IT 
ES 
ATM jackpotting continues to be a threat to banks. This month a new report reveals that North Korean hackers are using a new Linux variant of the FASTCash malware to trigger unauthorized cash withdrawals.
Auriga, which provides multivendor management and specialist cybersecurity for bank devices including ATMs and ASSTs, believe banks can protect themselves against this renewed threat.
Néstor Santolaya Bea, Auriga’s banking cybersecurity expert says:
“Firstly, banks need to know that FASTCash is not ATM but server-side malware, and the new variant attacks now the internal Linux switches of the network. It takes over the switches so that a reply message of “unauthorized transaction” is converted to an authorized transaction for specific primary account numbers (PANs). The attack is enabled by how FASTCash exploits the lack of end-to-end data encryption between the server and the ATM where the jackpot happens.
The good news is banks and ATM operators can prevent these attacks by implementing security protocols such as TLS in communications between the ATM operating software like Auriga WWS and the central systems of the banks. This ensures that the data transmitted is encrypted with secure algorithms and unreadable by unauthorized users. As a result, hackers cannot intercept the exchanged data and modify it fraudulently.
It is also wise to switch on security mechanisms to guarantee the integrity of messages such as the MAC (Message Authentication Code) on the ISO8583 message fields. In this way, malware would not be able to alter the messages without being detected. The MAC, generated with symmetric keys, would be used to verify the integrity of the messages exchanged between the ATM operating software and the central banking systems.”
If you want to learn more about this topic do not hesitate to contact us and we would be very happy to set up a call with him to discuss current and future ATM hacking trends and exploits.
For information about Auriga’s PR activities and to receive our press kit:
Contact the Communication Department
