Usernames
The serial numbers
Firewall settings
Information network
The computer name
Device identifiers
ATM settings
Two system passwords
Other information related to the material
“Benjamin reported the critical issue to Sparkasse Bank, which acknowledged the issue and has already started patching ATMs and self-service terminals in a pilot program to prevent attacks,” Sparkasse Bank said in a statement.
The ATM (automatic teller machine) that Benjamin analyzed is manufactured by Wincor Nixdorf, one of the most famous companies in the retail and banking industry.
Therefore, the chances are high that both ATMs and self-service terminals of other banks that use them were also affected, along with Sparkasse Bank.
Benjamin reported the critical issue to Sparkasse Bank, which acknowledged the issue and has already begun patching ATMs and self-service terminals to prevent attacks.
