It’s either not talked about often or doesn’t happen that frequently. But it should come as no surprise to learn that there is malware that targets ATMs. It makes perfect sense. ATMs run software, require connectivity and are stuffed with cash. Let me say that again—they’re stuffed with cash.
The latest ATM attack is quite different than your average attack, though. Actually, it’s a lot different. The malware, named WinPot, turns ATMs owned by an unnamed, but apparently well-known, vendor into slot machines. They’re selling it on the dark web for upwards of a thousand bucks. They created an interface that crudely mimics a one-armed bandit. Dials represent each of the ATM’s four (4) cassettes, which are the areas in which the cash is held (the design is to prevent an ATM from emptying its entire contents at a single time).
It’s no game of chance
WinPot differs from a traditional slot machine in one (1) very significant way—there’s no chance or luck involved. Once the “spin” button is tapped, the cash starts flowing. And after a cassette has emptied its cash, a “scan” button instructs the ATM to look for other cassettes that are still loaded with money. The slot machine-like interface is apparently for comedic effect only.
WinPot is not the first malware to attack ATMs. In fact, it’s not even the first to combine ill-gotten gains with laughs, or at least a hacker’s version of humor. Two (2) years ago, Cutler Maker was made available on the dark web for five (5) grand. It was loaded by plugging a flash drive into an ATM USB port. The interface looked more like the menu from a 1950’s-era diner. The felon served as virtual cook and accessed ATM cassettes by pushing “Check Heat”, then extracted cash with the cleverly labeled “Start Cooking” button.
Thankfully, illegally pulling cash from ATMs is no slam dunk
Just last year, Qin Qisheng, a software engineer from China, detected an operating system weakness in ATMs used by Huaxia Bank. Apparently, the OS created a small sliver of time at midnight during which ATM withdrawals weren’t recorded. He withdrew approximately $1 million prior to being arrested. His defense? He was storing the cash in his account for safekeeping, and, once the window had been sealed shut, would return the loot. Qin may know software, but he’s no Clarence Darrow. His defense didn’t hold up in court. He was sentenced to over ten (10) years in prison.
Stay steps ahead of cyberattackers by working with these folks
To find out how to secure your organization’s network and protect its mission critical data, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.
