An updated version of malware designed to steal money and card details from ATMs has been discovered by security researchers.

The new version of the Skimer malware, first discovered in 2009, uses new techniques to evade detection in infected ATMs running Windows software.

According to researchers from Kaspersky Lab, hackers using Skimer begin operations by getting access to the ATM system either through physical access or via the bank’s internal network.

Once successfully being installed into the system, the malware checks if the filesystem is FAT32 or NTFS; If it’s FAT32 it drops a malicious executable file in the C:\Windows\System32 directory, but if it’s NTFS, it will write the file in the NTFS data stream corresponding to Microsoft’s Extension for Financial Services (XFS) service, making forensic analysis more difficult.

The malware infects the core of an ATM, the part responsible for the machines interaction with the bank itself, successfully turning the entire machine into a card skimmer, allowing them to withdraw all the funds in the ATM or grab data from cards used in the ATM, including customers’ bank account numbers and PIN codes.

“Unlike in cases with a skimmer device, the Skimer malware is undetectable to the common ATM user since there is no physical sign of the ATM being tampered with,” the researchers noted.

Dormant

The hackers using Skimer often leave it dormant at first, as making a direct money withdrawal from the ATM would be revealed once funds from the ATM self are reconciled, whereas instead they can skim data from cards for several months, without undertaking any activity.

Once the people using the malware decide to wake it up, they insert a particular command card with records on the magnetic strip that can either execute hard coded commands, or request command through a special menu the card activates and displays on the ATM’s screen.

The menu itself is said to offer 21 different commands, including dispensing money, collecting details of inserted cards, self-deleting, updating and other options, with the ability to save details of PINs and card numbers on the special card.

To prevent this threat, Kaspersky Lab recommends that banks and other ATM operators undertake regular antivirus scans, accompanied by the use of whitelisting technologies, a good device management policy, full disk encryption, protecting ATM’s BIOS with a password, allowing only HDD booting and isolating the ATM network from any other internal bank network.

Image credit: 101332430@N03/Flickr/CC by 2.0