Rewterz Threat Alert – Logical Attack Hitting ATM Machine in Pakistan

Severity

High

Analysis Summary

Reports are emerging of the Logical attack hitting ATM machine in Pakistan recently where the attacker used external device to inject malicious code in the ATM software. It is observed from the initial analysis that the attacker physically opened the ATM machine and injected the malicious code via USB port by logging into Windows “quoted in NCR advisory”. While more details emerge, NCR has recommended banks to take certain actions to avoid any further losses given in the remediation section.

Impact

• Financial loss

Affected Vendors

NCR

Affected Products

• Cash Dispenser ATMs

Remediation

NCR Recommendations:

Changing passwords for all ATMs to avoid attackers from logging into the machine.
If you are using EPO Solidcore, change the password of Solidcore via EPO server and ensure the machines are all in locked down mode. This will stop the attacker from injecting the malicious code in the ATM via windows.
Securing the BIOS via password to stop the attacker to BOOT the ATM machine and inject malicious code in the hard drive.