GDT Webinar Series – How to Fail at Security? Reserve Your Spot

What happens in an ATM, doesn’t always stay in an ATM

ATM security

It’s either not talked about often or doesn’t happen that frequently. But it should come as no surprise to learn that there is malware that targets ATMs. It makes perfect sense. ATMs run software, require connectivity and are stuffed with cash. Let me say that again—they’re stuffed with cash.

The latest ATM attack is quite different than your average attack, though. Actually, it’s a lot different. The malware, named WinPot, turns ATMs owned by an unnamed, but apparently well-known, vendor into slot machines. They’re selling it on the dark web for upwards of a thousand bucks. They created an interface that crudely mimics a one-armed bandit. Dials represent each of the ATM’s four (4) cassettes, which are the areas in which the cash is held (the design is to prevent an ATM from emptying its entire contents at a single time).

It’s no game of chance

WinPot differs from a traditional slot machine in one (1) very significant way—there’s no chance or luck involved. Once the “spin” button is tapped, the cash starts flowing. And after a cassette has emptied its cash, a “scan” button instructs the ATM to look for other cassettes that are still loaded with money. The slot machine-like interface is apparently for comedic effect only.

WinPot is not the first malware to attack ATMs. In fact, it’s not even the first to combine ill-gotten gains with laughs, or at least a hacker’s version of humor. Two (2) years ago, Cutler Maker was made available on the dark web for five (5) grand. It was loaded by plugging a flash drive into an ATM USB port. The interface looked more like the menu from a 1950’s-era diner. The felon served as virtual cook and accessed ATM cassettes by pushing “Check Heat”, then extracted cash with the cleverly labeled “Start Cooking” button.

Thankfully, illegally pulling cash from ATMs is no slam dunk

Just last year, Qin Qisheng, a software engineer from China, detected an operating system weakness in ATMs used by Huaxia Bank. Apparently, the OS created a small sliver of time at midnight during which ATM withdrawals weren’t recorded. He withdrew approximately $1 million prior to being arrested. His defense? He was storing the cash in his account for safekeeping, and, once the window had been sealed shut, would return the loot. Qin may know software, but he’s no Clarence Darrow. His defense didn’t hold up in court. He was sentenced to over ten (10) years in prison.

Stay steps ahead of cyberattackers by working with these folks

To find out how to secure your organization’s network and protect its mission critical data, contact GDT’s tenured and talented engineers and security analysts at SOC@GDT.com. From their Security and Network Operations Centers, they manage, monitor and protect the networks of companies of all sizes, including those for some of the most notable enterprises, service providers, healthcare organizations and government agencies in the world. They’d love to hear from you.

Author

Share this article

You might also like:

NCAA basketball coaching legend Bobby Knight once said: “Good basketball always starts with a good defense.” Winning teams understand their opponents’ strengths and weaknesses, as well as their own. They study their opponents’ plays and anticipate their next moves. The same concept is true for cybersecurity, which is why, at

GDT is committed to supporting #WomenInTech. In this interview, Sr. Bid Manager Peggy Debrowski shares insights into her journey, challenges, and triumphs as a woman in the technology industry. From her role evolution to her passion for empowering women, Peggy’s narrative inspires and encourages aspiring professionals. Sydney: How long have

Welcome to our February edition of our GDT Employee Spotlight. Our Culture & Engagement Manager, Sydney Johnson, interviewed Anirudh Raghavan, Associate Solutions Architect, with our Professional Services team this month. SYDNEY: Hi, Anirudh! Thank you for taking the time to answer my questions for our February Employee Spotlight. You have