ATM Malware

Great - just when I was getting good at defending myself from phishers, vishers, social engineering, viruses, trojan horses, keystroke loggers, cross-site scripting attacks, forged SSL certificates, and other such threats to my personal banking, word comes from Eastern Europe that crooks have decided to cut out the middle man and just install malware directly on the automated teller machines.

The malicious code captures PINs and magnetic stripe data from the ATM's memory, which they then use to drain cash from accounts.

This is a highly sophisticated attack and certainly steps up the game. Since most modern ATMs are loaded with Windows XP, there are plenty of holes to be exploited. It took financial institutions years to get their ATMs off of legacy Windows NT Workstation and Windows 2000 Professional operating systems, and most only did so because vendors were leery of supporting hardware for which Microsoft refused to provide OS security support.

This new attack still takes an insider, either an ATM technician or someone with keys to install the malware, but since the average ATM contains $600,000 when fully stocked, paying someone off wouldn't be that difficult.

Time to go back to stuffing cash in the mattress.

New ATM Malware Captures PINs and Cash , via Wired