Cash machines could be mass-hacked in global cyber attack, FBI warns
Cash machines could be mass-hacked in global cyber
attack, FBI warns
By Natasha Bernal 13 AUGUST 2018 • 2:06PM
Banks have been warned of an imminent threat that their
cash machines could be mass-hacked by cyber criminals.
In a confidential alert on Friday, America's Federal
Bureau of Investigation told international banks that criminals are plotting a
concerted global malware attack on cash machines in the next few days.
The FBI issued a warning about a highly choreographed
fraud scheme known as an ATM "jackpotting", in which crooks hack a
bank or payment card processor and use cloned cards at cash machines around the
world to take out millions in just a few minutes.
UK-based banks with large international operations, such
as HSBC and Barclays, are among those thought to have been made aware of the
threat.
“The FBI has obtained unspecified reporting indicating
cyber criminals are planning to conduct a global Automated Teller Machine (ATM)
cash-out scheme in the coming days, likely associated with an unknown card
issuer breach,” the FBI warning said, according to Krebs on Security, which
originally reported the alert.
The method usually involves physical access to a cash
machine using specialised electronics and malware to take over the system and
force it to dispense cash until it is empty.
Andrew Bushby, UK director at Fidelis Cybersecurity,
said: “UK banks are a likely target – and this latest ‘ATM cash-out blitz’ will
no doubt send shockwaves to financial institutions."
He added: "Whilst the financial services industry is
heavily regulated, it doesn’t make banks immune from being attacked by
cybercriminals... UK banks need to urgently take a look at their security
posture."
Smaller, independent banks are considered the most
vulnerable to such attacks, according to NCC Group, a cyber-security
consultancy firm.
Ollie Whitehouse, global chief technology officer at NCC,
said that criminals tend to target smaller banks that issue debit cards but
which may have less stringent security systems.
"It's a symptom of organised crime becoming more
capable, as they [criminals] become emboldened they are able to do these orchestrated
activities," he said.
In one incident in Thailand in 2016, thieves made off in
minutes with 12 million baht or about £280,000 from cash machines by targeting
ATMs run by Government Savings Bank, a state-owned Thai bank based in Bangkok.
In another case in the US, criminals siphoned about
$570,000 in cash from ATMs operated by
the National Bank of Blacksburg in two
separate attacks in 2016 and 2017.
Ross Brewer, a cyber security expert with LogRhythm,
said: "This case may have been identified in the US, however it is a
global attack and, if successful, has the potential to have widespread
implications. UK banks should be concerned and need to be putting measures in
place that ensure they can identify anomalous activity that could indicate the
start of this attack."
Cyber criminals typically steal credit card data to
create fraudulent copies of legitimate cards on reusable magnetic strip cards,
the FBI warned. At a pre-determined time, the fellow conspirators withdraw
account funds from ATMs using these cards and alter bank balances to force a
cash machine to dispense all of its money.
According to Krebs on Security, the FBI urged banks to
review the way they handle security internally, such as implementing strong
passwords and two-factor authentication using a physical and digital token.
Criminals have worked on varying methods of stealing
credit card information when customers use credit card machines, mostly
creating "skimmers" that copy card details from individual customers.
These machines tend to fit into the ATM's card slot to read the magnetic code
embedded in the black strip of a bank card, while allowing the machine to
function as normal to avoid raising suspicion.
The National Cyber Security Centre (NCSA) recommends that
all banks use up to date and supported operating systems and software, deploy
critical security patches as soon as possible and use an anti-virus solution
that scans new files and can regularly check for vulnerability in the network.
It also recommends banks to implement an application whitelisting technologies,
which earmarks programmes that are safe to use, to prevent malware.
A NCSC spokesman said that it is working closely with the
financial service sector to make sure that their platforms are as secure and
resilient as possible.
"By sharing our experiences of exposure to cyber
incidents, the NCSC raises awareness across the board and improves the nation's
cyber defences," the spokesman said.
The Financial Conduct Authority and the National Security
Agency have declined to comment. The FBI
was approached for comment.
Comments
Post a Comment