ATM thefts have gone high-tech, and judging by how the police and banks are running around like a headless chicken trying to piece together the puzzle, the local authorities and financial institutions were obviously not ready for such an attack. And it’s not hard to understand why – the police and banking institutions were trapped in stone age mentality where they thought the bad guys will always be the same “Oxy Gang”, using oxy-acetylene blow torch to open the machine’s cash compartment.
That was so yesterday. To make things worse, banking institutions blinded by greediness had resorted to squeeze every penny of profits by cutting off security guards manning ATM machines. They depend on merely CCTV cameras and alarm systems as their only defence. Hence, the latest ATM thefts methodology has left the authorities head scratching. So far, 14 bank branches belonging to Affin Bank, Al Rajhi Bank and Bank Islam were reportedly hacked into by a Latin American gang which made off with over RM3 million.
Malaysian Bukit Aman Commercial Crime Investigation Department chief Comm Mortadza Nazarene revealed that the suspects used a computer malware known as “ulssm.exe” to hack into the ATMs. The suspects were found to have opened the top panel of the machine without using a key and inserted a compact disc into the machine’s processing centre which caused the ATM’s system to reboot.
The sophisticated gang then used a keyboard to hack into the system and take out money. According to systems engineer of a bank – up to 40 notes could be taken out in a single transaction using the method. Needless to say, the absence of security guard ease the gang’s task, so much so that they could go for a spa or coffee session before coming back to collect their loots.
But is this something very new as if it was invented yesterday? Actually, the risk of using such malware or to be precise – ATM trojan horse - was published back in May 2014. What this means is, somebody had already done that using the same method somewhere in the world. Unfortunately, the police were too busy carrying orders from their politician masters arresting opposition for petty and silly seditious allegations.
As far back as 2010, computer security experts have shown how ATM machines can be hacked to spit money, using hardware kit that cost less than US$100 to make. And the ATM’s motherboard is only protected by a door, of which you can buy the “universal key” online (*grin*). You can then used a USB port on the motherboard to upload your own software (stored in your USB stick), which changed the device’s display, played a tune, and made the machine spit out money.
So, how did the high-tech Latin American gang hacked and stole RM3 million (US$920,000; £560,000) in a couple of nights? It all started with Microsoft – they stopped supporting Windows XP operating system after 8th April, 2014. In other words, even if the ATM trojan horse was discovered one day after the end-of-support date, Microsoft will not release any security patches to plug the threat, period.
The problem is there are up to 95% ATM machines still running on Windows XP. Again, due to cost and profit, banking institutions prefer to close one-eye and pretend as if their ATMs were as secured as the Alcatraz. In the case of Malaysian ATM thefts, the Latin Americans could most likely infected their compact disc with “Backdoor.Padpin” trojan horse. Once the CD is inserted, the ATM reboots and execute the trojan horse, which create the following file:
The Trojan then creates the following registry entries so that it runs every time Windows starts:
The Trojan can delete itself if it fails to gain control of the PIN pad or dispenser. It runs in the background until a specific code is entered on the ATM’s PIN pad. Finally, it then opens a back door on the ATM running Windows XP, allowing an attacker to perform the following actions:
There’s also another famous trojan horse – Backdoor.Ploutus – which was discovered in 2013 to hack ATMs in Mexico. Amazingly, this Ploutus trojan allows cybercriminals to simply send an SMS to the compromised ATM, then walk up and collect the dispensed cash. Here’s how it works:
At the moment, it’s not sure if the Latin American gang used the “Padpin” or “Ploutus” trojan, or another type of variant. If police’ revelation is true, and not just another marketing stunt to convince the public about their efficiency, then the first method could be used. But that does not explain the phone SIM card usage during the ATM hacking operation, as what the police have claim.
Whichever the method used, the Latin American gang did one huge mistake – they forgot to erase their foot trail by deleting their trojan from the ATMs hacked and robbed. Perhaps they were too excited and surprised with the lack of banking security in this country. Either way, the fact that no security guard was deployed to this “goldmines” can only means one thing – the hacking spree is going to continue (*tongue-in-cheek*).
http://www.financetwitter.com/2014/09/here-is-how-malaysian-atms-were-hacked-of-rm3-million-by-latin-americans.html
Created by Tan KW | Aug 27, 2024
Created by Tan KW | Aug 27, 2024
Created by Tan KW | Aug 27, 2024
Created by Tan KW | Aug 27, 2024
Who is going to foot the bill for their 24/7 IT operation? Do you really think they want to foot the bill to start up this 24/7? Most relies on the branch/outlet managers to trigger the alarm. Unfortunately, the branch manager is also a human and need to sleep cause he/she needs to report to work the next morning.
2014-10-02 17:11
EAT MORE NASI LEMAK N RENDANG AYAM, WITH SAMBAL UDANG. THE OUTCOME IS STUPIDITY..THIS SHOWS HOW BACKDATED WE ARE, EVEN LATIN PEOPLE ALSO CAN HACK OUR ATM..THIS IS THE HEIGHT OF STUPIDITY
2014-10-02 20:01
Watch out! These culprits r still at large, since they r so expert in hacking, don't u think they ralso smart in hiding? So many days already, still unable to trace them. Sigh...scary....
2014-10-02 20:38
very well written, may be the solution is to cut down the numbers of ATMs and use the money to employ security guards.
2014-10-03 09:01
Jonathan Keung
very good write up. our police do not have the expertise (tracking) this malware hackers. the banks have to shoulder the blame for trying to cut down the use of manpower. the ATM are supposed to be monitor 24/7 by their IT unit. what happen ?
2014-10-02 08:39