Incident: ATM Software Vulnerability Exploited for Fraudulent Activities

Published Date: 2010-04-30

Postmortem Analysis
Timeline 1. The software failure incident mentioned in Article 1481 happened in early last year, as per the statement "Early last year, Diebold Inc issued a security update for its Windows-based ATMs after criminals attacked a number of them in Russia and installed malware designed to steal sensitive data" [1481]. Estimation: Step 1: The incident was mentioned as happening early last year. Step 2: The article was published on 2010-04-30. Step 3: Estimating back from the publication date, the incident likely occurred in early 2009.
System The software failure incident mentioned in the article involved the failure of the following systems and components: 1. Windows XP Professional operating system used in ATMs [1481]
Responsible Organization 1. Criminals who attacked ATMs in Russia and installed malware on the machines [1481] 2. Maintenance crews who opened up ATMs and installed malware on the machines [1481] 3. Thieves who manipulated ATM software to gain access to customers' PINs [1481]
Impacted Organization 1. Customers using the ATMs [1481]
Software Causes 1. Malware installed on Windows-based ATMs in Russia [1481] 2. Manipulation of ATM software to gain access to customer PINs [1481]
Non-software Causes 1. Breaking open or stealing the whole ATM machine. 2. Common fraud attempts such as stealing, cloning, or creating cards, "shoulder surfing" to collect PINs, "social engineering," and hacking. 3. Use of skimmers to steal card information. 4. Installation of malware on ATMs by apparent maintenance crews. 5. Criminal attacks on the backend of ATMs where they interface with other networks at financial institutions [1481].
Impacts 1. The software failure incident involving Windows XP in ATMs led to potential security vulnerabilities and concerns about the safety of customers' money [1481]. 2. Criminals were able to exploit the software vulnerability to install malware on ATMs, leading to the theft of sensitive data and financial losses [1481]. 3. The incident highlighted the risks associated with ATM security, including the manipulation of software, installation of malware, and other fraudulent activities [1481].
Preventions 1. Regular software updates and security patches could have prevented the software failure incident. Implementing timely security updates helps in addressing known vulnerabilities and reducing the risk of malware attacks [1481]. 2. Enhanced monitoring and detection systems could have helped in identifying any unauthorized access or malware installation on the ATMs. Implementing robust monitoring tools can help in detecting suspicious activities and responding promptly to potential threats [1481]. 3. Implementing multi-factor authentication for ATM transactions could have added an extra layer of security to prevent unauthorized access and fraudulent activities. Multi-factor authentication requires users to provide two or more verification factors to access their accounts, making it harder for attackers to compromise the system [1481].
Fixes 1. Implementing regular security updates and patches for the Windows XP operating system to address vulnerabilities and prevent malware installation [1481]. 2. Upgrading the ATMs to a more secure operating system such as Windows 7 or Linux to reduce the risk of software failures and security breaches [1481]. 3. Enhancing physical security measures around ATMs to prevent unauthorized access and tampering with the machines [1481]. 4. Educating customers about ATM security best practices to reduce the risk of falling victim to fraud schemes like card skimming and social engineering [1481].
References 1. Brian Krebs 2. Rick Doten 3. Javelin Strategy & Research 4. Robert Vamosi 5. SearchFinancialSecurity

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident related to ATM attacks involving malware being installed on the machines has happened before at Diebold Inc. In early last year, Diebold Inc issued a security update for its Windows-based ATMs after criminals attacked a number of them in Russia and installed malware designed to steal sensitive data [1481]. (b) The software failure incident related to ATM attacks involving malware has also occurred at other organizations. Criminals have targeted the backend of ATMs, where the ATM interfaces with other networks at financial institutions, in cases such as the RBS WorldPay heist [1481].
Phase (Design/Operation) design, operation (a) The article mentions incidents where criminals have attacked ATMs by opening them up and installing malware on the machines, such as in the case of Diebold Inc issuing a security update for its Windows-based ATMs after attacks in Russia [1481]. These incidents highlight failures related to the design phase, where vulnerabilities in the system's software are exploited by attackers during the development or system update processes. (b) The article also discusses instances where criminals target the backend of ATMs to steal sensitive data by manipulating ATM software or sending out bogus text messages to consumers [1481]. These actions represent failures related to the operation phase, where contributing factors introduced by the operation or misuse of the system lead to security breaches and fraud incidents.
Boundary (Internal/External) within_system, outside_system (a) within_system: The articles mention instances where ATM attacks involved criminals opening up ATMs and installing malware on the machines, such as in the case of Diebold Inc issuing a security update for its Windows-based ATMs after attacks in Russia [1481]. This indicates that the failure incidents were due to contributing factors originating from within the system itself. (b) outside_system: The articles also discuss how thieves are gaining access to customers' PINs by manipulating ATM software and sending out bogus text messages to consumers requesting personal information [1481]. This highlights that failure incidents can also be influenced by contributing factors originating from outside the system.
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The article mentions incidents where criminals have attacked ATMs and installed malware on the machines, such as in the case of Diebold Inc issuing a security update for its Windows-based ATMs after attacks in Russia [1481]. - There have been instances of ATM attacks where maintenance crews opened up ATMs and installed malware on the machines [1481]. (b) The software failure incident occurring due to human actions: - Criminals have targeted the backend of ATMs, where the ATM interfaces with other networks at financial institutions, to carry out heists like the RBS WorldPay incident [1481]. - Thieves have gained access to customers' PINs by manipulating ATM software and sending out bogus text messages to consumers requesting their personal information [1481].
Dimension (Hardware/Software) hardware, software (a) The software failure incident occurring due to hardware: - The article mentions incidents where criminals opened up ATMs and installed malware on the machines, indicating a hardware-related attack [1481]. - Criminals attacked Windows-based ATMs in Russia and installed malware designed to steal sensitive data, highlighting a hardware-related vulnerability [1481]. (b) The software failure incident occurring due to software: - The article discusses incidents where criminals manipulated ATM software and sent out bogus text messages to consumers to gain access to customers' PINs, indicating software-related vulnerabilities [1481]. - Diebold Inc issued a security update for its Windows-based ATMs after criminals attacked them in Russia and installed malware, emphasizing a software-related security issue [1481].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The articles mention instances of malicious software failure incidents related to ATM security. Criminals have been reported to have attacked ATMs by installing malware on the machines, manipulating ATM software, and sending out bogus text messages to consumers to gain access to their PINs [1481]. These actions were carried out with the intent to harm the system and steal sensitive data. (b) The articles also discuss non-malicious software failure incidents related to ATM security. For example, there have been cases where criminals targeted the backend of ATMs to steal data by interfacing with other networks at financial institutions [1481]. Additionally, the articles highlight that securing an ATM is like securing a house, implying that non-malicious factors such as vulnerabilities in the system architecture and lack of robust security measures can also contribute to failures [1481].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor decisions can be inferred from the article. The article mentions that some ATMs were attacked by criminals who installed malware on the machines after apparent maintenance crews opened them up [1481]. This indicates that the decision to allow unauthorized access to the ATMs for maintenance without proper security measures in place was a poor decision that led to the software failure incident. Additionally, the article highlights that criminals targeted the backend of ATMs where they could install malware to steal sensitive data, indicating a lack of robust security measures in place [1481]. (b) The intent of the software failure incident related to accidental decisions can also be seen in the article. It mentions that in some cases, criminals targeted the backend of ATMs to install malware, such as in the RBS WorldPay heist [1481]. This suggests that the decision to not have sufficient security measures in place to prevent unauthorized access to the backend of the ATMs was an accidental decision that contributed to the software failure incident. Additionally, the article discusses how thieves are gaining access to customers' PINs by manipulating ATM software, indicating unintentional vulnerabilities in the software that were exploited [1481].
Capability (Incompetence/Accidental) accidental (a) The articles do not provide information about a software failure incident related to development incompetence. (b) The articles mention incidents where criminals have attacked ATMs and installed malware on the machines, such as in the case of Diebold Inc issuing a security update for its Windows-based ATMs after criminals attacked them in Russia and installed malware designed to steal sensitive data [1481]. These incidents can be categorized as software failure incidents occurring due to accidental factors introduced by malicious actors.
Duration unknown The articles do not provide specific information about a software failure incident being either permanent or temporary.
Behaviour omission, timing, value, other (a) crash: The article mentions a scenario where criminals attacked Windows-based ATMs in Russia and installed malware designed to steal sensitive data, leading to a security update by Diebold Inc [1481]. (b) omission: The article discusses ATM attacks where maintenance crews opened up ATMs and installed malware on the machines, indicating a failure of the system to perform its intended functions due to the malicious installation of malware [1481]. (c) timing: The article mentions instances where thieves gained access to customers' PINs by manipulating ATM software and sending out bogus text messages to consumers, indicating that the system performed its intended functions but at the wrong time, leading to security breaches [1481]. (d) value: The article highlights cases where criminals targeted the backend of ATMs to steal sensitive data, indicating a failure of the system to perform its intended functions correctly, resulting in data theft [1481]. (e) byzantine: The article does not specifically mention any instances of the system behaving erroneously with inconsistent responses and interactions. (f) other: The article discusses various risks to ATM security, including physical attacks, card skimming, social engineering, hacking, and the use of skimmers, which could be categorized as "other" behavior in terms of security threats faced by the system [1481].

IoT System Layer

Layer Option Rationale
Perception sensor, actuator, processing_unit, network_communication, embedded_software (a) sensor: The articles mention incidents where criminals opened up ATMs and installed malware on the machines, indicating a potential sensor-related failure where the malware could manipulate the sensor data [1481]. (b) actuator: There is a reference to criminals attacking ATMs and installing malware designed to steal sensitive data, which could potentially affect the actuator function of the ATMs [1481]. (c) processing_unit: The articles discuss incidents where criminals targeted the backend of ATMs to install malware, suggesting a potential failure related to the processing unit of the ATMs [1481]. (d) network_communication: Criminals have been reported to manipulate ATM software and send out bogus text messages to consumers, indicating a failure related to network communication where unauthorized access or manipulation occurs [1481]. (e) embedded_software: The incidents mentioned in the articles, such as criminals installing malware on ATMs, point towards potential failures related to the embedded software of the ATMs [1481].
Communication unknown The articles do not provide specific information about a software failure incident related to the communication layer of the cyber physical system that failed. Therefore, it is unknown whether the failure was at the link level or connectivity level.
Application FALSE The software failure incident described in the articles does not specifically mention a failure related to the application layer of the cyber physical system due to bugs, operating system errors, unhandled exceptions, or incorrect usage. Therefore, the information regarding whether the failure was related to the application layer is unknown based on the provided articles.

Other Details

Category Option Rationale
Consequence harm, property, non-human, theoretical_consequence, other (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [1481]. (b) harm: The article discusses ATM attacks where criminals installed malware on ATMs, potentially leading to the theft of sensitive data. While physical harm is not explicitly mentioned, the installation of malware could harm individuals financially [1481]. (c) basic: The article does not mention any impact on people's access to food or shelter due to the software failure incident [1481]. (d) property: The software failure incident discussed in the article could impact people's material goods, money, or data as criminals targeted ATMs to steal sensitive information [1481]. (e) delay: The article does not mention any instances where people had to postpone activities due to the software failure incident [1481]. (f) non-human: The software failure incident primarily impacted ATMs and financial institutions, which are non-human entities [1481]. (g) no_consequence: The article does not mention any real observed consequences of the software failure incident [1481]. (h) theoretical_consequence: The article discusses potential consequences of ATM fraud, such as financial losses, but does not provide specific examples of these consequences occurring [1481]. (i) other: The article mentions various risks associated with ATM security, including fraud attempts like stealing, cloning or creating cards, "shoulder surfing," hacking, and the use of skimmers. These actions could have additional consequences beyond those listed in the options [1481].
Domain finance (a) The failed system was related to the finance industry, specifically ATMs. The article discusses how ATMs use Windows XP as the operating system and the various security risks associated with ATM operations, including fraud attempts such as skimming, hacking, and malware installation [1481]. The article also mentions incidents where criminals targeted ATMs by installing malware on the machines to steal sensitive data [1481]. (h) The software failure incident was directly related to the finance industry, as it involved the security and operation of ATMs, which are crucial for manipulating and moving money for profit [1481].

Sources

Back to List