Electronic Bank Robberies

everyone, I think, knows ATMs, used ATMs

and our security researchers there

have something very interesting to tell us about electronic bank robberies

and because them, please welcome our two security researchers with a very warm applause

tw: are we on?

okay, well

welcome to our little talk here

and thanks for the introduction

as the angel said, I guess everybody knows what an ATM is

it's basically used by people to dispense money from their accounts

either because they live in countries like this one

where you really don't use credit cards to pay

or because you don't wanna be tracked, right?

we're gonna tell a little war story here

and that's a case of ATM hacking

a real world incident that occured this year

and you wanna remember this number here

because that's how you enable the hacked system

in case it's infected

and I'm gonna hand over to my co-speaker here

to tell you about the first few things here

sb: yeah, okay, so let's just have a quick look

what do we have in a cash machine

so of course we have a safe

that's where we want to get in

there's the money, we want to spend

so of course we have a normal computer

it's like a desktop computer

mostly it's running a normal operating system

most likely it's Windows XP

and with just a few different manufacturers that build the teller machines

and, yes

we as user, we use a common user interface

it's just a screen - most likely it's a touchscreen

or we have then the EPP number pads

where we put the PIN number for our card

tw: one thing I would like to add to this slide

you see the picture on the right hand side

that's a photo we took yesterday when we arived here at Hamburg main station

and it's interesting, because this is the state hacked ATMs are usually in

befor the bad guys go there and cash out

I don't know - maybe this one is infected, too

sb: this is not the first ATM hacking, of course

the most famous one was from Barnaby at the Black Hat in 2010

you see in the screenshot here

this was the user interface of his malware

so from the functionality it's quite alike

but not as nice

tw: has anybody in the room looked at this Ploutus thing by any chance?

no...

sb: okay, so of course we have a lot of POS malware

from mobile terminals

to steal just sensitive information

like the credit card data or paymant data or something

and the most famous ones this year even was the Ploutus malware

probably you've heard about it - quite famous

we had a quick look at Ploutus, too

it was written in .NET

from the functionality it's similar or the same

but not as advanced

why are we standing here and talking about this case?

we had an incident

a bank, they discovered, they had a lot of

empty teller machines and they started to

work in investigation for themselves

just a little bit of forensics and it was just limited success

but yeah, they had to do something about it and they tapped up surveillance

and improved monitoring

and they started to discover that the infection was conducted via an USB stick

they get to mange to arrest the guy and to secure this USB stick

and on the USB stick we found actually that malware and started to examine that

tw: yeah so to re-address that, before we go on

what they did was: they figured "okay there's something going on with our ATMs"

and they improved their surveillance technology, if you will

and then saw that guy trying to cash out from one of the hacked machines

and then they went there, arrested the guy

and confiscated the USB thumb drive that he was carrying

and that's where we started our analysis

right

sb: they plugged in a USB stick

they broke a small part of the chassis

it's just PVC, so it's not hard to break that

and they plugged in a USB device and forced the ATM to reboot

so you can do that by cutting the power off

or putting down the LAN interface or plug it out

they forced the ATM to reboot and therefore to reboot from the USB device

and what we found on the USB device was just a simple image of a Hiren boot CD

everyone can just download that

and within that Hiren boot CD it's just a mini XP running

and you have a folder where you can just put customer executables

that will automatically be started when the XP is booted

within this customer section we just found our malware

it was a batch that was called hack.bat

just very nice

so actually we thought that this is probably a fake

because they just wanted us to examine the wrong file

to save some time

because it was just that obvious

you will have a look at bat script afterwards

so you can see what I mean

so yes, it's just a mini-XP

you have the hack.bat

and this will actually start the real malware

the so-called atm.exe

and yeah... what we found then besides the bootable device on the stick were some very interesting files

they were obviously copied from the infected ATM teller machines

we can tell that, because there were three different ones that we found there

and it was very interesting what kind of data were copied from the ATMs

we found data like system data

like for example the software hive key

a lot of files that have cache data, credit card data, payment data, someting like that

from each of the infected teller machines

and of course we have our atm.exe

that was really interesting

and we take a quick look at the hack.bat script

so you see, it's very user friendly

because they implemented a lot of very interesting switches

we see, right at the top, that he begins to copy the software hive key of the infected machines

and at first he's checking if the system is already hacked or if he has to do it

the switches you can see here

they are all implemented

the most used one is of course "-hack"

we see otherwise, that you have some functionality like clear log files

or get the log files

this is the part where he copies really interesting data from the teller machines

of course the question is: why does he do that?

we answer that later

it also has got a functionality on it that he can cover his tracks

you can clear all files of the malware and remove it also

a little bit more about the installer of the atm.exe

tw: yeah, thanks

I mean of course we were curious

now that we know how the system gets infected

insert the USB drive, force a reboot and then the batch script runs

we were curious: how does the actual cash out process work?

how do you get money out of the thing?

what we did was

we took this atm.exe file - the executable

and reverse engineered that to recover the funtionality

and the next couple of slides talk about what we found in this executable

first of all

the atm.exe is a UPX packed thing

UPX is one of the standard packers

you can easily unpack the original code again

and then we came across an interesting fact

so we unpacked it and loaded it up into our analysis tools

what you can see on the right hand side

it's a little bit blurred, but we hope you can still read it

is IDA Pro, that probably many of you are familiar with

one of the state-of-the-art disassemblers

so we loaded that file up into IDA Pro, took a look at the code

and then we discovered something interesting

we discovered that the original executable contains a resource

if you are a little bit familiar with the PE format

the executable file format on Windows systems

you might know that there are containers that you can use to store additional data

or attatch data to a binary

they are called resources

so this binary had a resource and there was some encrypted data in there

which turned out to be a DLL that contains the actual malicious functionality

and the interesting thing is that this resource is XOR-encrypted

now XOR is not a particularly strong encryption scheme

but never the less, if the key is long enough

like 4 bytes in this case

I mean you can still probably brute-force it

but well, you know

we figured that every executable that's deployed onto an ATM has the resource

encrypted with a key that is derived from the volume serial

which is an ID that is assigned to a hard drive when it's formatted

by the operating system

that means that every executable that's deployed onto an ATM is taylored specifically for this ATM

so it's not mass-malware that you can install on any ATM

each executable only runs one one very specific ATM

and that's interesting

I mean of course that raises the question: How do they get this ID in the first place?

How do they create this binary with the encrypted resource?

Where do they get the volume serials from?

and there are basically two options

I mean we don't have the answers to these questions

but there are only two options

one is: they go to the ATMs the first time, run their stuff

and extract the volume serial ID from the system

then go home, prepare the malware and then come back to infect the system

which seems kind of risky, because

if you get caught while doing this... well then

you'll lose something

the other option is...

we'll leave that to your imagination

so what we did

what you see here on the right hand side is some code that is executed after the XOR-decryption of the resource

and if you look closely enought you can see in the first basic block up there

it checks if the first byte of the decrypted data is an "M"

and then the next one checks if the next byte - the second byte - is a "Z"

which is part of the PE file header - MZ header

so we figured: okay, this is probably an executable

and that's how we recovered the original code

we assumed that this is an executable and then

you can call it a known plaintext attack or something like that

we reverted the XOR-encryption and recovered the DLL

and after this happened, of course

the dropper runs some checksumming code

to verify that the extracted and decrypted code is actually the DLL it wants to run

so after we recovered this malicious DLL

we took a closer look at that one

and it's dropped into this path up there under the system directory

and the value in the squared brackets over there is again derived from the volume ID

so if you come across one of these DLLs

you can take a look at the file name

and that's linked to the ATM it's supposed to run on

because of the naming scheme here

so that's how - and of course I mean you can see all of that in the code

that the second value there is hard-coded

that's how we figured: okay this sample was supposed to run on an ATM with this volueme ID

and then we came across something else

something that's as interesting

this DLL, or the malware in general writes a log file

and stores this on the USB drive that's used for the infection process

and that's pretty verbose

if you look at this

again we have to apologize that's it a little blurry

but there you can see

it's basically what is executed when the batch script runs, right?

there is a file name up there

if you can see that 978-blablabla DLL and some others

and suprisingly this log file contained information about three other infections that took place

so we switch to the next slide

with that information we can say

we have information that these guys infected at least four ATMs

the ones where we had that DLL for

and then these other three

that we recover from the log file

log file - again - is XOR-encrypted, but the key is hard-coded

so we could recover it from the code and then decrypt the log file and read it

this is an abbreviated version

the most interesting lines from the log

you can see that these ATMs run in fact Windows XP

yeah...

sb: what probably is quite intersting here is that we have information about three different teller machines

that were infected with this USB device

in clear text and we have it additionally in this somehow encrypted log file

so the question is: Why do we have that twice?

Why do we have this log file?

And why didn't they remove that files?

actually for every new infection they have to build up a new exe device

which is encrypted with the volume serial ID from this machine

and they would have enough time to clear that up

but they didn't do it

so furthermore the question broke: Why didn't they?

tw: okay, now in this part we wanna talk a little bit more about the actual payload

the malicious code that's executed on the compromised ATM

you know, the interesting bit

what you can see here is a list of some facts that we discovered

again this file contains some encrypted resources

this time they're encrypted with the static key that you see up there

so by looking at the code we obtained this key and could easily recover the resources

and they contained images like the one you see on the right hand side, up there

obviously stuff they wanted to display on the ATM screen, right?

we changed the coloring scheme and some other stuff here a little bit

because we don't wanna disclose the target here

yeah that's what they store in these resources

another thing that was in there, is this sdelete tool from Sysinternals

maybe some of you are familiar with that

a publicly available tool for secure file deletion

so you know, you override the file with specific byte patterns before you remove it

and they used that to remove forensic artefacts

forensic traces from the system

for example when they're uninstalling the malware

because you can also uninstall it from an ATM

but in case this fails for whatever reason, they have some backup code in the malware

some backup secure undelete code that does basically the same stuff

it overwrites the data first and then it deletes the file

so it's kinda interesting that it put a lot of effort into

covering up their, you know

hiding their traces on the system

and by the way

we will give you a demo in a few minutes

and show you the whole process

how you interact with an infected ATM

you will see the other screens as well

then of course for most malware it's important to become persistent on the infected system

because when it reboots for whatever reason, you want the malware to automatically load again

and these guys do that by writing the drop DLL into the AppInit DLLs value in the windows registry

for those of you, who are not familiar with the value

you can specify libraries in there that are loaded into every process that starts up

so by this you make sure that the malicious DLL is loaded into every proess that starts

within the current logon session at least

what you see down there is some decompiled source code

basically the main function of the malware

of the DLL

and what you can see there

there are several checks running in cash client one

cash client is the term for the software that controlles the ATM

that is running on the ATM

and controls the dispenser and so on

so it does this check and if this returns true, it starts some routine

and if some other checks succeed, then it calls some other functions and so on

basically what's happening here is that the DLL checks the name of the process it's running in

and then depending on this name it invokes certain functionality

and we believe that by doing this they implement support for different cash clients

this line down here, running in lsass.exe is also interesting

because the DLL is also obviously loaded into

what's lsass again? local system...

some windows process

is also loaded into that one of course

because of the AppInit thing

if it's running in this, it doesn't interact with the cash client ATM software at all

the DLL that's running in there is an event processor

for example, if you wanna uninstall the software

you basically create an uninstall event

and then the instance running in this process here

handles the event and removes the file and so on

and cleans up all traces

sb: what's also quite interesting here

you can see that later on, when we discover the malware itself

they have really somthing like a development cycle

it's really professional made up

because within the first infections we could find this malicious DLL within this AppInit hive key

there was an incident where the forensic team could discover it there

because it's quite obvious, you know

the AppInit DLL key is very famous for any malware

that should start at startup

and they improved it

so later on, they just added this malicious DLL to the DLLs which are started

just when the cash client is started

so it's also started from the startup, but it's not as loud

so you have to have to search quite deeper to find it

tw: Where are we? Are we on time? How are we doing?

How much time do we have left?

okay, plenty of time

great

so we know, how the malware becomes persistent

we know how it makes sure that it runs on the system

so it injects this DLL into all these processes

now of course we wanna know how to interact with it

because there must be a way of interacting with the malware

and what we found out by reverse engineering code is that the DLL that's running in the cash client

installs a hook for keyboard events

so whenever you press a key on the keyboard which in this case is the num pad

this is trapped by the malware and processed

and what they do is, they process only number keys

for obvious reasons

because that's the only kind of keys that you can enter

and if you enter the code that you've seen on the first slide

you activate a hidden menu that allows you to choose the several options

that you can use to control the ATM

but they have implemented an additional measure

because, you know, it's possible that somebody by accident enters the right 12 digits

and then suprise this thing pops up

and you can dispense all the money from the ATM

of course they don't want that to happen

so they have implemented a challenge-response scheme

so when you enter the 12 digit code, the first menu allowes you to say

present me with a challenge

and then the malware generates a random or like a secret code

where the scheme to generate it is secret

and you have to enter a response

that's not easy to crack

what they do in this case

because of the poor guy who goes to the ATM to cash out is not the brain behind the whole operation

they're likely to get arrested

so they probably don't want to transfer the knowledge

how to generate the response for the challenge to these people

can you tell the story about the phone calls?

sb: yeah, actually they had a surveillance video where they could monitor just one of their cash guys

which just currently had entered the secret 12 digits

and you can see on this video that he has already one part of this hack view

and after that he just took a cell phone

and called somebody and you can see that within that call

he types another number and right after that, he starts cashing out the teller machines

that's exactly that challenge-response check, he was talking about

so this proves that they don't want anything to chance

they wanna control which teller machine is cached out and exactly when and who does the cash out

so this may implicate that they don't trust their own people, do they?

tw: so, I mean we tried to bring you this video where the guy makes the phone call

but obviously the bank that was targeted here

they're a little concerned about their identity beeing disclosed

so unfortunately we couldn't get it

but, well, you have to trust us on that

that's how they probably do it

another thing is that these guys already anticipated that somebody would get a copy of the malware

and then probably start to reverse engineer it

and understand how it works

and of course the worst thing that can happen is

if somebody recovers the challenge-response functionality in that code

and then goes to all the hacked ATMs and, you know, jackpots them

insted of these guys

so they figured: okay, we need a means to protect that really important code

and that's not the only part, that's protected

there are several pieces that are, you know, critical

so to speak

so this challenge-response thing is one of them

and the other parts that are protected is everything that interacts wih the cash client

so by looking at the code you would never see a direct API call or DLL function call

into the cash clients libraries

all of this stuff is protected

and I'm gonna talk a little bit more about how they do that

it's a little bit hard to put that...

to find the right words for it

we have a picture of that in our mind, but...

we call that a state machine

so their obfuscation method is basically control flow obfuscation

when you look at some code statially, you can see this function is calling that function

and then this is calling that under this condition and so on

that's the control flow in the code

but if you don't wanna disclose that function A is calling function B

you have to put something in between

that obfuscates this relationship

they implemented a state-machine

that's what we call it

and this state machine consumes a buffer

a static buffer that's somewhere in the binary

and performs some computation on the bytes

and the result is the address of the function to call

at some point you say: state machine, here is a buffer

do your thing

and then the state machine starts computing the address to call

or that's only one scenario

the other scenario is that you wanna compute a certain value

for example, you enter the response for a particular challenge

and then the state machine with its functions computes some other value

that it compares to a challange or something

and this computation as well is protected by the state machine

and you can see a little snippet of that on the right hand side

again, if you can read it, you can see there's a lot of junk code in there

those of you who are familiar with polymorphism

polymorphic malware or other stuff like that

you will immediately see that some of the functions in there are total garbage

like for example, the SUB AL e1

and then, you know, some values are subtracted from a register first and then added again

so it's basically doing nothing

this junk code stuff is one method of obfuscation

and the other is, what's usally called "spaghetti code"

you know, it's jumping back and forth

and calling subroutines all over the place

and I think it's really hard or next to impossible to reverse engineer that

at least we spent several days

weeks even

and we couldn't really figure out how the state machine works

and that's really the purpose

but fortunately for us there was a solution for this

and that is what the little colored bar at the bottom of the slide shows you

again, this is something that IDA Pro generates for you, this disassembler tool

you can see the blue stuff at the front

that's the real code of the malware

all of that lives in the code section

and is at the beginning

and the green stuff here is library functions

here we have some data

and at the end there is some code again

and suprisingly this is the state machine

and it's pretty convenient for us that this is somewhere else in the memory layout

so what you can do is

you can put a memory break point a the section here

and by doing this trap every attempt to execute the state machine code

and then when you're in the state machine

you put a break point on the original, on the real code, up there

and you get the exit point of the state machine

by doing this you can basically treat the state machine as a black box

you don't care about the calculations at all

you can still reconstruct the relationship between the calling function and the callee

okay

unfortunately we couldn't use this break point method to understand how these value calculations are performed

but, well, you still can inspect memory and somehow understand a little bit of that somehow at least

okay now we wanna demo to you how this thing looks like

unfortunately we don't own an ATM that we can infect

but we have a virtual machine here that's running the malware

and we've patched the malware a little bit here

I think we didn't tell you

so what's happening is these screens when you enter the secret code

these screens that you saw on the slide

they're displayed on a second desktop

on Windows you can have as many desktops

like virtual desktops as you want

and then switch back and forth between these desktops

so what's happening is

these screens are displayed on a second desktop

and then execution switches over

the displays which is over to this desktop

so you leave the original ATM display and it's process alone

you just switch over to your secret menu desktop

and when you're done, you can switch back

that's a little difficult to debug

because when you do that, when you're running in a debugger and using break points and stuff

and the malware all of a sudden switches to a second desktop

you can't control the debugger anymore, because it's running on the first desktop

so we had to patch a few things to make it more convenient for us to demonstrate this

and that's what we're gonna do now

can you...?

so we have this little Windows XP VM

because we want to be accurate, right?

and I'm gonna start two processes here

one is: I have some little batch scripts

one is the one that simulates the malware running in the lsass process

and the other one simulates the malware running in the cash client

this one here

and let's just presume that this is showing the stardard ATM screen here

so "Enter your PIN" and stuff like that, okay

so what we're gonna do now is

we're gonna enter the 12 digit secret code that we saw on the first slide

you remember that, right?

and if you do that, you're presented with this menu here

do you wanna talk about those values? how that's calculated?

sb: yeah probably

so the only thing which is hard coded are the three lines at the bottom here

and all of the rest is just generated with the actual amounts they find on this ATM

so the ATMs, they have a lot of loo files which they create

and they're just saved on the hard drive

and within that files

every payment transaction is noted

what the malware does is

it requests the newest of that files

and just pulls the values into that screen

and so the attacker is presented with the actual value of the amount of money

and there he can just choose which one he wants to cash out

so just the 100 bills, or all of them

this is quite interesting

we took this screen from an ATM which was already attacked

there you can see that especially, or only the $100 cash cassette was cashed out

because, you know how long it takes if you're just cashing out 100 or 200 Dollars or Euros

and if you can imagine if you have a whole cassette full of money

that takes a lot of time

so this is why they most likely just cashed out this cassette with the most valuable input

tw: so what I can do now is

I can either press "0" and then I leave that again

and, you know, ATM shows its standard screen again

or I press "1"

I'm gonna do that now, just to show you what's happening

and now it's challenging me with this code here

and I have to enter the response

and yeah, I mean, it's a 6 digit number

the problem is

because we're not running on a real ATM, we cannot simulate this here

so I mean, I can enter a number here

but even if it would be the right one and it would accept this

we wouldn't be able to go any further, because some pieces are missing here

unfortunately... let me restart this

there we go again

usually what happens is

you press "1"

you get the challenge code

you call your HQ

you get the response code

you enter your response code

and then you have access to this second level menu, so to speak

that allows you to actually cash out

well, as I said, we cannot really do that here

so we have to simulate the fact that we're authenticated

we entered the right response code

for that we patched a little bit in this DLL

unfortunately we have to wait for three minutes now

because there is a timeout

they implemented a timeout as a measure to not leave this screen open

when, you know, something happens

the guy has to run off or something

because police is coming or something

and then you don't want to leave this on the scren

so they implemented a timer that fires after three minutes

and then after three minutes this window is closed

we patched this timer, that after three minutes the second layer menu is opened instead

we have to talk a little bit more, until that happens now

sb: probably about the version number

cause there you can see, they named their software

typical software style of course

with a four digit value number

so they have really a development cycle

for this malware

and they really are improving that with nearly every attack they are doing

they collect all facts they have, they improve antiforensics

and build in a little more functionality

you can really track these changes, they made

this developement improves

tw: another thing we can tell you meanwhile is that this challenge code is generated from two things

again, we don't know how it's generated, we don't know the algorithm

but we do know the input

and the two things that are the input to this algorithm

are an ID that's unique to the ATM

or the station, whatever you wanna call it

and a random value

so there's some randomness in there

by this you make sure that even if the same random value is chosen

the codes are different for two different ATMs

so the guy has to in fact call you and ask for the code

he cannot, you know, just by accident enter the right thing and take the money for himself

alright now would be a good time for the timer to fire

let's see

okay, I have another story

the dropper executable

when something goes wrong, they calculate an error message, an error code

oh, there we go

and this error code is derived from the value 1337

so apparently they think they are leet

which didn't really stop us from reverse engineering their software

this screen is like what we showed on the second slide

which basically says "this terminal is out of order, go to the next one"

and when you see this

I mean, two purposes:

one: others who want to dispense money from the ATM, if they see this, they would not touch it

and go to another one

but this also tells you that now you can enter another code

which turns out to be the same 12 digit sequence that we already know

to enter the second hidden menu

and there we go

this is now the real menu that you can use to control the ATM

again, you see the first four lines show you how much money for the different bills

or different notes is in there

but now you can actually, you know, cash out

you can dispense that money from the machine

so for example if I press "1", hopefully I can get the 300 R-Dollars

or if I press "4", I can get the 50s

so let me do that now and you can pay attention to the purple line at the bottom

so I press "4" now

and it said "wait" or "waiting" or something like that

and now it says "command has failed"

which is too bad because I wanted money, but my VM...

the emulation is not that good

sb: still didn't get to manage to really cash out some money from that machine here

tw: that would be nice

so I could now try to cash out 1, 2, 3, 4

and always I get this failure message

but this is where the malware actually interacts with the cash client

it loads, or resolves the libraries that belong to this cash client and then calls the API functions

to trigger the dispense functionality

but the other options at the bottom of the screen are also interesting

let me show you "7" and "8" first

and that's why I have this little window open here

I hope you can see that

so this is my network connection

the network devices that are installed

and as she said, every ATM has a persistentnetwork connection to the bank

so they can control what's going on and monitor and so on

so probably before you wanna cash out, you wanna disable the network entirely

and they can use "7" and "8" to do that

so let me press "7", you take a look at that window on the right hand side

you can see, the adapters are disabled now

and now I'm going to press "8" again

and now they're enabled again

that's convenient, right

so you can disable and enable the network adapters entirely

if you press "6" you're going back to this mode

and finally you can also format the system

I mean obviously because you wanna remove all the traces

so if I press "5", you see that little screen, that we already know

from the slide

they're somewhat cautious here

again, if you do that, you can either press "0"

then you get back to the previous menu

or you can press "9" and confirm that you actually wanna format the system

and doing that' now

and again it presents you with a challenge and you have to enter a 6 digit response code

the algorighm that's used to calculate this here is different from the previous one

and I mean we figured it out somewhat

but the funny thing is, that it doesn't actually format the system

it just uninstalles the malware

I don't know what the right answer to this is now

if you enter the wrong one, it keeps asking

and interestingly you cannot get out of this state anymore

so if you don't know the right answer, you're trapped in this

and after three minutes the "out of order" thing is displayed again

but if you enter the sectet code, you don't have access to the main menu again

you will always end up in this screen

so unless you enter the right code here, well, you locked yourself out

alright

we wanna conclude with some speculation about the people behind this maybe

we obviously don't really know who it is

but, you know, there are some interesting facts

and after that we'll open it up for questions and, you know, a little Q&A

sb: what we really can tell for sure

that they want to make serious money with that

they put a lot of effort in implementing and investigating

in coding actually

they build up quite a big team to do that and they have apparently different roles

that are strictly assigned

so every role has his part and is able to do his part

so it's quite separated

for sure they have to have profound knowledge about the ATMs

so most likely they really had one

to test all these features and to really check whether the coding is correct

whether they get any error messages

something like that

so either they probably robbed one and reverse engineered the original cash client

to derive the malware from it

or they most likely had someone in the inside

which was just to...

which had to develop the original cash client

and therefore really knows exactly how this works

how it's possible just to trigger a cash out

without entering a valid card, the PIN code

circumvent all the security measures that are implemented here

they have quite good development skills

so the code is quite sorted

you see the development cycles

they implement new features just like the AppInit DLL key stuff and so on

at least they are capable of protecting the code against people like him

they're just trying to reverse engineer malware

and they really try to cover their tracks for forensic investigations

so they made it really hard to get the pieces together

to just have a full image of how that finally works together

tw: alright

that was almost the last slide

you guys remember the 12 digits

from the first slide

so next time, before you dispense the money from an ATM, enter the 12 digits first

to make sure that it's not hacked

right, and if it is hacked

then you enter this here

because that uninstalls the malware

applause

well then we do a short Q&A, if it's okay for you

please, everybody that has a question

please line up on the microphones

signed with the numbers

and then we will do a short Q&A from approximately 8 to 10 minutes

alright, let's start with you

hi, I have two questions

the first question is whether they were gathering PIN codes and no strips

to be able to use them later on

and the second question is whether the ATM is connected to the Internet through the network connection

I didn't get all of that

can the others be a little quiet

so we have the chance to understand the questions

sorry, can you please repeat?

so my first question is whether the PIN codes and this magnetic strip

or any other information linked to the credit card number is gathered by this malware

and the second question is wether net network connection gives Internet access to the ATM

let me answer the first one, and for the second one, I'll refer to her

so this one could gather information like credit card stuff and so on

but it doesn't

not this one

I didn't get the second question

second question was: can you access the ATMs over the Internet? is there internet connection?

no, actually they do not have an Internet connection

but it is possible to build, so far

we did that in a test, where we tested an ATM

you can use this USB connection where they plugged in the bootable device

and just put an UTMS stick there and then you have an Internet connection

but by default there is none

but we did that, yeah

okay, then let's take number 1

thank you for your talk

I have two short questions

what was the time span between the infection and the cash out?

and did the attackers try to intercept card data?

so, the second question is the same as the previous one

they don't intercept any card data

they don't gather like credit card information and stuff like that

they only like jackpot - as Barnaby Jack called it - the ATMs

they only dispense money from the ATM

for the first question, what was the first question again?

what was the time span between the infection and the cash out?

how much time is between the infection and the actual cash out

we discovered that were only two to three days

so they could have any time between that, but they really try to make it short

and of course they waited for the right time, so right after the recharging

because thats the point of the most money

okay, then number 3 please

hi, thank you for your talk

question about banking security

this beeing Windows XP, I missed the part of code signing

and verified publishers and such

do banks employ these security measures or not?

they do have security measures

but they're only implemented when the XP is running

so they have whitelisting for applications

they have monitoring for the process

and they have an anti-virus

and of course something like that

but in essence everyone can dump their own software on it and run it

there is no whitelist for signatures or publishers, right?

there is a whitelist

actually there is, but that was the point why they did that

via bootable USB stick

because they wrote this DLL just within the system folder

and they have a whitelist for applications, but not for the DLLs

which these applications are using

I mean, it goes without saying that you can take measures to make the ATMs more secure

because this is kind of a trivial attack

and as you said, everybody could do that

and that's kind of the reason why we're giving this talk

it's no use in keeping vulnerabilites secret

they should be like talked about openly

and then people can go and fix their problems, right

thank you

do we have a question from IRC or the community out there?

yes there was one question coming from IRC

which was: how to get on the USB printer port to reverse that machine?

can you repeat the question please?

how to get on the USB port or printer port to reverse that machine?

this was just via cutting a hole into the chassis

so this is just a...

this is no metal, this is not a safe

so this is just a plastic

and there you can just cut a hole in it

and then you can actually access the USB port

I mean, they physically damaged the ATM to be able to access the USB port

and then they had to cut the network connection

and that triggered a reboot

so it's really a trivial attack

not that hard

okay number 4 please

yes

two part question

you would think that banking and money would be a high priority thing to secure

why are they using Windows XP?

and the second one is

applause

second one is

if there was a time-frame of I think it was three days between the two attacks

why don't they realize, there is hole cut into their ATM and just...

change it out?

applause

there is a...

that depends on the USB port that they used

there is one on the back, so you don't see it

and the other is just...

you can cut that very exact and then they just repaired it afterwards

they just fixed it

and for the first question

the problem in the main cases is that there are hundreds of thousands of teller machines

for each bank

and that's just the problem

they are of course starting to renew that

but when they are at the end doing that

Windows has already realeased two newer versions of operating systems

and that's one part of it

and the other thing, if we had Windows 7 here it wouldn't change a thing

I mean, that's probably a question for the banks that we can't really answer

but as long as they're convered by insurances

they don't really have to care

which is of course kind of short sighted

but maybe thats how it works

okay and now the last question from number 1

hi there, I was just curious about this particular ATM model

if we're framing this picture of this is let's say the state of security and ATM technology

or if it's just let's say an example for how to not build an ATM

I mean are these bad guys simply the first who found out

well it's basically that simple

or is it just let's say a really bad model, they have exploiting?

that all depends on the original cash client

so the teller machines are all the same, but every bank has an own cash client

it's an own software which is really doing the cashing out

and they're all different

and you have to develop the malware exactly for just one cash client

because it won't work on others

I mean, sorry

I mean also speaking about this physical security

I mean, having an easy accessible USB port

and booting USB images without any additional security measure

I mean, is this state of the art?

no, it's not

actually this has been fixed

because there is an whole disk encryption in place now

that just prevents this way of attack

but yeah, it's not at all teller machine currently implemented

so yes, it's kind of state of the art

yeah, great, thank you

okay then now

thank you to our security researchers

give them a great and warm applause, please

thanks for coming, thank you

subtitles created by c3subtitles.de