ATM's vulnerable to new malware via CD

ATMs in Mexico use a simple lock that is easily picked. Once picked, the attackers can gain physical access to the machines. Then it is just a matter of inserting their own malware packed CD's into the machines. The malware is referred to as the Ploutus malware.

Information security firm Trustwave has completed an analysis of the malware. Infected machines still carry out their normal functions of dispensing cash, but with just a few particular key combinations, the attacker will be presented with a hidden GUI, written in Spanish, complete with drop-down menus apparently designed for a touch screen.

"If you are a bank or the owner/operator of ATMs in Mexico, you will want to examine your machines for evidence of tampering," advises Josh Grunzweig, an ethical hacker in TrustWave's SpiderLabs team. "Banks and ATM owner/operators outside of Mexico could also benefit from an inspection of their ATMs."

"Examples of targeted malware like Ploutus serve as a reminder of the importance of a thorough security review of ATMs and the back-end systems connected to them," he added.

"The emergence of new malware with ability to directly extract cash from ATMs is a very alarming sign for self-service device security," Stanislav Shevchenko, chief technology officer at SafenSoft, warns. "Malware like this allows the cybercriminals to skip the whole process of cash withdrawal they have to take part in after using traditional ATM trojans and skimmer-like devices to steal the plastic card information.

"Additionally, by spreading malware like that criminals can easily bypass the traditional antivirus-based protection on the ATMs. If that trojan gets massively distributed any bank without specialised protection software on its ATMs will have hard times ahead," he added.