We need your help now
Support from readers like you keeps The Journal open.
You are visiting us because we have something you value. Independent, unbiased news that tells the truth. Advertising revenue goes some way to support our mission, but this year it has not been enough.
If you've seen value in our reporting, please contribute what you can, so we can continue to produce accurate and meaningful journalism. For everyone who needs it.
Sign in. It’s quick, free and it’s up to you.
An account is an optional way to support the work we do. Find out more.
By continuing, you are indicating that you accept our Terms of Service and Privacy Policy.
RESEARCHERS HAVE SHOWN how thieves were able to hack into ATMs and steal cash from a major European bank earlier this year.
The methods used were demonstrated at the Chaos Computing Congress, an annual event which brings together the international hacking community, in Hamburg, Germany.
The BBC reports how the bank noticed several of its ATMs being emptied despite its use of safes to protect the cash inside.
After it increased its surveillance, it found that the thieves were cutting holes in the ATMs to access the machine’s USB ports. They could plug in USB drives that would install malware onto the machine.
Once it was installed, the thieves would patch up the holes, allowing them to target the same machine several times and prevent discovery. Later on, they could return to the ATM and enter a 12-digit code to launch a custom interface, giving them access to the machine.
The researchers found the thieves would focus on the highest value banknotes to reduce the chances of being discovered. However, before they could access the money, a second code was required which would differ each time.
The thief was required to ring a second member and tell them the number displayed before they got the right code.
This was because the thieves didn’t trust each other and were worried that some of their members would go solo and take the money for themselves. If they did nothing for three minutes, the machine would return to their normal state.
To embed this post, copy the code below on your site
Evil genius
His name is John Connor! ;)
nice one doc.
I get the feeling lately that banks really don’t know much about their own ATMs at all.
You’d be right about that. ATMs are typically assembled, installed, maintained, repaired, and stocked by 3rd party companies.
I think banks should be held responsible for anyone’s money that goes missing through ATMs. After all the machines are their property.
Never knew an atm machine had usb ports.
Everything these days have USB ports.
Me neither, and I often load one up.
@Simon, many ATM’s run Microsoft Windows and use standard PC components. From time to time you may even come across an ATM rebooting and you’ll see the screen going through the same startup process as your regular PC.
So if you are told you dont have enough money can you keep turning it off and on again? Try Ctrl+Alt+Del then Euro sign for loads of money :-)
I dont !
ATMs dont have a Keyboard.
I would like to see how this is done purely for educational purposes :D.
3 years old, but quite relevant.
http://www.youtube.com/watch?v=Ss_RWctTARU
The banks rob us without any crimes being committed it would appear.
Evil C…ts.
I went to withdraw cash from an ATM recently and it displayed the message “insufficient funds available”.
I wondered is that me or the bank they’re referring to.
How could anyone dislike this comment?
Too dumb to get the joke Stephen.
No, it’s an old joke
Every time a banking article comes up someone will post that comment. . It’s getting a bit old these days.
Banks are robbing ba@tards. AIB charge you for everything these days. Charge for using a teller, charge for logging into online banking, charge for using your debit card, charge for using non AIB ATM. It’s my bloody money, I should start charging them for holding onto it for me…
@david garland:
Why not just leave enough money in your account to cover direct debit and standing order payments and withdraw all the rest using cash to pay day to day purchases and expenses. Can we trust the banks or the government not to try to take some of our money sooner or later just like Cypress?
John, that will soon be a thing of the past. They are trying to remove paper money so we will be paying a fee for each click of the terminal.
Move to permanent tsb
There’s a very simple solution to this David, it’s called moving bank!
@Jason Bourne:
“They are trying to remove paper money”
When that happens we should try and barter with people as much as possible. There’s no VAT, Income Tax etc. on a barter and it’s untraceable!
David, funny how people want everything from Banks free of charge. I suppose you feel the Teller behind the counter should be paid nothing, the purchase cost and servicing of ATM units, the cost of processing transactions Dr card & online – Computer mainframe purchase and maintenance and updating. The cost of using other banks Atms. Oh yeah the most recent moan – borrowering money from Banks and having to pay it back.
The banks need to employ them as their security team.
That’s like punching someone so they’ll hire you as their bodyguard! Give jobs to the normal folk who are actually asking for work rather than just taking hard earned cash from others.
The boys around me were saying that they reckon they would still prefer the old JCB than the USB to remove the money from the ‘hole in the wall’ ! A bit messier,but way quicker
Yeah agree. Once the hydraulics is operating ok should be no prob.
Without the banks I wouldnt have my massive house ! The banks lended me loads of money for it and guess what? I have no intention of paying it back, sorry Anglo !!
John – No need to apologise to Anglo, you don’t owe them the money you owe the people who bailed them out the money now.
Fair play to the hackers, I hope there are no prosecutions.
If it happened to banks in Ireland, it would be us taxpayers footing the bill
If someone kicks you up the ar$e, I say fair play to them and I hope there are no prosecutions either :-D
Happy New Year!
This article appeared yesterday on the BBCs news we page almost word for word! At least they should have been credited for it.
“Churnalism”
Alan those specs of yours need cleaning
“The BBC reports how the bank noticed several of its ATMs being emptied despite its use of safes to protect the cash inside.”
It’s there, in the article,
I can’t slag my bank off. They open 7 days a week until 7 every day. Going in to the branch is unlike any banking experience you’ve ever had. You are meet at the door by a greeter who walks you to the counter. Gets you a coffee if it’s busy and NO bank charges.
Oh and I was given my atm card the day I joined, they say me at a desk and went through the online login process step by step and gave me £3 to buy a cup of coffee. They are called metro bank. Pity they are not in Ireland
Krebsonsecurity.com might hopefully do an in-depth article on this for his blog, great site for keeping uptown date on ATM Security along general computer security.
It’s a very basic computer behind the atm which runs the atm software so like any computer it has usb ports. The computer itself usually runs windows xp.
Windows CE more like, a ripped down version.
Also not all PC’s have USB’s I work for a company that still uses windows 3.11 and NT and these run on machines nearly as old as me. The floppy drive is still big where I work, and I have a few jazz drives still in use too. LOL
I’ve seen one rebooting NT4 before. As a security professional it boggles my mind that they don’t have application whitelisting. If there ever was a use case for it….
you’d be surprised how many banking systems still use NT and 3.11, very surprised.
Not surprised at all. That’s one of the main target markets for our application whitelisting solution. Also, XP is joining that band. Even if they don’t use application control; device control should be used as a minimum. I’ve worked on a massive cleanup of an air gapped network riddled with conficker because they didn’t use device control.
There is still some Novell 3.12 lurking and RBS still have the odd MS DOS prog still running.
Not surprised they have usb ports..surprised they can be accessed from the front of the machines..bad design?
Just smarter thieving sc#m bags
There was a Java.exe error on an overhead sign on the M50 today.
Did i not read this story here last week already ?
Hi Vlad. We meet again. Heard they had to get a plasterer, carpenter and Brick layer to repair the ATM Lobbies.
AIB switched to Linux some years back as it is more secure than Windoze. I believe it was due to their CEO or other high ranking executive being unable to get money from an ATM at Dublin Airport, maybe they switched back, I dunno. The reason the others stick with windoze is because they like fancy graphics and security of your money comes way down the list
This is nothing more than a nice story. Its untrue. Next time you’re in your local AIB take a look at the computers they use, they’re Windows OS.
‘Plug and Pay’
As dar as I’m aware if an ATM Machine unit is in any way interfered with (Esp by cutting/drilling a hole n2 it) an alarm is triggered to alert the bank and the ATM automatically clises down. Cant understabd how these banks were ripped off?. ?
Windows NT
have your say