Rewterz Threat Advisory – Bank Servers Hacked to cause ATM cash-out

An alert was released about a new ATM cash out scheme called FASTCash, being used by Lazarus group.

IMPACT:  HIGH

PUBLISH DATE:  10-08-2018

OVERVIEW

Hidden Cobra, also known as Lazarus Group and Guardians of Peace, is believed to be backed by the North Korean government. They’re using a technique called “FASTCash” since 2016 to cash out ATMs by compromising the bank server.

BACKGROUND INFORMATION

The WannaCry Ransomware menace of 2017, the SWIFT banking attacks of 2016 and the Sony Pictures hack of 2014 are all associated with the same hacking group, Hidden Cobra or Lazarus group, backed by North Korean government. They are said to have stolen tens of millions of dollars, simultaneously attacking ATMs in over 30 countries in 2017 and in 23 countries in 2018.

ANALYSIS

FASTCash cyber-attacks involve the usage of ten different malwares that have yet been discovered. The researchers believe that attackers remotely compromise payment “switch application servers” within the targeted banks to facilitate unauthorized transactions.

Being an essential component of ATMs and Point-of-Sale infrastructures, Switch application server communicates with the core banking system to validate user’s bank account details for a requested transaction.

When your ATM card is used in an ATM or PoS machine, the software communicates with the bank’s switch application server to validate the transaction, and then accept or decline based on bank balance.

The malware installed on the compromised switch application servers then intercepts transaction request associated with the attackers’ payment cards and responds with fake but legitimate-looking affirmative response without actually validating their available balance with the core banking systems. Eventually ATMs are fooled into spitting out large amounts of cash without sending a notification to the bank.

ATTACK VECTORS

The common thing in all the compromised switch application servers is that they were running unsupported IBM Advanced Interactive eXecutive (AIX) operating system versions beyond the end of their service pack support dates. However, there’s no evidence that those have been exploited. The initial attack vector is also unknown.

Windows-based malwares seem to be the vectors to explore a bank’s network to identify the payment switch application server. However, each incident occurred with the usage of a different malware, samples indicate similarities in malware capabilities and functionalities.

Also, it looks like legitimate credentials were used to move laterally through a bank’s network to illicitly access the switch application server. Threat actors likely deployed legitimate scripts—using command-line utility applications on the payment switch application server.

INDICATORS OF COMPROMISE

US-CERT recommends that organizations filter their systems for these files, containing Backdoors, Trojans, Executables and scripts and block them if there are any indicators of compromise running in the system.

• 20ca1903a30516263d630c7c08f2b95f7b65dffceb21129c51c9e21cf9551c6
• ab88f12f0a30b4601dc26dbae57646efb77d5c6382fb25522c529437e5428629
• 9ddacbcd0700dc4b9babcd09ac1cebe23a0035099cb612e6c85ff4dffd087a26
• 4a740227eeb82c20286d9c112ef95f0c1380d0e90ffb39fc75c8456db4f60756
• 1f2cd2bc23556fb84a51467fedb89cbde7a5883f49e3cfd75a241a6f08a42d6d
• a9bc09a17d55fc790568ac864e3885434a43c33834551e027adb1896a463aafc
• d465637518024262c063f4a82d799a4e40ff3381014972f24ea18bc23c3b27ee
• 3a5ba44f140821849de2d82d5a137c3bb5a736130dddb86b296d94e6b421594c
• e03dc5f1447f243cf1f305c58d95000ef4e7dbcc5c4e91154daa5acd83fea9a8
• f3e521996c85c0cdb2bfb3a0fd91eb03e25ba6feef2ba3a1da844f1b17278dd2
• ca9ab48d293cc84092e8db8f0ca99cb155b30c61d32a1da7cd3687de454fe86c
• 10ac312c8dd02e417dd24d53c99525c29d74dcbc84730351ad7a4e0a4b1a0eba

IP: 75.99.63.27

MITIGATION

Mitigation Recommendations for Institutions with Retail Payment Systems

• Require Chip and Personal Identification Number Cryptogram Validation
• Isolate Payment System Infrastructure
• Logically Segregate Operating Environments
• Encrypt Data in Transit
• Monitor for Anomalous Behavior as Part of Layered Security

Recommendations for Organizations with ATM or Point-of-Sale Devices

• Implement chip and PIN requirements for debit cards.
• Require and verify message authentication codes on issuer financial request response messages.
• Perform authorization response cryptogram validation for Europay, Mastercard, and Visa transactions.

RECOMMENDATIONS

• Make sure antivirus signatures and engines are up-to-date
• Apply timely patches to operating systems
• Limit access to files and printer sharing services
• Limit user privileges and only authorize administrative privileges where necessary
• Maintain regular password changes
• Configure firewall to deny untrusted connection requests
• Organization workstations and servers should only run required services
• Ensure email attachments to be true file types, with extensions matching the file headers
• Restrict access to potentially harmful sites and maintain browsing monitoring of users
• Do not execute downloaded software until scanned
• Implement appropriate ACLs.

If you think you are a victim of a cyber-security attack. Immediately send an email to info@rewterz.com for a rapid response.