A new study examines the proliferation of malware for ATM devices
Posted on April 12th, a joint study made by Trend Micro and the Cyber Crime Center (EC3) of the Europol. The research deals with malwares against ATMs.
The study examines the threats and the types of malware activity against more than three million existing ATM devices worldwide, which provide an amount of approximately 8.6 billion EUR annually. These are clear attractive targets for cyber attacks, since stealing money from the devices using malwares is easier and more secure than using physical means as before.
The study shows that there was an increase of 15% in malware attacks against ATMs between 2014 and 2015, a phenomenon found in the beginning and is expected to grow, with three countries outside Europe which recorded the biggest losses; the United States, Indonesia and the Philippines.
The study found a number of components contributing to this trend;
- Using Expired operating systems such as Windows XP, in which it is no longer possible to install security updates.
- The increase in sophisticated criminals who opt for digital operation methods since they are disguised and less risky.
- The ATM manufacturers that allow interim mechanisms (eXtensions for Financial Services (XFS) middleware) that provide APIs for communication with auxiliary devices.
- The study also examined the major malware activity concerning ATMs, alongside the geographical aspects of dispersion, and found that the lack of implementation of security measures in commercial banks in Latin America and Eastern Europe, led to their exposure to attacks by cyber criminals, as well as the export of the methods of attacks to other regions.
- Every malware family differs in two key components; ATM manufacturer type and capabilities of the malware (fraud the device to receive different cards and PIN numbers, or physical withdrawal of money), but they have in common the need to install them manually using external means. However it is argued that trade for ATM malwares has not yet became popular.
- These data join the European ATM Security Team (EAST) research, which was published on the same day, regarding various losses due to fraud related to ATMs and a relatively low proportion of the physical ones out of all frauds;
On the other hand, rising from the post is that in 2015 there were 15 cases of ATM fraud via malware, compared to 51 the year before, along with a decrease in damage from 1.23 million Euro to 743 thousand Euro.
