UNDERCODE COMMUNITY

🦑BEFORE THEY START ATRM PROCESS-

1️⃣Direct interaction with the periphery, without communication with the host is only one of the effective methods of carding.

> Other techniques rely on the fact that we have a wide variety of network interfaces through which an ATM connects to the outside world. From X.25 to Ethernet and cellular.

> Many ATMs can be identified and localized through the Shodan service (the most concise instructions on its use are presented here ), followed by an attack parasitizing the vulnerable security configuration, the administrator’s laziness, and vulnerable communications between different departments of the bank.

2️⃣The “last mile” of communication between the ATM and the processing center is rich in a wide variety of technologies that can serve as an entry point for the card. The interaction can be carried out through a wired (telephone line or Ethernet) or wireless (Wi-Fi, cellular communication: CDMA, GSM, UMTS, LTE) method of communication. Security mechanisms can include:

1) hardware or software tools to support VPN (both standard, built-in operating systems, and from third-party manufacturers);

2) SSL / TLS (both specific to a specific ATM model, and from third-party manufacturers);

3) encryption;

4) message authentication.

2️⃣However, it seems that for the banks the listed technologies are very complex, and therefore they do not bother with special network protection; or implement it with errors.

> At best, the ATM communicates with the VPN server, and already within the private network it connects to the processing center. In addition, even if the banks manage to implement the above-mentioned defense mechanisms, the carder already has effective attacks against them.

> So even if security complies with the PCI DSS standard, ATMs are still vulnerable.

3️⃣One of the basic requirements of PCI DSS: all sensitive data, when transferred over a public network, must be encrypted

. And after all, we really have networks that were originally designed so that the data is completely encrypted in them! Therefore, there is a temptation to say: "We have the data encrypted, because we use Wi-Fi and GSM." However, many of these networks do not provide sufficient protection.

> Cellular networks of all generations have long been hacked. Finally and irrevocably. And even there are suppliers who offer devices to intercept the data transmitted through them.

> Therefore, either in unsafe communication or in a “private” network, where each ATM broadcasts itself to other ATMs, a MiTM-attack “fake processing center” can be initiated - which will cause the cardder to seize control of the data flows transmitted between ATM and processing center.

4️⃣Thousands of ATMs are potentially susceptible to such MiTM attacks . On the way to the authentic processing center - the cardrer inserts his fake. This fake processing center gives the ATM a team to issue banknotes. At the same time, the cardder adjusts its processing center so that cash withdrawal takes place regardless of which card is inserted into the ATM

> even if its validity period has expired, or there is a zero balance on it. The main thing is that the fake processing center “recognizes” it. As a fake processing center, either an artisanal hand-made article or a processing center simulator, originally developed for debugging network settings (another gift from the “manufacturer” to carders), can be used.

> The following figure shows a dump of commands for issuing 40 banknotes from the fourth cassette, sent from a fake processing center and stored in ATM-software logs. They look almost like real ones.

197 views19:08