"ATM jackpotting" has reached the US, over one million US dollars are stolen

[captain_to_fire]

Sources: The Verge, Reuters [here and here]

 

Also, I wish people will stop saying the words "ATM machine". It's redundant and for whatever reason I get a little bit disappointed whenever I hear this  from newscasters and journalist who are supposed to be better in English than me. Just call the damn thing ATM or cash point or cash machine. ?

Quote

The Secret Service has been warning US financial institutions that domestic ATMs are being targeted in jackpotting attacks, according to a new report from well-known security journalist Brian Krebs.

 

Jackpotting, in which thieves use a variety of tools to hack into ATMs and cause them to dispense large amounts of cash on demand, has been a legitimate threat for several years now. The late computer hacker Barnaby Jack famously showed off an ATM exploit at the Black Hat conference back in 2010. But until now, jackpotting was mostly a threat in Europe, Asia, and Mexico.

 

According to the Krebs report, the US Secret Service recently sent out a confidential alert to multiple financial institutions warning that the “targeted stand-alone ATMs are routinely located in pharmacies, big box retailers, and drive-thru ATMs.”

 

The thieves have been posing as ATM technicians and, using a medical endoscope, locate an area within the machine where they can attach their own computers. The original hard disk of the ATM is removed and replaced with a disk that mirrors the ATM’s own software. At that point, the ATM appears out of service to regular customers, while fraudsters can remotely control it and force it to spit out cash, using “money mules” to actually collect the cash.

Thieves have gone a long way.. But holy crap them using an endoscope is genius though devious. Endoscope is that medical instrument used by doctors to probe the insides of the body and can be used for both diagnosis and treatment like in a laparoscopic surgery but instead of those, they used it to find tiny nooks and cranny of the cash dispenser and insert their own hard disk containing the ATM's usually proprietary software and the malware so that the machine will just spit out money. The people from Kaspersky Lab fortunately made some videos demonstrating how easy it is to do jackpotting and other reported cases of cyber bank heists like the Carbanak from Russia and Lazarus Group from North Korea.

 

Meanwhile, the US Secret Service has warned two ATM manufacturers about the vulnerabilities in their machines because crooks managed to infiltrate ATMs and steal one million dollars. Diebold Nixdorf, Inc. and NCR was advised to get rid of Windows XP in their ATMs and upgrade to modern versions of Windows like Windows 7. 

Quote

WASHINGTON (Reuters) - A coordinated group of hackers likely tied to international criminal syndicates has pilfered more than $1 million by hijacking ATM machines across the United States and forcing them to spit out bills like slot machines dispensing a jackpot, a senior U.S. Secret Service official said on Monday.

Within the past few days there have been about a half-dozen successful “jackpotting” attacks, the official said.

 

The heists, which involve hacking ATMs to rapidly shoot out torrents of cash, have been observed across the United States spanning from the Gulf Coast in the southern part of the country to the New England region in the northeast, Matthew O‘Neill, a special agent in the criminal investigations division, told Reuters in an interview.

 

The spate of attacks represented the first widespread jackpotting activity in the United States, O‘Neill said. Previous campaigns have been spotted in parts of Europe and Latin America in recent years.

Well this is what you get for using an out of date operating system. I know that XP for embedded systems are still receiving updates but still, it's about time to let it go and pick something better. I'm guessing that even banks using a custom Linux distribution is also vulnerable. Other than having my ATM card getting captured few weeks ago, I have never experienced any cyber thievery and I'd like to keep it that way other than having my ATM getting captured on a Saturday just a few weeks ago. Just to be safe, inspect the machine and wiggle the keypad and the machine and see if there's anything moving as it's one sign of a compromised ATM. Inspect if there are cameras installed that looks directly to the keypad and look at the back of the ATM if there's any box or USB drive attached. If there is, move to another ATM. Also, see if there are any exposed USB or any I/O of the ATM and report it to the bank as those are vectors for bank heists. 

 

Personally, I don't withdraw money from an ATM late at night unless necessary like in an emergency as those are the times that crooks do bad stuff anyway like installing a rogue hard drive containing sniffers and other viruses. I withdraw money during daytime and I use the ATM inside the bank and not the one outside or I use those located inside shopping malls or offices. 

[AshleyAshes]

Quote

1. Do you use an ATM card to withdraw money?

• Yes
• No, I withdraw money over the counter inside a commercial bank or a credit union
• No, I save, hide and manage my own money

 

So uhh... Why isn't 'I pay for goods electronically almost exclusively' an option here?

[captain_to_fire]

Just now, AshleyAshes said:

 

So uhh... Why isn't 'I pay for goods electronically almost exclusively' an option here?

because there's no physical cash involved with buying electronically

[Eduard the weeb]

1 minute ago, AshleyAshes said:

 

So uhh... Why isn't 'I pay for goods electronically almost exclusively' an option here?

Other then for education at school which is required I don't leave the premises of my compound 

[TacoSenpai]

I have been skimmed at a gas pump once.  Luckily it was flagged immediately on my account once transactions were attempted far away from me almost right after it got skimmed. 

[AshleyAshes]

1 minute ago, hey_yo_ said:

because there's no physical cash involved with buying electronically

Yes.  That's my point EXACTLY.

 

You set up the questions so that they can't say that.  The poll requires that ALL poll questions be answered.  You rigged it so that no one can say 'No, I don't use cash at all' but instead MUST use cash in any of the three scenarios your presented even if none apply.

[dizmo]

4 minutes ago, AshleyAshes said:

Yes.  That's my point EXACTLY.

 

You set up the questions so that they can't say that.  The poll requires that ALL poll questions be answered.  You rigged it so that no one can say 'No, I don't use cash at all' but instead MUST use cash in any of the three scenarios your presented even if none apply.

That's a very valid point. 

 

The only time I use cash is when I'm buying something from Kijiji. Otherwise it's all debit or credit card. 

[AshleyAshes]

2 minutes ago, dizmo said:

That's a very valid point. 

 

The only time I use cash is when I'm buying something from Kijiji. Otherwise it's all debit or credit card. 

Yup.  I use cash for literally one kind of transaction in every day life; I need quarters for the laundry machines in my apartment building.  Which obviously I get from the teller since ATMs don't really do coins.  So that really doesn't even count.  It's not cash for every day stuff it's just the like of quarters in a bowl near my laundry detergent.

The only other time I carry cash is like for an anime convention since I need cash for the dealers room.  AND MY GOD do I hate carrying around $700 in cash.  Super paranoid I'll just lose it. D:

[Donut417]

Im already wary of ATM's. Too many Skimmers in our area not to be. I wont use an ATM outside the ones at my Bank. Even then, I rarely use them. My dad pays his portion of the phone bill in cash, so I keep that cash on hand. 

[dizmo]

30 minutes ago, AshleyAshes said:

Yup.  I use cash for literally one kind of transaction in every day life; I need quarters for the laundry machines in my apartment building.  Which obviously I get from the teller since ATMs don't really do coins.  So that really doesn't even count.  It's not cash for every day stuff it's just the like of quarters in a bowl near my laundry detergent.

The only other time I carry cash is like for an anime convention since I need cash for the dealers room.  AND MY GOD do I hate carrying around $700 in cash.  Super paranoid I'll just lose it. D:

Your building still uses coins?! I haven't seen that in... Probably 12 years. 

 

Haha that's a lot of cash for an anime convention! You must have a room dedicated to it. I feel ya though. We get paid in cash, so sometimes after a job I'll have $3k in my pocket until I get around to going to the bank. That's sketchy. I still don't use the teller though. 

[AshleyAshes]

3 minutes ago, dizmo said:

Your building still uses coins?! I haven't seen that in... Probably 12 years. 

I know, right? It's a smaller building with only two washers and two dryers, so I think that whichever third party runs and maintains them feels that the infrastructure for the those typical card systems isn't worth it.  It's a 95 year old apartment building too so I'd not be surprised if wiring up the card hardware would ALSO need telecom cabling to be run and they're just all 'Screw it'

[Murasaki]

Given the chances of this happening in my country are slim, I still don't use ATMs whatsoever.

[suicidalfranco]

wonder if the same people who ask for crypto to be banned when shit like this happen would ask for the same thing in this instance 

[Sakkura]

Why don't people just withdraw extra money when grocery shopping? That's usually how I get cash when I need it for some reason (rarely these days).

[mynameisjuan]

23 minutes ago, Sakkura said:

Why don't people just withdraw extra money when grocery shopping? That's usually how I get cash when I need it for some reason (rarely these days).

I will do that when I know I need cash which only ever is when we go out for drinks because fuck the $3 atm fee here. 

[paddy-stone]

Haven't voted, your options aren't various enough on the first poll question. I SOMETIMES use ATMs, and the rest of the time use electronic transfers etc... none of the options worked, and it wouldn't let me submit the vote without the first question.

[SpaceGhostC2C]

1 hour ago, Sakkura said:

Why don't people just withdraw extra money when grocery shopping? That's usually how I get cash when I need it for some reason (rarely these days).

Are you asking why don't people just withdraw extra money when grocery shopping in Denmark, or around the world?

You can guess the answer won't be the same...

[SpaceGhostC2C]

2 hours ago, ModuleLFS said:

Given the chances of this happening in my country are slim, I still don't use ATMs whatsoever.

Robbing ATMs' content does not affect you as customer, though (other than trying to withdraw from an emptied machine, in which case it just forces you to walk to a different ATM).

[Energycore]

1 hour ago, Sakkura said:

Why don't people just withdraw extra money when grocery shopping? That's usually how I get cash when I need it for some reason (rarely these days).

Fees for cash withdrawal outside of the bank's on ATM are still way too high. Sometimes you have ta pay $5 US equivalent to withdraw any amount of money at the grocery store.

[Sakkura]

6 minutes ago, SpaceGhostC2C said:

Are you asking why don't people just withdraw extra money when grocery shopping in Denmark, or around the world?

You can guess the answer won't be the same...

Around the world mostly, since I already know most people do the same as me here.

 

It can't just be a special thing only Denmark knows how to do.

1 minute ago, Energycore said:

Fees for cash withdrawal outside of the bank's on ATM are still way too high. Sometimes you have ta pay $5 US equivalent to withdraw any amount of money at the grocery store.

Hmm, but don't you pay the same fee whether you withdraw $47.58 for groceries or $67.58 for groceries and a pair of $10 notes?

 

Also, the EU just banned credit card fees in shops.

 

https://www.independent.ie/business/personal-finance/latest-news/new-eu-rule-will-ban-charges-for-using-credit-card-35949337.html

[Ryujin2003]

I occasionally withdraw cash from ATM's; however, I don't use publicly available ones (IE: outside gas stations, malls, or other high traffic areas). I will generally get cash back at the grocery store or go inside of a bank and take cash out directly. And when using my card on ANY device, I always physically check the slot. I've only had my card abused once by a hotel employee. My bank quickly took care of that for me (because they are freaking awesome).

 

And when I say bank, I mean the generic term. As a consumer, I prefer credit unions.

[SpaceGhostC2C]

22 minutes ago, Sakkura said:

Around the world mostly, since I already know most people do the same as me here.

 

It can't just be a special thing only Denmark knows how to do.

Well, it exists in other countries as well, but not in every country. So, to some the answer will be "because there is no such thing", while those in places where it does exist will have a different answer (as in @Energycore's post). For example, I never used that option, partly because need for groceries and need for cash hardly coincide in time. If I just find myself needing cash, which doesn't happen that often, it doesn't make sense to come up with something to buy just to use the store - easier to just go the nearest ATM.

 

22 minutes ago, Sakkura said:

Hmm, but don't you pay the same fee whether you withdraw $47.58 for groceries or $67.58 for groceries and a pair of $10 notes?

I don't know where he's at, but I for example face no fee for paying with debit card. Hence, if there was a fee for withdrawing cash, that would make a difference (afaik there isn't here). 

29 minutes ago, Sakkura said:

Also, the EU just banned credit card fees in shops.

 

Withdrawing money isn't buying goods, though. In some EU countries, cash withdrawal fess have actually skyrocketed in recent years in some EU countries, including ATMs (see for instance Spain). I don't think they can ban your bank for charging withdrawal fees at supermarket, while allowing it to charge said fees at ATMs...

[Dabombinable]

So...the machines with the problem are based on the long-term unstable Windows XP, as opposed to the long-term stable IBM OS/2?

[Sakkura]

1 hour ago, SpaceGhostC2C said:

Well, it exists in other countries as well, but not in every country. So, to some the answer will be "because there is no such thing", while those in places where it does exist will have a different answer (as in @Energycore's post). For example, I never used that option, partly because need for groceries and need for cash hardly coincide in time. If I just find myself needing cash, which doesn't happen that often, it doesn't make sense to come up with something to buy just to use the store - easier to just go the nearest ATM.

 

I don't know where he's at, but I for example face no fee for paying with debit card. Hence, if there was a fee for withdrawing cash, that would make a difference (afaik there isn't here). 

 

Withdrawing money isn't buying goods, though. In some EU countries, cash withdrawal fess have actually skyrocketed in recent years in some EU countries, including ATMs (see for instance Spain). I don't think they can ban your bank for charging withdrawal fees at supermarket, while allowing it to charge said fees at ATMs...

Right. Didn't say there was necessarily only one reason, just wondering (especially about the US perspective as this story is about the US).

 

As for the last bit, if they charge the same fee in the supermarket and the ATM, it doesn't really change where you'd want to withdraw money. Personally I'd just do it at the supermarket since I'm going there regularly anyway, but of course if there's some sudden need it's another matter. Guess that also just depends how often you run into situations where you need cash; it's pretty rare for me. I just carry a bit of cash in my wallet just in case, and then restock when needed & convenient.

[mr moose]

It's getting harder to find people that only take cash nowadays.  Even the junior footy club here has a mobile eftpos machine. 

 

 

On a related note:

 

I do use and ATM machine when I need cash to fix my ABS brakes.  they usually have issues when the IC circuits in the CPU processor burn out.