21
ATM Malware: Understanding the Threat Amit Malik Co-Founder @ Cysinfo (https://cysinfo.com) Researcher @ Netskope Linkedin: https://in.linkedin.com/in/doublezer0

ATM Malware: Understanding the threat

Embed Size (px)

Citation preview

Page 1: ATM Malware: Understanding the threat

ATM Malware: Understanding the Threat

Amit Malik Co-Founder @ Cysinfo (https://cysinfo.com)

Researcher @ Netskope Linkedin: https://in.linkedin.com/in/doublezer0

https://cysinfo.com
https://in.linkedin.com/in/doublezer0
Page 2: ATM Malware: Understanding the threat

DisclaimerThe Content, Demonstration, Source Code and Programs presented here is “AS IS” without any warranty or conditions of any kind. Also the views/ideas/knowledge expressed here are solely of the author’s only and nothing to do with the company or the organisation in which the author is currently working.

However in no circumstances neither the speaker nor Cysinfo is responsible for any damage or loss caused due to use or misuse of the information presented here.

Page 3: ATM Malware: Understanding the threat

News..

Page 4: ATM Malware: Understanding the threat

Agenda• Introduction

• XFS subsystem/middleware architecture

• XFS Internals

• ATM Malware evolution

• Case Study

RIPPER ATM Malware

Page 5: ATM Malware: Understanding the threat

Introduction• ATM (Automated Teller Machine)

• As per ATM Industry Association (ATMIA) there are around 3 Million ATMs installed worldwide.

• Majority of the ATMs use windows operating system.

• WOSA/XFS or CEN XFS is the software standard used by ATM platforms for ATM device interactions.

• XFS subsystem basically provides the common API to access and manipulate the ATM devices from different vendors.

• Leading ATM vendors:

• NCR

• Diebold

• Wincor

Page 6: ATM Malware: Understanding the threat

ATM Diagram

*Picture: https://upload.wikimedia.org/wikipedia/commons/9/99/Atm_blockdiagram.png

https://upload.wikimedia.org/wikipedia/commons/9/99/Atm_blockdiagram.png
Page 7: ATM Malware: Understanding the threat

XFS (eXtensions for Financial Services) Architecture

*pic: CEN/XFS Specifications

Page 8: ATM Malware: Understanding the threat

XFS APIs• Application uses XFS APIs to communicate with

service providers.

• APIs can be called synchronously or asynchronously.

• XSF manager translates the APIs to SPIs

• APIs starts with WFS*

• Example: WFSOpen, WFSExecute, WFSGetInfo etc.

Page 9: ATM Malware: Understanding the threat

Configuration Information• XFS manager uses configuration information to route APIs to

SPIs.

• Configuration information is stored in windows registry hives.

• PC dependent information is stored under

• HKEY_LOCAL_MACHINE\SOFTWARE\XFS

• User dependent information is stored under:

• HKEY_USERS\.Default\XFS

• .Default or user id.

Page 10: ATM Malware: Understanding the threat

Config. Info. cont..• PC dependant information.

• XFS_Manager: trace file, share file information etc.

• Service_Provider: XFS compliant service provider - dll name, version, vendor name

• Physical_service: physical attachments configuration by the solution providers.

*pic:CEN/XFS Specifications

Page 11: ATM Malware: Understanding the threat

Config. Info. cont..• Example (service providers):

[HKEY_LOCAL_MACHINE\SOFTWARE\XFS\SERVICE_PROVIDERS\PIN]

"dllname"="PIN.DLL"

"vendor_name"="XFS Solutions Provider"

"version"="1.0.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\XFS\SERVICE_PROVIDERS\IDC]

"dllname"="IDC.DLL"

"vendor_name"="XFS Solutions Provider"

"version"="1.0.0"

[HKEY_LOCAL_MACHINE\SOFTWARE\XFS\SERVICE_PROVIDERS\CDM]

"dllname"="CDM.DLL"

"vendor_name"="XFS Solutions Provoder"

"version"="1.0.0"

Page 12: ATM Malware: Understanding the threat

Config. Info. cont..• User dependent configs

• Logical services can provide one or more physical services, for example cash dispenser and coin dispenser can be the part of one logical service.

• logical services: service class, service provider (service provider key name in service providers)

*pic: CEN/XFS specifications

Page 13: ATM Malware: Understanding the threat

Config. Info. cont..• Example (logical services)

[HKEY_USERS\.Default\XFS\LOGICAL_SERVICES\CashDispenser]

"class"="CDM"

“provider"="CDM"

[HKEY_USERS\.Default\XFS\LOGICAL_SERVICES\Pinpad]

"class"="PIN"

“provider"="PIN"

[HKEY_USERS\.Default\XFS\LOGICAL_SERVICES\Magstripe]

"class"="IDC"

"provider"="IDC"

Page 14: ATM Malware: Understanding the threat

Important XFS APIs• WFSStartUp - Initiate a connection between an application and the XFS

Manager

• WFSOpen - Open a session between an application and a service provider

• WFSRegister - Enable monitoring of a class of events by an application

• WFSExecute - Send service-specific commands to a service provider

• WFSGetInfo - Retrieve service-specific information from a service provider

• Pretty much all of the APIs can be called Asynchronously except few (eg: WFSStartUp etc.)

• Async - WFSAsyncExecute, WFSAsyncOpen, WFSAsyncRegister etc.

• Application must perform WFSOpen for each logical service.

Page 15: ATM Malware: Understanding the threat

ATM Malware Evolution

20072013

20142015

2016

Skimer Padpin, Neopocket

Ploutus Sucful, GreenDispenser

Ripper, Alice

Page 16: ATM Malware: Understanding the threat

Case Study• RIPPER ATM Malware

• Linked with Bt12 million hack

• Targets Major ATM manufactures (NCR, Diebold, Wincor)

• Reads both magnetic stripe and EMV chip data.

• Cash dispenser functionalities

• Lets jump on to the malware code analysis!

Page 17: ATM Malware: Understanding the threat

Code…

Page 18: ATM Malware: Understanding the threat

Code (path)

Page 19: ATM Malware: Understanding the threat

Code..

Page 20: ATM Malware: Understanding the threat

Code..

Page 21: ATM Malware: Understanding the threat

References• CEN/XFS:https://www.cen.eu/work/areas/ICT/

eBusiness/Pages/CWA16374.aspx

• https://www.fireeye.com/blog/threat-research/2016/08/ripper_atm_malwarea.html

• http://blog.trendmicro.com/trendlabs-security-intelligence/untangling-ripper-atm-malware/

https://www.cen.eu/work/areas/ICT/eBusiness/Pages/CWA16374.aspx
https://www.fireeye.com/blog/threat-research/2016/08/ripper_atm_malwarea.html
http://blog.trendmicro.com/trendlabs-security-intelligence/untangling-ripper-atm-malware/

Malware, Reverse Code Engineering and Cyber Threat

Malware, Reverse Code Engineering and Cyber Threat

Documents
Cisco ThreatGrid: Malware Analysis and Threat Intelligence

Cisco ThreatGrid: Malware Analysis and Threat Intelligence

Technology
Threat Hunting & IR - SANS Institute...Threat Hunting & IR Summit & Training 2019 October 2-7 | #ThreatHuntingSummit @sansforensics Venue ... FOR610 Reverse-Engineering Malware: Malware

Threat Hunting & IR - SANS Institute...Threat Hunting & IR Summit & Training 2019 October 2-7 | #ThreatHuntingSummit @sansforensics Venue ... FOR610 Reverse-Engineering Malware: Malware

Documents
Genetic Malware Analysis for Threat Intelligence · Malware Family Classification Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Genetic Malware Analysis for Threat Intelligence · Malware Family Classification Understanding if a threat is a generic malware, ransomware, or a nation-state sponsored attack,

Documents
Threat Analysis of BlackEnergy Malware for Synchrophasor ... · Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid Khan

Threat Analysis of BlackEnergy Malware for Synchrophasor ... · Threat Analysis of BlackEnergy Malware for Synchrophasor based Real-time Control and Monitoring in Smart Grid Khan

Documents
2015 Mobile Threat Report - The Rise of Mobile Malware

2015 Mobile Threat Report - The Rise of Mobile Malware

Technology
Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Identifying Mobile Malware and Key Threat Actors … Proactive Cyber Threat Intelligence By ... current CTI processes reactively look at malware in cyberspace, ... trends and evolution

Documents
Nokia Threat Intelligence Report – H1 2016 · Nokia Threat Intelligence Report – H1 2016. Table of contents Introduction 3 Malware in mobile networks 4 Mobile malware becoming

Nokia Threat Intelligence Report – H1 2016 · Nokia Threat Intelligence Report – H1 2016. Table of contents Introduction 3 Malware in mobile networks 4 Mobile malware becoming

Documents
A Unique Approach to Threat Analysis Mapping: A Malware ... · PDF fileA Unique Approach to Threat Analysis Mapping: A Malware-Centric Methodology for Better Understanding the Adversary

A Unique Approach to Threat Analysis Mapping: A Malware ... · PDF fileA Unique Approach to Threat Analysis Mapping: A Malware-Centric Methodology for Better Understanding the Adversary

Documents
Threat Bulletin VPNFilter Malware - Allot · built-in anti-malware measures. VPNFilter Malware: Real-time Report A new malware threat has emerged that poses such a serious potential

Threat Bulletin VPNFilter Malware - Allot · built-in anti-malware measures. VPNFilter Malware: Real-time Report A new malware threat has emerged that poses such a serious potential

Documents
Threat of Mobile Malware

Threat of Mobile Malware

Documents
Protect Against Malware with Mobile Threat Management

Protect Against Malware with Mobile Threat Management

Documents
BillGates Botnet Malware Used in Large DDoS Attacks | Threat

BillGates Botnet Malware Used in Large DDoS Attacks | Threat

Documents
Security Threat Intelligence Report...Security Threat Intelligence Report September 2020 In this issue Trickbot malware targets Linux Internet Explorer script-based malware emerges

Security Threat Intelligence Report...Security Threat Intelligence Report September 2020 In this issue Trickbot malware targets Linux Internet Explorer script-based malware emerges

Documents
Threat Analysis | Accenture€¦ · malware of choice THREAT ANALYSIS . DOCUMENT HEADER (ALL CAPS) ... used by miner malware. iDefense analysis of cyber-criminal underground activity

Threat Analysis | Accenture€¦ · malware of choice THREAT ANALYSIS . DOCUMENT HEADER (ALL CAPS) ... used by miner malware. iDefense analysis of cyber-criminal underground activity

Documents
Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Malware Labs : Unknown Malware Advanced Detection · Next generation anti-virus, malware tracking, threat hunting, behavioral analysis, endpoint detection, sandboxing, machine learning,

Documents
Active Threat Control Solution Paper - Bitdefender · PDF fileActive Threat Control increases the detection rate of malware A large quantity of malware samples is detected by Active

Active Threat Control Solution Paper - Bitdefender · PDF fileActive Threat Control increases the detection rate of malware A large quantity of malware samples is detected by Active

Documents
PHISHING THREAT MALWARE REVIEW - Cofense · PHISHING THREAT AND MALWARE REVIEW: 2019 Figure 1: As identified by the Cofense Phishing Defense Center. PHISHING THREATS BY TYPE October

PHISHING THREAT MALWARE REVIEW - Cofense · PHISHING THREAT AND MALWARE REVIEW: 2019 Figure 1: As identified by the Cofense Phishing Defense Center. PHISHING THREATS BY TYPE October

Documents
Malware & Data Breaches: Combatting the Biggest Threat

Malware & Data Breaches: Combatting the Biggest Threat

Technology
Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Threat Bulletin Fileless Malware The Stealth Attacker · Threat Bulletin See. Control. Secure. Fileless Malware - The Stealth Attacker Fileless malware (FM), aka “non-malware”,

Documents
Threat Analysis of BlackEnergy Malware for Synchrophasor based

Threat Analysis of BlackEnergy Malware for Synchrophasor based

Documents
Securonix Threat Research: COSMOS BANK SWIFT/ATM US$13.5 ... · 3 Summary Impact US$13.5 million stolen from Cosmos Bank between August 10-13, 2018. Scope Malware infection, ATM switch

Securonix Threat Research: COSMOS BANK SWIFT/ATM US$13.5 ... · 3 Summary Impact US$13.5 million stolen from Cosmos Bank between August 10-13, 2018. Scope Malware infection, ATM switch

Documents
Advanced Targeted Malware or Advanced Persistent Threat

Advanced Targeted Malware or Advanced Persistent Threat

Documents
MALOnt: An Ontology for Malware Threat Intelligence

MALOnt: An Ontology for Malware Threat Intelligence

Documents
Malware and the Modern Threat Landscape

Malware and the Modern Threat Landscape

Documents
Detailed Analysis Advanced Persistent Threat Malware

Detailed Analysis Advanced Persistent Threat Malware

Documents
Fidelis Threat Advisory #1020 Dissecting the Malware

Fidelis Threat Advisory #1020 Dissecting the Malware

Documents
Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Malware Analysis - ISWAT · The Malware Analysis Process Malware Sample Threat Intelligence Basic Static Analysis Dynamic Analysis Forensics Advanced Analysis ... Advanced Analysis

Documents
Quarterly Threat Report - Quick Healdlupdate.quickheal.com/documents/others/quick_heal...Threat Report: 3rd Quarter, 2014 Summary Windows Top 10 Windows Malware Windows Malware Collection

Quarterly Threat Report - Quick Healdlupdate.quickheal.com/documents/others/quick_heal...Threat Report: 3rd Quarter, 2014 Summary Windows Top 10 Windows Malware Windows Malware Collection

Documents
Ransomware: 2016's Greatest Malware Threat

Ransomware: 2016's Greatest Malware Threat

Internet