WEBVTT
00:00:09.460 --> 00:00:15.340
everyone, I think, knows ATMs, used ATMs
00:00:15.340 --> 00:00:20.180
and our security researchers there
00:00:20.180 --> 00:00:28.700
have something very interesting to tell us about electronic bank robberies
00:00:28.700 --> 00:00:39.634
and because them, please welcome our two security researchers with a very warm applause
00:00:46.820 --> 00:00:48.100
tw: are we on?
00:00:48.100 --> 00:00:49.099
okay, well
00:00:49.114 --> 00:00:51.540
welcome to our little talk here
00:00:51.540 --> 00:00:54.100
and thanks for the introduction
00:00:54.100 --> 00:00:58.140
as the angel said, I guess everybody knows what an ATM is
00:00:58.140 --> 00:01:02.600
it's basically used by people to dispense money from their accounts
00:01:02.600 --> 00:01:06.180
either because they live in countries like this one
00:01:06.180 --> 00:01:09.260
where you really don't use credit cards to pay
00:01:09.260 --> 00:01:13.940
or because you don't wanna be tracked, right?
00:01:13.940 --> 00:01:19.600
we're gonna tell a little war story here
00:01:19.600 --> 00:01:22.459
and that's a case of ATM hacking
00:01:22.459 --> 00:01:26.980
a real world incident that occured this year
00:01:26.980 --> 00:01:29.620
and you wanna remember this number here
00:01:29.620 --> 00:01:35.420
because that's how you enable the hacked system
00:01:35.420 --> 00:01:37.460
in case it's infected
00:01:37.460 --> 00:01:41.380
and I'm gonna hand over to my co-speaker here
00:01:41.380 --> 00:01:44.740
to tell you about the first few things here
NOTE Paragraph
00:01:44.740 --> 00:01:48.700
sb: yeah, okay, so let's just have a quick look
00:01:48.700 --> 00:01:51.500
what do we have in a cash machine
00:01:51.500 --> 00:01:54.100
so of course we have a safe
00:01:54.100 --> 00:01:55.939
that's where we want to get in
00:01:55.939 --> 00:01:57.980
there's the money, we want to spend
00:01:57.980 --> 00:02:00.980
so of course we have a normal computer
00:02:00.980 --> 00:02:02.900
it's like a desktop computer
00:02:02.900 --> 00:02:06.380
mostly it's running a normal operating system
00:02:06.380 --> 00:02:08.779
most likely it's Windows XP
00:02:08.779 --> 00:02:16.504
and with just a few different manufacturers that build the teller machines
00:02:16.504 --> 00:02:19.214
and, yes
00:02:19.214 --> 00:02:22.420
we as user, we use a common user interface
00:02:22.420 --> 00:02:25.700
it's just a screen - most likely it's a touchscreen
00:02:25.700 --> 00:02:28.300
or we have then the EPP number pads
00:02:28.300 --> 00:02:32.140
where we put the PIN number for our card
00:02:32.140 --> 00:02:34.220
tw: one thing I would like to add to this slide
00:02:34.220 --> 00:02:37.140
you see the picture on the right hand side
00:02:37.140 --> 00:02:41.780
that's a photo we took yesterday when we arived here at Hamburg main station
00:02:41.780 --> 00:02:46.780
and it's interesting, because this is the state hacked ATMs are usually in
00:02:46.780 --> 00:02:49.620
befor the bad guys go there and cash out
00:02:49.620 --> 00:02:55.500
I don't know - maybe this one is infected, too
00:02:55.500 --> 00:03:00.260
sb: this is not the first ATM hacking, of course
00:03:00.260 --> 00:03:08.420
the most famous one was from Barnaby at the Black Hat in 2010
00:03:08.420 --> 00:03:12.340
you see in the screenshot here
00:03:12.340 --> 00:03:15.340
this was the user interface of his malware
00:03:15.340 --> 00:03:20.740
so from the functionality it's quite alike
00:03:20.740 --> 00:03:24.500
but not as nice
00:03:24.500 --> 00:03:32.420
tw: has anybody in the room looked at this Ploutus thing by any chance?
00:03:32.420 --> 00:03:34.860
no...
00:03:34.860 --> 00:03:41.500
sb: okay, so of course we have a lot of POS malware
00:03:41.500 --> 00:03:43.620
from mobile terminals
00:03:43.620 --> 00:03:46.540
to steal just sensitive information
00:03:46.540 --> 00:03:49.820
like the credit card data or paymant data or something
00:03:49.820 --> 00:03:54.220
and the most famous ones this year even was the Ploutus malware
00:03:54.220 --> 00:03:57.260
probably you've heard about it - quite famous
00:03:57.260 --> 00:04:01.180
we had a quick look at Ploutus, too
00:04:01.180 --> 00:04:03.140
it was written in .NET
00:04:03.140 --> 00:04:06.500
from the functionality it's similar or the same
00:04:06.500 --> 00:04:14.660
but not as advanced
00:04:14.660 --> 00:04:19.380
why are we standing here and talking about this case?
00:04:19.380 --> 00:04:22.460
we had an incident
00:04:22.460 --> 00:04:27.200
a bank, they discovered, they had a lot of
00:04:27.200 --> 00:04:30.740
empty teller machines and they started to
00:04:30.740 --> 00:04:35.100
work in investigation for themselves
00:04:35.100 --> 00:04:40.420
just a little bit of forensics and it was just limited success
00:04:40.420 --> 00:04:45.820
but yeah, they had to do something about it and they tapped up surveillance
00:04:45.820 --> 00:04:50.180
and improved monitoring
00:04:50.180 --> 00:05:04.820
and they started to discover that the infection was conducted via an USB stick
00:05:04.820 --> 00:05:11.420
they get to mange to arrest the guy and to secure this USB stick
00:05:11.420 --> 00:05:16.980
and on the USB stick we found actually that malware and started to examine that
00:05:16.980 --> 00:05:19.260
tw: yeah so to re-address that, before we go on
00:05:19.260 --> 00:05:23.980
what they did was: they figured "okay there's something going on with our ATMs"
00:05:23.980 --> 00:05:28.180
and they improved their surveillance technology, if you will
00:05:28.180 --> 00:05:32.420
and then saw that guy trying to cash out from one of the hacked machines
00:05:32.420 --> 00:05:34.620
and then they went there, arrested the guy
00:05:34.620 --> 00:05:38.540
and confiscated the USB thumb drive that he was carrying
00:05:38.540 --> 00:05:43.600
and that's where we started our analysis
00:05:43.600 --> 00:05:49.940
right
00:05:49.940 --> 00:05:54.220
sb: they plugged in a USB stick
00:05:54.220 --> 00:05:59.140
they broke a small part of the chassis
00:05:59.140 --> 00:06:03.460
it's just PVC, so it's not hard to break that
00:06:03.460 --> 00:06:07.580
and they plugged in a USB device and forced the ATM to reboot
00:06:07.580 --> 00:06:10.260
so you can do that by cutting the power off
00:06:10.260 --> 00:06:15.260
or putting down the LAN interface or plug it out
00:06:15.260 --> 00:06:22.340
they forced the ATM to reboot and therefore to reboot from the USB device
00:06:22.340 --> 00:06:28.380
and what we found on the USB device was just a simple image of a Hiren boot CD
00:06:28.380 --> 00:06:30.540
everyone can just download that
00:06:30.540 --> 00:06:35.180
and within that Hiren boot CD it's just a mini XP running
00:06:35.180 --> 00:06:41.900
and you have a folder where you can just put customer executables
00:06:41.900 --> 00:06:48.460
that will automatically be started when the XP is booted
00:06:48.460 --> 00:06:53.820
within this customer section we just found our malware
00:06:53.820 --> 00:07:00.460
it was a batch that was called hack.bat
00:07:00.460 --> 00:07:02.380
just very nice
00:07:02.380 --> 00:07:07.620
so actually we thought that this is probably a fake
00:07:07.620 --> 00:07:11.460
because they just wanted us to examine the wrong file
00:07:11.460 --> 00:07:13.180
to save some time
00:07:13.180 --> 00:07:14.940
because it was just that obvious
00:07:14.940 --> 00:07:18.540
you will have a look at bat script afterwards
00:07:18.540 --> 00:07:21.100
so you can see what I mean
00:07:21.100 --> 00:07:23.260
so yes, it's just a mini-XP
00:07:23.260 --> 00:07:26.200
you have the hack.bat
00:07:26.200 --> 00:07:31.180
and this will actually start the real malware
00:07:31.180 --> 00:07:33.780
the so-called atm.exe
00:07:33.780 --> 00:07:43.380
and yeah... what we found then besides the bootable device on the stick were some very interesting files
00:07:43.380 --> 00:07:48.180
they were obviously copied from the infected ATM teller machines
00:07:48.180 --> 00:07:52.180
we can tell that, because there were three different ones that we found there
00:07:52.180 --> 00:07:58.500
and it was very interesting what kind of data were copied from the ATMs
00:07:58.500 --> 00:08:03.220
we found data like system data
00:08:03.220 --> 00:08:09.420
like for example the software hive key
00:08:09.420 --> 00:08:17.500
a lot of files that have cache data, credit card data, payment data, someting like that
00:08:17.500 --> 00:08:22.260
from each of the infected teller machines
00:08:22.260 --> 00:08:26.820
and of course we have our atm.exe
00:08:26.820 --> 00:08:28.860
that was really interesting
00:08:28.860 --> 00:08:36.300
and we take a quick look at the hack.bat script
00:08:36.300 --> 00:08:38.660
so you see, it's very user friendly
00:08:38.660 --> 00:08:44.460
because they implemented a lot of very interesting switches
00:08:44.460 --> 00:08:54.540
we see, right at the top, that he begins to copy the software hive key of the infected machines
00:08:54.540 --> 00:09:01.940
and at first he's checking if the system is already hacked or if he has to do it
00:09:01.940 --> 00:09:04.620
the switches you can see here
00:09:04.620 --> 00:09:09.140
they are all implemented
00:09:09.140 --> 00:09:12.600
the most used one is of course "-hack"
00:09:12.600 --> 00:09:16.620
we see otherwise, that you have some functionality like clear log files
00:09:16.620 --> 00:09:18.340
or get the log files
00:09:18.340 --> 00:09:24.540
this is the part where he copies really interesting data from the teller machines
00:09:24.540 --> 00:09:28.300
of course the question is: why does he do that?
00:09:28.300 --> 00:09:32.420
we answer that later
00:09:32.420 --> 00:09:39.980
it also has got a functionality on it that he can cover his tracks
00:09:39.980 --> 00:09:49.340
you can clear all files of the malware and remove it also
00:09:49.340 --> 00:09:54.700
a little bit more about the installer of the atm.exe
00:09:54.700 --> 00:09:55.940
tw: yeah, thanks
00:09:55.940 --> 00:09:57.780
I mean of course we were curious
00:09:57.780 --> 00:10:00.540
now that we know how the system gets infected
00:10:00.540 --> 00:10:05.600
insert the USB drive, force a reboot and then the batch script runs
00:10:05.600 --> 00:10:09.820
we were curious: how does the actual cash out process work?
00:10:09.820 --> 00:10:11.980
how do you get money out of the thing?
00:10:11.980 --> 00:10:13.740
what we did was
00:10:13.740 --> 00:10:16.499
we took this atm.exe file - the executable
00:10:16.499 --> 00:10:19.260
and reverse engineered that to recover the funtionality
00:10:19.260 --> 00:10:24.739
and the next couple of slides talk about what we found in this executable
00:10:24.739 --> 00:10:27.200
first of all
00:10:27.200 --> 00:10:30.780
the atm.exe is a UPX packed thing
00:10:30.780 --> 00:10:33.420
UPX is one of the standard packers
00:10:33.420 --> 00:10:38.140
you can easily unpack the original code again
00:10:38.140 --> 00:10:41.580
and then we came across an interesting fact
00:10:41.580 --> 00:10:44.900
so we unpacked it and loaded it up into our analysis tools
00:10:44.900 --> 00:10:46.940
what you can see on the right hand side
00:10:46.940 --> 00:10:49.660
it's a little bit blurred, but we hope you can still read it
00:10:49.660 --> 00:10:53.300
is IDA Pro, that probably many of you are familiar with
00:10:53.300 --> 00:10:56.820
one of the state-of-the-art disassemblers
00:10:56.820 --> 00:10:59.580
so we loaded that file up into IDA Pro, took a look at the code
00:10:59.580 --> 00:11:02.600
and then we discovered something interesting
00:11:02.600 --> 00:11:07.460
we discovered that the original executable contains a resource
00:11:07.460 --> 00:11:10.140
if you are a little bit familiar with the PE format
00:11:10.140 --> 00:11:12.780
the executable file format on Windows systems
00:11:12.780 --> 00:11:17.380
you might know that there are containers that you can use to store additional data
00:11:17.380 --> 00:11:19.200
or attatch data to a binary
00:11:19.200 --> 00:11:20.418
they are called resources
00:11:20.418 --> 00:11:24.460
so this binary had a resource and there was some encrypted data in there
00:11:24.460 --> 00:11:30.860
which turned out to be a DLL that contains the actual malicious functionality
00:11:30.860 --> 00:11:35.220
and the interesting thing is that this resource is XOR-encrypted
00:11:35.220 --> 00:11:38.700
now XOR is not a particularly strong encryption scheme
00:11:38.700 --> 00:11:41.780
but never the less, if the key is long enough
00:11:41.780 --> 00:11:43.180
like 4 bytes in this case
00:11:43.180 --> 00:11:45.180
I mean you can still probably brute-force it
00:11:45.180 --> 00:11:47.260
but well, you know
00:11:47.260 --> 00:11:54.620
we figured that every executable that's deployed onto an ATM has the resource
00:11:54.620 --> 00:12:01.580
encrypted with a key that is derived from the volume serial
00:12:01.580 --> 00:12:04.780
which is an ID that is assigned to a hard drive when it's formatted
00:12:04.780 --> 00:12:06.420
by the operating system
00:12:06.420 --> 00:12:13.460
that means that every executable that's deployed onto an ATM is taylored specifically for this ATM
00:12:13.460 --> 00:12:17.620
so it's not mass-malware that you can install on any ATM
00:12:17.620 --> 00:12:21.830
each executable only runs one one very specific ATM
00:12:21.830 --> 00:12:23.580
and that's interesting
00:12:23.580 --> 00:12:29.500
I mean of course that raises the question: How do they get this ID in the first place?
00:12:29.500 --> 00:12:32.460
How do they create this binary with the encrypted resource?
00:12:32.460 --> 00:12:35.140
Where do they get the volume serials from?
00:12:35.140 --> 00:12:36.740
and there are basically two options
00:12:36.740 --> 00:12:38.340
I mean we don't have the answers to these questions
00:12:38.340 --> 00:12:40.100
but there are only two options
00:12:40.100 --> 00:12:46.900
one is: they go to the ATMs the first time, run their stuff
00:12:46.900 --> 00:12:50.200
and extract the volume serial ID from the system
00:12:50.200 --> 00:12:53.420
then go home, prepare the malware and then come back to infect the system
00:12:53.420 --> 00:12:56.410
which seems kind of risky, because
00:12:56.410 --> 00:12:59.530
if you get caught while doing this... well then
00:12:59.530 --> 00:13:01.010
you'll lose something
00:13:01.010 --> 00:13:04.380
the other option is...
00:13:04.380 --> 00:13:08.330
we'll leave that to your imagination
00:13:14.590 --> 00:13:16.200
so what we did
00:13:16.200 --> 00:13:25.580
what you see here on the right hand side is some code that is executed after the XOR-decryption of the resource
00:13:25.580 --> 00:13:29.300
and if you look closely enought you can see in the first basic block up there
00:13:29.300 --> 00:13:33.200
it checks if the first byte of the decrypted data is an "M"
00:13:33.200 --> 00:13:36.580
and then the next one checks if the next byte - the second byte - is a "Z"
00:13:36.580 --> 00:13:40.580
which is part of the PE file header - MZ header
00:13:40.580 --> 00:13:45.380
so we figured: okay, this is probably an executable
00:13:45.380 --> 00:13:47.700
and that's how we recovered the original code
00:13:47.700 --> 00:13:50.340
we assumed that this is an executable and then
00:13:50.340 --> 00:13:52.420
you can call it a known plaintext attack or something like that
00:13:52.420 --> 00:13:57.860
we reverted the XOR-encryption and recovered the DLL
00:13:57.860 --> 00:14:01.900
and after this happened, of course
00:14:01.900 --> 00:14:06.220
the dropper runs some checksumming code
00:14:06.220 --> 00:14:16.500
to verify that the extracted and decrypted code is actually the DLL it wants to run
00:14:21.740 --> 00:14:24.300
so after we recovered this malicious DLL
00:14:24.300 --> 00:14:26.380
we took a closer look at that one
00:14:26.380 --> 00:14:33.260
and it's dropped into this path up there under the system directory
00:14:33.260 --> 00:14:38.180
and the value in the squared brackets over there is again derived from the volume ID
00:14:38.180 --> 00:14:40.820
so if you come across one of these DLLs
00:14:40.820 --> 00:14:42.820
you can take a look at the file name
00:14:42.820 --> 00:14:45.900
and that's linked to the ATM it's supposed to run on
00:14:45.900 --> 00:14:48.140
because of the naming scheme here
00:14:48.140 --> 00:14:53.200
so that's how - and of course I mean you can see all of that in the code
00:14:53.200 --> 00:14:56.600
that the second value there is hard-coded
00:14:56.600 --> 00:15:03.460
that's how we figured: okay this sample was supposed to run on an ATM with this volueme ID
00:15:03.460 --> 00:15:06.260
and then we came across something else
00:15:06.260 --> 00:15:08.460
something that's as interesting
00:15:08.460 --> 00:15:13.460
this DLL, or the malware in general writes a log file
00:15:13.460 --> 00:15:17.180
and stores this on the USB drive that's used for the infection process
00:15:17.180 --> 00:15:19.073
and that's pretty verbose
00:15:19.073 --> 00:15:20.966
if you look at this
00:15:20.966 --> 00:15:22.860
again we have to apologize that's it a little blurry
00:15:22.860 --> 00:15:25.700
but there you can see
00:15:25.700 --> 00:15:28.540
it's basically what is executed when the batch script runs, right?
00:15:28.540 --> 00:15:31.660
there is a file name up there
00:15:31.660 --> 00:15:35.980
if you can see that 978-blablabla DLL and some others
00:15:35.980 --> 00:15:44.380
and suprisingly this log file contained information about three other infections that took place
00:15:44.380 --> 00:15:48.820
so we switch to the next slide
00:15:48.820 --> 00:15:50.820
with that information we can say
00:15:50.820 --> 00:15:54.900
we have information that these guys infected at least four ATMs
00:15:54.900 --> 00:15:57.200
the ones where we had that DLL for
00:15:57.200 --> 00:15:58.780
and then these other three
00:15:58.780 --> 00:16:01.860
that we recover from the log file
00:16:01.860 --> 00:16:04.780
log file - again - is XOR-encrypted, but the key is hard-coded
00:16:04.780 --> 00:16:08.700
so we could recover it from the code and then decrypt the log file and read it
00:16:08.700 --> 00:16:11.900
this is an abbreviated version
00:16:11.900 --> 00:16:13.900
the most interesting lines from the log
00:16:13.900 --> 00:16:18.340
you can see that these ATMs run in fact Windows XP
00:16:18.340 --> 00:16:19.520
yeah...
00:16:21.940 --> 00:16:29.540
sb: what probably is quite intersting here is that we have information about three different teller machines
00:16:29.540 --> 00:16:31.940
that were infected with this USB device
00:16:31.940 --> 00:16:37.340
in clear text and we have it additionally in this somehow encrypted log file
00:16:37.340 --> 00:16:41.740
so the question is: Why do we have that twice?
00:16:41.740 --> 00:16:43.380
Why do we have this log file?
00:16:43.380 --> 00:16:45.260
And why didn't they remove that files?
00:16:45.260 --> 00:16:50.860
actually for every new infection they have to build up a new exe device
00:16:50.860 --> 00:16:55.600
which is encrypted with the volume serial ID from this machine
00:16:55.600 --> 00:16:58.200
and they would have enough time to clear that up
00:16:58.200 --> 00:16:59.580
but they didn't do it
00:16:59.580 --> 00:17:04.490
so furthermore the question broke: Why didn't they?
00:17:09.220 --> 00:17:12.860
tw: okay, now in this part we wanna talk a little bit more about the actual payload
00:17:12.860 --> 00:17:17.500
the malicious code that's executed on the compromised ATM
00:17:17.500 --> 00:17:20.030
you know, the interesting bit
00:17:21.140 --> 00:17:25.260
what you can see here is a list of some facts that we discovered
00:17:25.260 --> 00:17:29.500
again this file contains some encrypted resources
00:17:29.500 --> 00:17:33.260
this time they're encrypted with the static key that you see up there
00:17:33.260 --> 00:17:37.700
so by looking at the code we obtained this key and could easily recover the resources
00:17:37.700 --> 00:17:43.138
and they contained images like the one you see on the right hand side, up there
00:17:43.138 --> 00:17:48.940
obviously stuff they wanted to display on the ATM screen, right?
00:17:48.940 --> 00:17:52.820
we changed the coloring scheme and some other stuff here a little bit
00:17:52.820 --> 00:17:55.580
because we don't wanna disclose the target here
00:17:55.580 --> 00:18:00.260
yeah that's what they store in these resources
00:18:00.260 --> 00:18:04.260
another thing that was in there, is this sdelete tool from Sysinternals
00:18:04.260 --> 00:18:08.180
maybe some of you are familiar with that
00:18:08.180 --> 00:18:10.980
a publicly available tool for secure file deletion
00:18:10.980 --> 00:18:16.200
so you know, you override the file with specific byte patterns before you remove it
00:18:16.200 --> 00:18:19.380
and they used that to remove forensic artefacts
00:18:19.380 --> 00:18:21.300
forensic traces from the system
00:18:21.300 --> 00:18:23.300
for example when they're uninstalling the malware
00:18:23.300 --> 00:18:25.860
because you can also uninstall it from an ATM
00:18:25.860 --> 00:18:30.940
but in case this fails for whatever reason, they have some backup code in the malware
00:18:30.940 --> 00:18:34.780
some backup secure undelete code that does basically the same stuff
00:18:34.780 --> 00:18:37.540
it overwrites the data first and then it deletes the file
00:18:37.540 --> 00:18:40.420
so it's kinda interesting that it put a lot of effort into
00:18:40.420 --> 00:18:42.420
covering up their, you know
00:18:42.420 --> 00:18:45.540
hiding their traces on the system
00:18:45.540 --> 00:18:47.100
and by the way
00:18:47.100 --> 00:18:49.200
we will give you a demo in a few minutes
00:18:49.200 --> 00:18:51.900
and show you the whole process
00:18:51.900 --> 00:18:54.260
how you interact with an infected ATM
00:18:54.260 --> 00:18:57.500
you will see the other screens as well
00:19:01.860 --> 00:19:07.380
then of course for most malware it's important to become persistent on the infected system
00:19:07.380 --> 00:19:13.780
because when it reboots for whatever reason, you want the malware to automatically load again
00:19:13.780 --> 00:19:27.030
and these guys do that by writing the drop DLL into the AppInit DLLs value in the windows registry
00:19:27.030 --> 00:19:29.340
for those of you, who are not familiar with the value
00:19:29.340 --> 00:19:34.860
you can specify libraries in there that are loaded into every process that starts up
00:19:34.860 --> 00:19:39.700
so by this you make sure that the malicious DLL is loaded into every proess that starts
00:19:39.700 --> 00:19:42.910
within the current logon session at least
00:19:43.980 --> 00:19:48.180
what you see down there is some decompiled source code
00:19:48.180 --> 00:19:51.580
basically the main function of the malware
00:19:51.580 --> 00:19:53.140
of the DLL
00:19:53.140 --> 00:19:54.980
and what you can see there
00:19:54.980 --> 00:19:58.100
there are several checks running in cash client one
00:19:58.100 --> 00:20:01.140
cash client is the term for the software that controlles the ATM
00:20:01.140 --> 00:20:02.660
that is running on the ATM
00:20:02.660 --> 00:20:04.900
and controls the dispenser and so on
00:20:04.900 --> 00:20:09.140
so it does this check and if this returns true, it starts some routine
00:20:09.140 --> 00:20:14.260
and if some other checks succeed, then it calls some other functions and so on
00:20:14.260 --> 00:20:20.460
basically what's happening here is that the DLL checks the name of the process it's running in
00:20:20.460 --> 00:20:24.340
and then depending on this name it invokes certain functionality
00:20:24.340 --> 00:20:29.940
and we believe that by doing this they implement support for different cash clients
00:20:29.940 --> 00:20:36.580
this line down here, running in lsass.exe is also interesting
00:20:36.580 --> 00:20:40.540
because the DLL is also obviously loaded into
00:20:40.540 --> 00:20:42.340
what's lsass again? local system...
00:20:42.340 --> 00:20:44.860
some windows process
00:20:44.860 --> 00:20:47.300
is also loaded into that one of course
00:20:47.300 --> 00:20:49.660
because of the AppInit thing
00:20:49.660 --> 00:20:54.260
if it's running in this, it doesn't interact with the cash client ATM software at all
00:20:54.260 --> 00:21:00.600
the DLL that's running in there is an event processor
00:21:00.600 --> 00:21:02.860
for example, if you wanna uninstall the software
00:21:02.860 --> 00:21:05.460
you basically create an uninstall event
00:21:05.460 --> 00:21:07.940
and then the instance running in this process here
00:21:07.940 --> 00:21:11.140
handles the event and removes the file and so on
00:21:11.140 --> 00:21:13.140
and cleans up all traces
00:21:13.140 --> 00:21:15.620
sb: what's also quite interesting here
00:21:15.620 --> 00:21:19.100
you can see that later on, when we discover the malware itself
00:21:19.100 --> 00:21:22.100
they have really somthing like a development cycle
00:21:22.100 --> 00:21:24.260
it's really professional made up
00:21:24.260 --> 00:21:31.900
because within the first infections we could find this malicious DLL within this AppInit hive key
00:21:31.900 --> 00:21:37.780
there was an incident where the forensic team could discover it there
00:21:37.780 --> 00:21:39.900
because it's quite obvious, you know
00:21:39.900 --> 00:21:45.420
the AppInit DLL key is very famous for any malware
00:21:45.420 --> 00:21:47.580
that should start at startup
00:21:47.580 --> 00:21:48.900
and they improved it
00:21:48.900 --> 00:21:55.220
so later on, they just added this malicious DLL to the DLLs which are started
00:21:55.220 --> 00:21:56.940
just when the cash client is started
00:21:56.940 --> 00:22:00.580
so it's also started from the startup, but it's not as loud
00:22:00.580 --> 00:22:05.220
so you have to have to search quite deeper to find it
00:22:07.620 --> 00:22:10.260
tw: Where are we? Are we on time? How are we doing?
00:22:10.260 --> 00:22:12.620
How much time do we have left?
00:22:18.420 --> 00:22:19.250
okay, plenty of time
00:22:19.250 --> 00:22:20.420
great
00:22:20.420 --> 00:22:28.180
so we know, how the malware becomes persistent
00:22:28.180 --> 00:22:31.620
we know how it makes sure that it runs on the system
00:22:31.620 --> 00:22:36.900
so it injects this DLL into all these processes
00:22:36.900 --> 00:22:39.700
now of course we wanna know how to interact with it
00:22:39.700 --> 00:22:41.819
because there must be a way of interacting with the malware
00:22:41.819 --> 00:22:50.540
and what we found out by reverse engineering code is that the DLL that's running in the cash client
00:22:50.540 --> 00:22:53.500
installs a hook for keyboard events
00:22:53.500 --> 00:22:57.620
so whenever you press a key on the keyboard which in this case is the num pad
00:22:57.620 --> 00:23:02.940
this is trapped by the malware and processed
00:23:02.940 --> 00:23:05.900
and what they do is, they process only number keys
00:23:05.900 --> 00:23:07.180
for obvious reasons
00:23:07.180 --> 00:23:08.980
because that's the only kind of keys that you can enter
00:23:08.980 --> 00:23:11.780
and if you enter the code that you've seen on the first slide
00:23:11.780 --> 00:23:19.620
you activate a hidden menu that allows you to choose the several options
00:23:19.620 --> 00:23:24.200
that you can use to control the ATM
00:23:27.870 --> 00:23:29.540
but they have implemented an additional measure
00:23:29.540 --> 00:23:34.220
because, you know, it's possible that somebody by accident enters the right 12 digits
00:23:34.220 --> 00:23:37.100
and then suprise this thing pops up
00:23:37.100 --> 00:23:39.500
and you can dispense all the money from the ATM
00:23:39.500 --> 00:23:41.700
of course they don't want that to happen
00:23:41.700 --> 00:23:44.260
so they have implemented a challenge-response scheme
00:23:44.260 --> 00:23:48.300
so when you enter the 12 digit code, the first menu allowes you to say
00:23:48.300 --> 00:23:50.300
present me with a challenge
00:23:50.300 --> 00:23:54.700
and then the malware generates a random or like a secret code
00:23:54.700 --> 00:23:57.460
where the scheme to generate it is secret
00:23:57.460 --> 00:23:59.900
and you have to enter a response
00:23:59.900 --> 00:24:02.140
that's not easy to crack
00:24:02.140 --> 00:24:03.980
what they do in this case
00:24:03.980 --> 00:24:10.100
because of the poor guy who goes to the ATM to cash out is not the brain behind the whole operation
00:24:10.100 --> 00:24:13.660
they're likely to get arrested
00:24:13.660 --> 00:24:17.540
so they probably don't want to transfer the knowledge
00:24:17.540 --> 00:24:21.100
how to generate the response for the challenge to these people
00:24:21.100 --> 00:24:26.140
can you tell the story about the phone calls?
00:24:26.140 --> 00:24:32.660
sb: yeah, actually they had a surveillance video where they could monitor just one of their cash guys
00:24:32.660 --> 00:24:37.380
which just currently had entered the secret 12 digits
00:24:37.380 --> 00:24:43.460
and you can see on this video that he has already one part of this hack view
00:24:43.460 --> 00:24:47.780
and after that he just took a cell phone
00:24:47.780 --> 00:24:52.620
and called somebody and you can see that within that call
00:24:52.620 --> 00:24:59.820
he types another number and right after that, he starts cashing out the teller machines
00:24:59.820 --> 00:25:05.700
that's exactly that challenge-response check, he was talking about
00:25:05.700 --> 00:25:10.300
so this proves that they don't want anything to chance
00:25:10.300 --> 00:25:18.500
they wanna control which teller machine is cached out and exactly when and who does the cash out
00:25:18.500 --> 00:25:24.619
so this may implicate that they don't trust their own people, do they?
00:25:24.619 --> 00:25:30.740
tw: so, I mean we tried to bring you this video where the guy makes the phone call
00:25:30.740 --> 00:25:34.140
but obviously the bank that was targeted here
00:25:34.140 --> 00:25:38.620
they're a little concerned about their identity beeing disclosed
00:25:38.620 --> 00:25:40.620
so unfortunately we couldn't get it
00:25:40.620 --> 00:25:43.620
but, well, you have to trust us on that
00:25:43.620 --> 00:25:46.140
that's how they probably do it
00:25:46.140 --> 00:25:52.660
another thing is that these guys already anticipated that somebody would get a copy of the malware
00:25:52.660 --> 00:25:55.300
and then probably start to reverse engineer it
00:25:55.300 --> 00:25:58.100
and understand how it works
00:25:58.100 --> 00:25:59.780
and of course the worst thing that can happen is
00:25:59.780 --> 00:26:03.700
if somebody recovers the challenge-response functionality in that code
00:26:03.700 --> 00:26:09.260
and then goes to all the hacked ATMs and, you know, jackpots them
00:26:09.260 --> 00:26:11.180
insted of these guys
00:26:11.180 --> 00:26:15.220
so they figured: okay, we need a means to protect that really important code
00:26:15.220 --> 00:26:18.260
and that's not the only part, that's protected
00:26:18.260 --> 00:26:22.500
there are several pieces that are, you know, critical
00:26:22.500 --> 00:26:24.260
so to speak
00:26:24.260 --> 00:26:26.900
so this challenge-response thing is one of them
00:26:26.900 --> 00:26:31.740
and the other parts that are protected is everything that interacts wih the cash client
00:26:31.740 --> 00:26:37.940
so by looking at the code you would never see a direct API call or DLL function call
00:26:37.940 --> 00:26:40.260
into the cash clients libraries
00:26:40.260 --> 00:26:41.860
all of this stuff is protected
00:26:41.860 --> 00:26:46.220
and I'm gonna talk a little bit more about how they do that
00:26:48.230 --> 00:26:51.620
it's a little bit hard to put that...
00:26:51.620 --> 00:26:53.700
to find the right words for it
00:26:53.700 --> 00:26:57.340
we have a picture of that in our mind, but...
00:26:57.340 --> 00:26:59.500
we call that a state machine
00:26:59.500 --> 00:27:04.140
so their obfuscation method is basically control flow obfuscation
00:27:04.140 --> 00:27:08.540
when you look at some code statially, you can see this function is calling that function
00:27:08.540 --> 00:27:11.180
and then this is calling that under this condition and so on
00:27:11.180 --> 00:27:13.300
that's the control flow in the code
00:27:13.300 --> 00:27:16.900
but if you don't wanna disclose that function A is calling function B
00:27:16.900 --> 00:27:19.380
you have to put something in between
00:27:19.380 --> 00:27:21.300
that obfuscates this relationship
00:27:21.300 --> 00:27:25.220
they implemented a state-machine
00:27:25.220 --> 00:27:26.980
that's what we call it
00:27:26.980 --> 00:27:28.580
and this state machine consumes a buffer
00:27:28.580 --> 00:27:31.180
a static buffer that's somewhere in the binary
00:27:31.180 --> 00:27:34.140
and performs some computation on the bytes
00:27:34.140 --> 00:27:37.220
and the result is the address of the function to call
00:27:37.220 --> 00:27:41.980
at some point you say: state machine, here is a buffer
00:27:41.980 --> 00:27:43.460
do your thing
00:27:43.460 --> 00:27:46.300
and then the state machine starts computing the address to call
00:27:46.300 --> 00:27:48.380
or that's only one scenario
00:27:48.380 --> 00:27:51.200
the other scenario is that you wanna compute a certain value
00:27:51.200 --> 00:27:54.600
for example, you enter the response for a particular challenge
00:27:54.600 --> 00:28:01.580
and then the state machine with its functions computes some other value
00:28:01.580 --> 00:28:04.860
that it compares to a challange or something
00:28:04.860 --> 00:28:08.940
and this computation as well is protected by the state machine
00:28:08.940 --> 00:28:13.178
and you can see a little snippet of that on the right hand side
00:28:13.178 --> 00:28:17.380
again, if you can read it, you can see there's a lot of junk code in there
00:28:17.380 --> 00:28:21.600
those of you who are familiar with polymorphism
00:28:21.600 --> 00:28:23.540
polymorphic malware or other stuff like that
00:28:23.540 --> 00:28:28.140
you will immediately see that some of the functions in there are total garbage
00:28:28.140 --> 00:28:31.500
like for example, the SUB AL e1
00:28:31.500 --> 00:28:36.500
and then, you know, some values are subtracted from a register first and then added again
00:28:36.500 --> 00:28:38.740
so it's basically doing nothing
00:28:38.740 --> 00:28:44.700
this junk code stuff is one method of obfuscation
00:28:44.700 --> 00:28:47.740
and the other is, what's usally called "spaghetti code"
00:28:47.740 --> 00:28:49.620
you know, it's jumping back and forth
00:28:49.620 --> 00:28:52.500
and calling subroutines all over the place
00:28:52.500 --> 00:28:56.980
and I think it's really hard or next to impossible to reverse engineer that
00:28:56.980 --> 00:28:59.460
at least we spent several days
00:28:59.460 --> 00:29:00.740
weeks even
00:29:00.740 --> 00:29:02.900
and we couldn't really figure out how the state machine works
00:29:02.900 --> 00:29:04.220
and that's really the purpose
00:29:04.220 --> 00:29:08.380
but fortunately for us there was a solution for this
00:29:08.380 --> 00:29:12.700
and that is what the little colored bar at the bottom of the slide shows you
00:29:12.700 --> 00:29:17.500
again, this is something that IDA Pro generates for you, this disassembler tool
00:29:17.500 --> 00:29:20.300
you can see the blue stuff at the front
00:29:20.300 --> 00:29:24.780
that's the real code of the malware
00:29:24.780 --> 00:29:27.100
all of that lives in the code section
00:29:27.100 --> 00:29:28.700
and is at the beginning
00:29:28.700 --> 00:29:31.540
and the green stuff here is library functions
00:29:31.540 --> 00:29:33.978
here we have some data
00:29:33.978 --> 00:29:36.700
and at the end there is some code again
00:29:36.700 --> 00:29:39.100
and suprisingly this is the state machine
00:29:39.100 --> 00:29:42.780
and it's pretty convenient for us that this is somewhere else in the memory layout
00:29:42.780 --> 00:29:43.980
so what you can do is
00:29:43.980 --> 00:29:46.780
you can put a memory break point a the section here
00:29:46.780 --> 00:29:51.740
and by doing this trap every attempt to execute the state machine code
00:29:51.740 --> 00:29:54.140
and then when you're in the state machine
00:29:54.140 --> 00:29:57.660
you put a break point on the original, on the real code, up there
00:29:57.660 --> 00:30:01.800
and you get the exit point of the state machine
00:30:01.800 --> 00:30:05.580
by doing this you can basically treat the state machine as a black box
00:30:05.580 --> 00:30:07.580
you don't care about the calculations at all
00:30:07.580 --> 00:30:12.200
you can still reconstruct the relationship between the calling function and the callee
00:30:12.200 --> 00:30:14.980
okay
00:30:14.980 --> 00:30:23.580
unfortunately we couldn't use this break point method to understand how these value calculations are performed
00:30:23.580 --> 00:30:29.220
but, well, you still can inspect memory and somehow understand a little bit of that somehow at least
00:30:33.260 --> 00:30:38.459
okay now we wanna demo to you how this thing looks like
00:30:38.459 --> 00:30:42.200
unfortunately we don't own an ATM that we can infect
00:30:42.200 --> 00:30:46.710
but we have a virtual machine here that's running the malware
00:30:48.270 --> 00:30:50.500
and we've patched the malware a little bit here
00:30:50.500 --> 00:30:51.900
I think we didn't tell you
00:30:51.900 --> 00:30:54.420
so what's happening is these screens when you enter the secret code
00:30:54.420 --> 00:30:57.180
these screens that you saw on the slide
00:30:57.180 --> 00:31:01.140
they're displayed on a second desktop
00:31:01.140 --> 00:31:03.580
on Windows you can have as many desktops
00:31:03.580 --> 00:31:05.660
like virtual desktops as you want
00:31:05.660 --> 00:31:08.260
and then switch back and forth between these desktops
00:31:08.260 --> 00:31:09.420
so what's happening is
00:31:09.420 --> 00:31:11.180
these screens are displayed on a second desktop
00:31:11.180 --> 00:31:15.300
and then execution switches over
00:31:15.300 --> 00:31:17.940
the displays which is over to this desktop
00:31:17.940 --> 00:31:21.700
so you leave the original ATM display and it's process alone
00:31:21.700 --> 00:31:24.340
you just switch over to your secret menu desktop
00:31:24.340 --> 00:31:27.150
and when you're done, you can switch back
00:31:28.100 --> 00:31:31.140
that's a little difficult to debug
00:31:31.140 --> 00:31:34.620
because when you do that, when you're running in a debugger and using break points and stuff
00:31:34.620 --> 00:31:38.740
and the malware all of a sudden switches to a second desktop
00:31:38.740 --> 00:31:42.200
you can't control the debugger anymore, because it's running on the first desktop
00:31:42.200 --> 00:31:47.740
so we had to patch a few things to make it more convenient for us to demonstrate this
00:31:47.740 --> 00:31:50.880
and that's what we're gonna do now
00:31:56.140 --> 00:31:57.820
can you...?
00:31:57.820 --> 00:32:01.580
so we have this little Windows XP VM
00:32:01.580 --> 00:32:04.140
because we want to be accurate, right?
00:32:04.140 --> 00:32:07.700
and I'm gonna start two processes here
00:32:07.700 --> 00:32:11.580
one is: I have some little batch scripts
00:32:11.580 --> 00:32:17.620
one is the one that simulates the malware running in the lsass process
00:32:17.620 --> 00:32:23.860
and the other one simulates the malware running in the cash client
00:32:23.860 --> 00:32:25.220
this one here
00:32:25.220 --> 00:32:32.200
and let's just presume that this is showing the stardard ATM screen here
00:32:32.200 --> 00:32:34.820
so "Enter your PIN" and stuff like that, okay
00:32:34.820 --> 00:32:36.780
so what we're gonna do now is
00:32:36.780 --> 00:32:40.700
we're gonna enter the 12 digit secret code that we saw on the first slide
00:32:40.700 --> 00:32:44.470
you remember that, right?
00:32:48.310 --> 00:32:52.340
and if you do that, you're presented with this menu here
00:32:58.650 --> 00:33:01.500
do you wanna talk about those values? how that's calculated?
00:33:01.500 --> 00:33:02.900
sb: yeah probably
00:33:02.900 --> 00:33:08.100
so the only thing which is hard coded are the three lines at the bottom here
00:33:08.100 --> 00:33:16.260
and all of the rest is just generated with the actual amounts they find on this ATM
00:33:16.260 --> 00:33:20.540
so the ATMs, they have a lot of loo files which they create
00:33:20.540 --> 00:33:23.980
and they're just saved on the hard drive
00:33:23.980 --> 00:33:25.660
and within that files
00:33:25.660 --> 00:33:31.180
every payment transaction is noted
00:33:31.180 --> 00:33:34.260
what the malware does is
00:33:34.260 --> 00:33:36.740
it requests the newest of that files
00:33:36.740 --> 00:33:41.700
and just pulls the values into that screen
00:33:41.700 --> 00:33:48.140
and so the attacker is presented with the actual value of the amount of money
00:33:48.140 --> 00:33:52.660
and there he can just choose which one he wants to cash out
00:33:52.660 --> 00:33:57.700
so just the 100 bills, or all of them
00:33:57.700 --> 00:33:59.700
this is quite interesting
00:33:59.700 --> 00:34:05.740
we took this screen from an ATM which was already attacked
00:34:05.740 --> 00:34:14.220
there you can see that especially, or only the $100 cash cassette was cashed out
00:34:14.220 --> 00:34:24.500
because, you know how long it takes if you're just cashing out 100 or 200 Dollars or Euros
00:34:24.500 --> 00:34:30.660
and if you can imagine if you have a whole cassette full of money
00:34:30.660 --> 00:34:33.420
that takes a lot of time
00:34:33.420 --> 00:34:43.420
so this is why they most likely just cashed out this cassette with the most valuable input
00:34:43.420 --> 00:34:48.500
tw: so what I can do now is
00:34:48.500 --> 00:34:51.340
I can either press "0" and then I leave that again
00:34:51.340 --> 00:34:55.300
and, you know, ATM shows its standard screen again
00:34:55.300 --> 00:34:57.300
or I press "1"
00:34:57.300 --> 00:35:01.380
I'm gonna do that now, just to show you what's happening
00:35:01.380 --> 00:35:05.420
and now it's challenging me with this code here
00:35:05.420 --> 00:35:09.260
and I have to enter the response
00:35:09.260 --> 00:35:12.660
and yeah, I mean, it's a 6 digit number
00:35:12.660 --> 00:35:14.260
the problem is
00:35:14.260 --> 00:35:17.700
because we're not running on a real ATM, we cannot simulate this here
00:35:17.700 --> 00:35:20.100
so I mean, I can enter a number here
00:35:20.100 --> 00:35:24.900
but even if it would be the right one and it would accept this
00:35:24.900 --> 00:35:29.620
we wouldn't be able to go any further, because some pieces are missing here
00:35:29.620 --> 00:35:33.580
unfortunately... let me restart this
00:35:45.140 --> 00:35:46.980
there we go again
00:35:49.790 --> 00:35:52.419
usually what happens is
00:35:52.419 --> 00:35:54.100
you press "1"
00:35:54.100 --> 00:35:57.200
you get the challenge code
00:35:57.200 --> 00:35:59.420
you call your HQ
00:35:59.420 --> 00:36:00.756
you get the response code
00:36:00.756 --> 00:36:02.182
you enter your response code
00:36:02.182 --> 00:36:05.740
and then you have access to this second level menu, so to speak
00:36:05.740 --> 00:36:08.860
that allows you to actually cash out
00:36:08.860 --> 00:36:12.900
well, as I said, we cannot really do that here
00:36:12.900 --> 00:36:17.200
so we have to simulate the fact that we're authenticated
00:36:17.200 --> 00:36:20.340
we entered the right response code
00:36:20.340 --> 00:36:24.110
for that we patched a little bit in this DLL
00:36:24.110 --> 00:36:27.068
unfortunately we have to wait for three minutes now
00:36:27.068 --> 00:36:29.096
because there is a timeout
00:36:29.096 --> 00:36:33.540
they implemented a timeout as a measure to not leave this screen open
00:36:33.540 --> 00:36:35.600
when, you know, something happens
00:36:35.600 --> 00:36:37.620
the guy has to run off or something
00:36:37.620 --> 00:36:39.620
because police is coming or something
00:36:39.620 --> 00:36:41.380
and then you don't want to leave this on the scren
00:36:41.380 --> 00:36:44.940
so they implemented a timer that fires after three minutes
00:36:44.940 --> 00:36:48.200
and then after three minutes this window is closed
00:36:48.200 --> 00:36:53.580
we patched this timer, that after three minutes the second layer menu is opened instead
00:36:53.580 --> 00:36:57.900
we have to talk a little bit more, until that happens now
00:36:57.900 --> 00:37:01.540
sb: probably about the version number
00:37:01.540 --> 00:37:05.500
cause there you can see, they named their software
00:37:05.500 --> 00:37:10.780
typical software style of course
00:37:10.780 --> 00:37:13.260
with a four digit value number
00:37:13.260 --> 00:37:15.420
so they have really a development cycle
00:37:15.420 --> 00:37:17.200
for this malware
00:37:17.200 --> 00:37:23.300
and they really are improving that with nearly every attack they are doing
00:37:23.300 --> 00:37:27.300
they collect all facts they have, they improve antiforensics
00:37:27.300 --> 00:37:31.500
and build in a little more functionality
00:37:31.500 --> 00:37:36.780
you can really track these changes, they made
00:37:36.780 --> 00:37:39.820
this developement improves
00:37:42.840 --> 00:37:48.780
tw: another thing we can tell you meanwhile is that this challenge code is generated from two things
00:37:48.780 --> 00:37:51.780
again, we don't know how it's generated, we don't know the algorithm
00:37:51.780 --> 00:37:53.620
but we do know the input
00:37:53.620 --> 00:37:56.900
and the two things that are the input to this algorithm
00:37:56.900 --> 00:38:01.620
are an ID that's unique to the ATM
00:38:01.620 --> 00:38:04.600
or the station, whatever you wanna call it
00:38:04.600 --> 00:38:05.660
and a random value
00:38:05.660 --> 00:38:07.300
so there's some randomness in there
00:38:07.300 --> 00:38:11.860
by this you make sure that even if the same random value is chosen
00:38:11.860 --> 00:38:14.380
the codes are different for two different ATMs
00:38:14.380 --> 00:38:18.460
so the guy has to in fact call you and ask for the code
00:38:18.460 --> 00:38:23.580
he cannot, you know, just by accident enter the right thing and take the money for himself
00:38:23.580 --> 00:38:30.520
alright now would be a good time for the timer to fire
00:38:33.490 --> 00:38:34.940
let's see
00:38:34.940 --> 00:38:37.600
okay, I have another story
00:38:37.600 --> 00:38:40.140
the dropper executable
00:38:40.140 --> 00:38:45.900
when something goes wrong, they calculate an error message, an error code
00:38:45.900 --> 00:38:46.980
oh, there we go
00:38:46.980 --> 00:38:50.260
and this error code is derived from the value 1337
00:38:50.260 --> 00:38:52.820
so apparently they think they are leet
00:38:52.820 --> 00:38:57.980
which didn't really stop us from reverse engineering their software
00:39:04.200 --> 00:39:08.260
this screen is like what we showed on the second slide
00:39:08.260 --> 00:39:12.220
which basically says "this terminal is out of order, go to the next one"
00:39:12.220 --> 00:39:14.300
and when you see this
00:39:14.300 --> 00:39:15.860
I mean, two purposes:
00:39:15.860 --> 00:39:22.540
one: others who want to dispense money from the ATM, if they see this, they would not touch it
00:39:22.540 --> 00:39:24.600
and go to another one
00:39:24.600 --> 00:39:27.820
but this also tells you that now you can enter another code
00:39:27.820 --> 00:39:32.660
which turns out to be the same 12 digit sequence that we already know
00:39:32.660 --> 00:39:34.980
to enter the second hidden menu
00:39:34.980 --> 00:39:41.460
and there we go
00:39:41.460 --> 00:39:45.180
this is now the real menu that you can use to control the ATM
00:39:45.180 --> 00:39:49.660
again, you see the first four lines show you how much money for the different bills
00:39:49.660 --> 00:39:51.820
or different notes is in there
00:39:51.820 --> 00:39:53.980
but now you can actually, you know, cash out
00:39:53.980 --> 00:39:55.900
you can dispense that money from the machine
00:39:55.900 --> 00:40:07.900
so for example if I press "1", hopefully I can get the 300 R-Dollars
00:40:07.900 --> 00:40:11.860
or if I press "4", I can get the 50s
00:40:11.860 --> 00:40:18.300
so let me do that now and you can pay attention to the purple line at the bottom
00:40:18.300 --> 00:40:20.700
so I press "4" now
00:40:20.700 --> 00:40:24.740
and it said "wait" or "waiting" or something like that
00:40:24.740 --> 00:40:27.140
and now it says "command has failed"
00:40:27.140 --> 00:40:30.460
which is too bad because I wanted money, but my VM...
00:40:30.460 --> 00:40:32.220
the emulation is not that good
00:40:32.220 --> 00:40:36.600
sb: still didn't get to manage to really cash out some money from that machine here
00:40:36.600 --> 00:40:38.100
tw: that would be nice
00:40:38.100 --> 00:40:40.200
so I could now try to cash out 1, 2, 3, 4
00:40:40.200 --> 00:40:41.900
and always I get this failure message
00:40:41.900 --> 00:40:47.500
but this is where the malware actually interacts with the cash client
00:40:47.500 --> 00:40:54.820
it loads, or resolves the libraries that belong to this cash client and then calls the API functions
00:40:54.820 --> 00:40:58.220
to trigger the dispense functionality
00:40:58.220 --> 00:41:02.340
but the other options at the bottom of the screen are also interesting
00:41:02.340 --> 00:41:04.540
let me show you "7" and "8" first
00:41:04.540 --> 00:41:07.420
and that's why I have this little window open here
00:41:07.420 --> 00:41:08.460
I hope you can see that
00:41:08.460 --> 00:41:10.700
so this is my network connection
00:41:10.700 --> 00:41:13.140
the network devices that are installed
00:41:13.140 --> 00:41:19.600
and as she said, every ATM has a persistentnetwork connection to the bank
00:41:19.600 --> 00:41:22.300
so they can control what's going on and monitor and so on
00:41:22.300 --> 00:41:27.980
so probably before you wanna cash out, you wanna disable the network entirely
00:41:27.980 --> 00:41:30.200
and they can use "7" and "8" to do that
00:41:30.200 --> 00:41:37.300
so let me press "7", you take a look at that window on the right hand side
00:41:37.300 --> 00:41:39.660
you can see, the adapters are disabled now
00:41:39.660 --> 00:41:42.540
and now I'm going to press "8" again
00:41:42.540 --> 00:41:43.900
and now they're enabled again
00:41:43.900 --> 00:41:45.860
that's convenient, right
00:41:45.860 --> 00:41:49.820
so you can disable and enable the network adapters entirely
00:41:49.820 --> 00:41:54.380
if you press "6" you're going back to this mode
00:41:57.700 --> 00:42:01.900
and finally you can also format the system
00:42:04.180 --> 00:42:07.340
I mean obviously because you wanna remove all the traces
00:42:07.340 --> 00:42:11.780
so if I press "5", you see that little screen, that we already know
00:42:11.780 --> 00:42:14.860
from the slide
00:42:14.860 --> 00:42:16.620
they're somewhat cautious here
00:42:16.620 --> 00:42:19.500
again, if you do that, you can either press "0"
00:42:19.500 --> 00:42:21.780
then you get back to the previous menu
00:42:21.780 --> 00:42:25.700
or you can press "9" and confirm that you actually wanna format the system
00:42:25.700 --> 00:42:27.340
and doing that' now
00:42:27.340 --> 00:42:32.660
and again it presents you with a challenge and you have to enter a 6 digit response code
00:42:32.660 --> 00:42:38.340
the algorighm that's used to calculate this here is different from the previous one
00:42:38.340 --> 00:42:41.620
and I mean we figured it out somewhat
00:42:41.620 --> 00:42:46.500
but the funny thing is, that it doesn't actually format the system
00:42:46.500 --> 00:42:49.460
it just uninstalles the malware
00:42:49.460 --> 00:42:53.860
I don't know what the right answer to this is now
00:42:53.860 --> 00:42:56.980
if you enter the wrong one, it keeps asking
00:42:56.980 --> 00:43:00.820
and interestingly you cannot get out of this state anymore
00:43:00.820 --> 00:43:04.580
so if you don't know the right answer, you're trapped in this
00:43:04.580 --> 00:43:08.820
and after three minutes the "out of order" thing is displayed again
00:43:08.820 --> 00:43:13.200
but if you enter the sectet code, you don't have access to the main menu again
00:43:13.200 --> 00:43:15.460
you will always end up in this screen
00:43:15.460 --> 00:43:22.940
so unless you enter the right code here, well, you locked yourself out
00:43:26.880 --> 00:43:27.600
alright
00:43:27.600 --> 00:43:34.220
we wanna conclude with some speculation about the people behind this maybe
00:43:34.220 --> 00:43:36.660
we obviously don't really know who it is
00:43:36.660 --> 00:43:39.740
but, you know, there are some interesting facts
00:43:39.740 --> 00:43:46.200
and after that we'll open it up for questions and, you know, a little Q&A
00:43:46.200 --> 00:43:48.940
sb: what we really can tell for sure
00:43:48.940 --> 00:43:51.260
that they want to make serious money with that
00:43:51.260 --> 00:43:54.340
they put a lot of effort in implementing and investigating
00:43:54.340 --> 00:43:57.180
in coding actually
00:43:57.180 --> 00:44:04.420
they build up quite a big team to do that and they have apparently different roles
00:44:04.420 --> 00:44:06.460
that are strictly assigned
00:44:06.460 --> 00:44:11.420
so every role has his part and is able to do his part
00:44:11.420 --> 00:44:13.660
so it's quite separated
00:44:13.660 --> 00:44:18.860
for sure they have to have profound knowledge about the ATMs
00:44:18.860 --> 00:44:21.620
so most likely they really had one
00:44:21.620 --> 00:44:28.620
to test all these features and to really check whether the coding is correct
NOTE Paragraph
00:44:28.620 --> 00:44:30.380
whether they get any error messages
00:44:30.380 --> 00:44:32.100
something like that
00:44:32.100 --> 00:44:39.300
so either they probably robbed one and reverse engineered the original cash client
00:44:39.300 --> 00:44:41.180
to derive the malware from it
00:44:41.180 --> 00:44:45.420
or they most likely had someone in the inside
00:44:45.420 --> 00:44:48.220
which was just to...
00:44:48.220 --> 00:44:50.460
which had to develop the original cash client
00:44:50.460 --> 00:44:54.460
and therefore really knows exactly how this works
00:44:54.460 --> 00:45:00.380
how it's possible just to trigger a cash out
00:45:00.380 --> 00:45:04.500
without entering a valid card, the PIN code
00:45:04.500 --> 00:45:10.600
circumvent all the security measures that are implemented here
00:45:10.600 --> 00:45:15.700
they have quite good development skills
00:45:15.700 --> 00:45:19.500
so the code is quite sorted
00:45:19.500 --> 00:45:23.340
you see the development cycles
00:45:23.340 --> 00:45:36.820
they implement new features just like the AppInit DLL key stuff and so on
00:45:36.820 --> 00:45:46.860
at least they are capable of protecting the code against people like him
00:45:46.860 --> 00:45:49.900
they're just trying to reverse engineer malware
00:45:49.900 --> 00:45:53.600
and they really try to cover their tracks for forensic investigations
00:45:53.600 --> 00:45:58.820
so they made it really hard to get the pieces together
00:45:58.820 --> 00:46:06.580
to just have a full image of how that finally works together
00:46:06.580 --> 00:46:07.980
tw: alright
00:46:07.980 --> 00:46:11.540
that was almost the last slide
00:46:11.540 --> 00:46:13.580
you guys remember the 12 digits
00:46:13.580 --> 00:46:15.220
from the first slide
00:46:15.220 --> 00:46:18.300
so next time, before you dispense the money from an ATM, enter the 12 digits first
00:46:18.300 --> 00:46:20.740
to make sure that it's not hacked
00:46:20.740 --> 00:46:22.820
right, and if it is hacked
00:46:22.820 --> 00:46:29.600
then you enter this here
00:46:29.600 --> 00:46:31.140
because that uninstalls the malware
00:46:31.140 --> 00:46:41.070
applause
00:46:48.540 --> 00:46:54.420
well then we do a short Q&A, if it's okay for you
00:46:54.420 --> 00:46:57.180
please, everybody that has a question
00:46:57.180 --> 00:47:00.980
please line up on the microphones
00:47:00.980 --> 00:47:04.220
signed with the numbers
00:47:04.220 --> 00:47:20.540
and then we will do a short Q&A from approximately 8 to 10 minutes
00:47:20.540 --> 00:47:22.860
alright, let's start with you
00:47:22.860 --> 00:47:25.100
hi, I have two questions
00:47:25.100 --> 00:47:30.620
the first question is whether they were gathering PIN codes and no strips
00:47:30.620 --> 00:47:32.660
to be able to use them later on
00:47:32.660 --> 00:47:37.700
and the second question is whether the ATM is connected to the Internet through the network connection
00:47:37.700 --> 00:47:40.600
I didn't get all of that
00:47:40.600 --> 00:47:42.380
can the others be a little quiet
00:47:42.380 --> 00:47:45.180
so we have the chance to understand the questions
00:47:45.180 --> 00:47:46.900
sorry, can you please repeat?
00:47:46.900 --> 00:47:52.540
so my first question is whether the PIN codes and this magnetic strip
00:47:52.540 --> 00:47:57.660
or any other information linked to the credit card number is gathered by this malware
00:47:57.660 --> 00:48:02.980
and the second question is wether net network connection gives Internet access to the ATM
00:48:02.980 --> 00:48:06.980
let me answer the first one, and for the second one, I'll refer to her
00:48:06.980 --> 00:48:13.460
so this one could gather information like credit card stuff and so on
00:48:13.460 --> 00:48:14.660
but it doesn't
00:48:14.660 --> 00:48:16.200
not this one
00:48:16.200 --> 00:48:17.980
I didn't get the second question
00:48:17.980 --> 00:48:23.140
second question was: can you access the ATMs over the Internet? is there internet connection?
00:48:23.140 --> 00:48:27.580
no, actually they do not have an Internet connection
00:48:27.580 --> 00:48:30.940
but it is possible to build, so far
00:48:30.940 --> 00:48:35.220
we did that in a test, where we tested an ATM
00:48:35.220 --> 00:48:40.300
you can use this USB connection where they plugged in the bootable device
00:48:40.300 --> 00:48:45.903
and just put an UTMS stick there and then you have an Internet connection
00:48:45.903 --> 00:48:48.348
but by default there is none
00:48:48.348 --> 00:48:51.003
but we did that, yeah
00:48:51.003 --> 00:48:55.700
okay, then let's take number 1
00:48:55.700 --> 00:48:58.460
thank you for your talk
00:48:58.460 --> 00:48:59.900
I have two short questions
00:48:59.900 --> 00:49:03.200
what was the time span between the infection and the cash out?
00:49:03.200 --> 00:49:08.598
and did the attackers try to intercept card data?
00:49:09.298 --> 00:49:11.260
so, the second question is the same as the previous one
00:49:11.260 --> 00:49:14.180
they don't intercept any card data
00:49:14.180 --> 00:49:16.820
they don't gather like credit card information and stuff like that
00:49:16.820 --> 00:49:22.260
they only like jackpot - as Barnaby Jack called it - the ATMs
00:49:22.260 --> 00:49:24.580
they only dispense money from the ATM
00:49:24.580 --> 00:49:27.620
for the first question, what was the first question again?
00:49:27.620 --> 00:49:30.820
what was the time span between the infection and the cash out?
00:49:30.820 --> 00:49:34.580
how much time is between the infection and the actual cash out
00:49:34.580 --> 00:49:40.140
we discovered that were only two to three days
00:49:40.140 --> 00:49:47.180
so they could have any time between that, but they really try to make it short
00:49:47.180 --> 00:49:51.780
and of course they waited for the right time, so right after the recharging
00:49:51.780 --> 00:49:56.540
because thats the point of the most money
00:49:56.540 --> 00:49:59.140
okay, then number 3 please
00:49:59.140 --> 00:50:01.600
hi, thank you for your talk
00:50:01.600 --> 00:50:04.180
question about banking security
00:50:04.180 --> 00:50:08.860
this beeing Windows XP, I missed the part of code signing
00:50:08.860 --> 00:50:12.260
and verified publishers and such
00:50:12.260 --> 00:50:17.070
do banks employ these security measures or not?
00:50:17.900 --> 00:50:19.860
they do have security measures
00:50:19.860 --> 00:50:25.470
but they're only implemented when the XP is running
00:50:25.470 --> 00:50:28.890
so they have whitelisting for applications
00:50:28.890 --> 00:50:31.110
they have monitoring for the process
00:50:31.110 --> 00:50:33.300
and they have an anti-virus
00:50:33.300 --> 00:50:34.540
and of course something like that
00:50:34.540 --> 00:50:37.870
but in essence everyone can dump their own software on it and run it
00:50:37.870 --> 00:50:43.220
there is no whitelist for signatures or publishers, right?
00:50:43.220 --> 00:50:44.580
there is a whitelist
00:50:44.580 --> 00:50:49.940
actually there is, but that was the point why they did that
00:50:49.940 --> 00:50:52.500
via bootable USB stick
00:50:52.500 --> 00:50:58.600
because they wrote this DLL just within the system folder
00:50:58.600 --> 00:51:02.140
and they have a whitelist for applications, but not for the DLLs
00:51:02.140 --> 00:51:05.100
which these applications are using
00:51:05.100 --> 00:51:10.820
I mean, it goes without saying that you can take measures to make the ATMs more secure
00:51:10.820 --> 00:51:12.660
because this is kind of a trivial attack
00:51:12.660 --> 00:51:14.700
and as you said, everybody could do that
00:51:14.700 --> 00:51:16.820
and that's kind of the reason why we're giving this talk
00:51:16.820 --> 00:51:21.350
it's no use in keeping vulnerabilites secret
00:51:21.350 --> 00:51:24.220
they should be like talked about openly
00:51:24.220 --> 00:51:27.260
and then people can go and fix their problems, right
00:51:27.260 --> 00:51:28.300
thank you
00:51:30.090 --> 00:51:36.220
do we have a question from IRC or the community out there?
00:51:37.010 --> 00:51:39.660
yes there was one question coming from IRC
00:51:39.660 --> 00:51:46.200
which was: how to get on the USB printer port to reverse that machine?
00:51:48.100 --> 00:51:50.200
can you repeat the question please?
00:51:50.200 --> 00:51:54.540
how to get on the USB port or printer port to reverse that machine?
00:51:57.700 --> 00:52:01.820
this was just via cutting a hole into the chassis
00:52:01.820 --> 00:52:03.620
so this is just a...
00:52:03.620 --> 00:52:05.700
this is no metal, this is not a safe
00:52:05.700 --> 00:52:08.180
so this is just a plastic
00:52:08.180 --> 00:52:10.200
and there you can just cut a hole in it
00:52:10.200 --> 00:52:13.580
and then you can actually access the USB port
00:52:13.580 --> 00:52:18.300
I mean, they physically damaged the ATM to be able to access the USB port
00:52:18.300 --> 00:52:21.860
and then they had to cut the network connection
00:52:21.860 --> 00:52:23.659
and that triggered a reboot
00:52:23.659 --> 00:52:25.980
so it's really a trivial attack
00:52:25.980 --> 00:52:27.300
not that hard
00:52:28.880 --> 00:52:30.260
okay number 4 please
00:52:30.880 --> 00:52:32.340
yes
00:52:32.340 --> 00:52:33.900
two part question
00:52:33.900 --> 00:52:38.860
you would think that banking and money would be a high priority thing to secure
00:52:38.860 --> 00:52:41.260
why are they using Windows XP?
00:52:41.260 --> 00:52:43.180
and the second one is
00:52:43.180 --> 00:52:46.660
applause
00:52:46.660 --> 00:52:48.300
second one is
00:52:48.300 --> 00:52:51.860
if there was a time-frame of I think it was three days between the two attacks
00:52:51.860 --> 00:52:55.200
why don't they realize, there is hole cut into their ATM and just...
00:52:55.200 --> 00:52:56.660
change it out?
00:52:56.660 --> 00:52:59.540
applause
00:52:59.540 --> 00:53:01.420
there is a...
00:53:01.420 --> 00:53:04.700
that depends on the USB port that they used
00:53:04.700 --> 00:53:06.380
there is one on the back, so you don't see it
00:53:06.380 --> 00:53:08.100
and the other is just...
00:53:08.100 --> 00:53:17.100
you can cut that very exact and then they just repaired it afterwards
00:53:17.100 --> 00:53:22.850
they just fixed it
00:53:22.850 --> 00:53:24.700
and for the first question
00:53:24.700 --> 00:53:30.700
the problem in the main cases is that there are hundreds of thousands of teller machines
00:53:30.700 --> 00:53:33.539
for each bank
00:53:33.539 --> 00:53:36.140
and that's just the problem
00:53:36.140 --> 00:53:38.300
they are of course starting to renew that
00:53:38.300 --> 00:53:43.180
but when they are at the end doing that
00:53:43.180 --> 00:53:48.660
Windows has already realeased two newer versions of operating systems
00:53:48.660 --> 00:53:51.860
and that's one part of it
00:53:51.860 --> 00:53:58.200
and the other thing, if we had Windows 7 here it wouldn't change a thing
00:53:58.200 --> 00:54:02.730
I mean, that's probably a question for the banks that we can't really answer
00:54:02.730 --> 00:54:06.600
but as long as they're convered by insurances
00:54:06.600 --> 00:54:08.140
they don't really have to care
00:54:08.140 --> 00:54:09.940
which is of course kind of short sighted
00:54:09.940 --> 00:54:14.370
but maybe thats how it works
00:54:15.100 --> 00:54:20.300
okay and now the last question from number 1
00:54:20.300 --> 00:54:25.500
hi there, I was just curious about this particular ATM model
00:54:25.500 --> 00:54:32.380
if we're framing this picture of this is let's say the state of security and ATM technology
00:54:32.380 --> 00:54:37.900
or if it's just let's say an example for how to not build an ATM
00:54:37.900 --> 00:54:40.740
I mean are these bad guys simply the first who found out
00:54:40.740 --> 00:54:43.460
well it's basically that simple
00:54:43.460 --> 00:54:48.220
or is it just let's say a really bad model, they have exploiting?
00:54:50.650 --> 00:54:54.200
that all depends on the original cash client
00:54:54.200 --> 00:55:00.340
so the teller machines are all the same, but every bank has an own cash client
00:55:00.340 --> 00:55:07.260
it's an own software which is really doing the cashing out
00:55:07.260 --> 00:55:09.180
and they're all different
00:55:09.180 --> 00:55:12.618
and you have to develop the malware exactly for just one cash client
00:55:12.618 --> 00:55:16.380
because it won't work on others
00:55:16.380 --> 00:55:18.140
I mean, sorry
00:55:18.940 --> 00:55:21.740
I mean also speaking about this physical security
00:55:21.740 --> 00:55:24.100
I mean, having an easy accessible USB port
00:55:24.100 --> 00:55:29.860
and booting USB images without any additional security measure
00:55:29.860 --> 00:55:32.140
I mean, is this state of the art?
00:55:33.410 --> 00:55:34.780
no, it's not
00:55:34.780 --> 00:55:36.580
actually this has been fixed
00:55:36.580 --> 00:55:38.900
because there is an whole disk encryption in place now
00:55:38.900 --> 00:55:42.460
that just prevents this way of attack
00:55:42.460 --> 00:55:49.980
but yeah, it's not at all teller machine currently implemented
00:55:49.980 --> 00:55:52.940
so yes, it's kind of state of the art
00:55:52.940 --> 00:55:56.100
yeah, great, thank you
00:55:56.100 --> 00:55:58.260
okay then now
00:55:58.260 --> 00:56:04.260
thank you to our security researchers
00:56:04.260 --> 00:56:07.100
give them a great and warm applause, please
00:56:07.100 --> 00:56:10.163
thanks for coming, thank you
00:56:10.163 --> 00:56:18.762
subtitles created by c3subtitles.de