Leaked programming manual may help criminals develop more ATM malware

Researchers found leaked documentation for application programming interfaces to interact with ATM devices

A leaked programming manual for interacting with the physical components of automated teller machines might have helped attackers create malware programs that were used to steal cash from ATMs in various parts of the world this year.

Security researchers from antivirus vendor Kaspersky Lab reported Tuesday that at least 50 ATMs in Eastern Europe and elsewhere have been infected with a malware program dubbed Tyupkin that can be controlled through the machines' keypads to dispense bills stored in their cassettes. It's believed that Tyupkin was used to steal millions, but it's not the first threat of its kind.

In October 2013 security researchers from Symantec warned about an ATM backdoor program dubbed Ploutus, which was used to steal money in Mexico. In May they documented another ATM Trojan, dubbed Padpin, that's very similar to Tyupkin.

Eighteen ATMs were infected with malware in Malaysia recently, allowing criminals to steal 3 million Malaysian Ringgit, or over US$900,000, according to a local media report. It's not clear which malware program was used in the attack, but Padpin is one of the possibilities.

Security researchers from F-Secure analyzed Padpin samples recently and determined that the malware is designed to interact with a particular DLL library known as Extension for Financial Services (XFS) that only exists on ATMs. The library, called MSXFS.dll, provides a special API (application programming interface) that enables software to communicate with an ATM's PIN pad. According to researchers from the Kaspersky Lab, Tyupkin also uses MSXFS.dll.

"Analyzing the code, we started wondering how the malware author knows which pin pad service name to provide to the API so that the program is able to interact with the pin pad device," the F-Secure researchers said in a blog post, noting that Microsoft doesn't provide any official documentation for this library's functions. "It's a valid question because the pin pad service name used in the code is quite unique and it is very unlikely one can figure out the service name without documentation."

The answer was eventually found in a programmer's reference manual from NCR, a U.S. manufacturer of ATMs, point-of-sale devices and self-service kiosks, that was posted on an ebook site owned by Chinese online search company Baidu.

It's possible that this manual was uploaded by someone other than Pinpad's authors and that the malware was created by programmers experienced in writing ATM applications. However, the leaked document could allow others to easily create ATM malware, according to the F-Secure researchers.

After skimming through the documentation, the researchers concluded that writing a program that interacts with ATMs would be easy even for someone with no prior knowledge about how to write software communicating with the devices. "The documentation is helpful enough to give programmers some sample code as well," the researchers said.

Unlike credit card skimming, the theft of money from ATMs via malware does not directly impact consumers, as the losses are incurred by the financial institutions that own the compromised machines. There are methods to prevent such attacks since they require physical access to the ATMs -- like changing the default locks on the machines, disabling their internal CD-ROMs and USB ports or installing additional alarm systems.

In the past, banks might have weighed the cost of locking down ATMs against the actual probability of those machines being attacked and concluded that the risk was acceptable. However, if the number of attacks using malware like Tyupkin, Padpin or Ploutus increases, as security researchers predict, then financial institutions might be forced to reconsider their ATM security practices.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags fraudmalwaresymantecintrusionncrf-securekaspersky lab

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.
Lucian Constantin

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Bang and Olufsen Beosound Stage - Dolby Atmos Soundbar

Learn more >

Toys for Boys

Sony WF-1000XM3 Wireless Noise Cancelling Headphones

Learn more >

ASUS ROG, ACRONYM partner for Special Edition Zephyrus G14

Learn more >

Nakamichi Delta 100 3-Way Hi Fi Speaker System

Learn more >

Family Friendly

Mario Kart Live: Home Circuit for Nintendo Switch

Learn more >

Philips Sonicare Diamond Clean 9000 Toothbrush

Learn more >

Stocking Stuffer

SunnyBunny Snowflakes 20 LED Solar Powered Fairy String

Learn more >

Teac 7 inch Swivel Screen Portable DVD Player

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Shining a light on creativity

MSI has long pushed the boundaries of invention with its ever-evolving range of laptops but it has now pulled off a world first with the new MSI Creative 17.

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Tom Pope

Dynabook Portégé X30L-G

Ultimately this laptop has achieved everything I would hope for in a laptop for work, while fitting that into a form factor and weight that is remarkable.

Tom Sellers

MSI P65

This smart laptop was enjoyable to use and great to work on – creating content was super simple.

Lolita Wang

MSI GT76

It really doesn’t get more “gaming laptop” than this.

Jack Jeffries

MSI GS75

As the Maserati or BMW of laptops, it would fit perfectly in the hands of a professional needing firepower under the hood, sophistication and class on the surface, and gaming prowess (sports mode if you will) in between.

Taylor Carr

MSI PS63

The MSI PS63 is an amazing laptop and I would definitely consider buying one in the future.

Christopher Low

Brother RJ-4230B

This small mobile printer is exactly what I need for invoicing and other jobs such as sending fellow tradesman details or step-by-step instructions that I can easily print off from my phone or the Web.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?