▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Some Topic 2020 Exploit & More tools :


Gtfo - Search For Unix Binaries That Can Be Exploited To Bypass System Security Restrictions

- SWFPFinder - SWF Potential Parameters Finder

- laravelN00b - Automated Scan .env Files And Checking Debug Mode In Victim Host

- Andriller - Software Utility With A Collection Of Forensic Tools For Smartphones

- LAVA - Large-scale Automated Vulnerability Addition

- Heapinspect - Inspect Heap In Python

- CHAPS - Configuration Hardening Assessment PowerShell Script

- Karonte - A Static Analysis Tool To Detect Multi-Binary Vulnerabilities In Embedded Firmware

- IotShark - Monitoring And Analyzing IoT Traffic

- LNAV - Log File Navigator

- TuxResponse - Linux Incident Response

@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Carding and black boxes: how ATMs are hacked today by UndercodeTesting

1️⃣REQUIREMENTS :

>A typical ATM is a set of ready-made electromechanical components located in one building. ATM manufacturers build their iron creations from a banknote dispenser,

>card reader, and other components already developed by third-party vendors.

> A kind of designer LEGO for adults.

> Finished components are placed in the ATM case, which usually consists of two compartments: the upper compartment (“cabinet” or “service area”), and the lower compartment (safe). All electromechanicaL components are connected via USB and COM ports to the system unit, which in this case acts as a host. On older ATM models, you can also find connections via the SDC bus.

2️⃣ The evolution of ATM carding :

> ATMs with huge amounts inside, invariably attract carders to themselves. At first, carders only exploited gross physical defects of ATM protection - they used skimmers and shimmers to steal data from magnetic strips; fake pin pads and pincode cameras; and even fake ATMs.


> Then, when ATMs began to be equipped with a unified software that works according to common standards, such as XFS (eXtensions for Financial Services), carders began to attack ATMs with computer viruses.


> Among them are Trojan.Skimmer, Backdoor.Win32.Skimer, Ploutus, ATMii and other numerous named and nameless malware that carders plant on the ATM host either via a bootable USB flash drive or through a remote control TCP port.

3️⃣HACK ATM PROCESS :


> Having captured the XFS subsystem, the malware can issue commands to the banknote issuer without authorization.

>Or give commands to the card reader: read / write the magnetic strip of a bank card and even retrieve the transaction history stored on the EMV card chip.

> Of particular note is the EPP (Encrypting PIN Pad; encrypted pinpad). It is generally accepted that the PIN code entered on it cannot be intercepted. However, XFS allows using the EPP pinpad in two modes:


1) open mode (for entering various numerical parameters, such as the amount to be cashed);

2) safe mode (EPP switches to it when you need to enter a PIN code or encryption key). This feature of XFS allows the carder to carry out a MiTM attack: intercept the safe mode activation command, which is sent from the host to the EPP, and then inform the EPP pinpad, that work should continue in open mode. In response to this message, EPP sends keystrokes in clear text.

ATM attack via remote access

5️⃣Antiviruses, firmware update blocking, USB port blocking and hard disk encryption - to some extent protect the ATM from virus attacks by carders. But what if the carder does not attack the host, but connects directly to the periphery (via RS232 or USB) - to a card reader, pin pad or cash dispenser?

🦑 The first acquaintance with the "black box" :


> using the so-called. "Black boxes" are specifically programmed single-board microcomputers, like the Raspberry Pi. Black Boxes empty ATMs in a completely magical (from the point of view of bankers) way.

> Carders connect their magic device directly to a banknote dispenser; to extract from it all the available money. Such an attack bypasses all protection software deployed on the ATM host (antiviruses, integrity monitoring, full disk encryption, etc.).

Black Box based on Raspberry Pi

🦑 WARNING IN ATM HACKING PROCESS :

1️⃣The largest ATM manufacturers and government intelligence agencies, faced with several black-box implementations, warn that these ingenious computers prompt ATMs to spit out all available cash; 40 banknotes every 20 seconds. Also, special services warn that carders most often target ATMs in pharmacies and shopping centers; and also at ATMs that serve motorists on the go.


2️⃣At the same time, in order not to shine in front of the cameras, the most careful carders take to the aid of some not too valuable partner, a mule. And so that he could not appropriate the “black box” for himself, they use the following scheme . The key functionality is removed from the “black box” and a smartphone is connected to it, which is used as a channel for remote transmission of commands to the truncated “black box” via IP-protocol.

Modification of the "black box", with activation via remote access

🦑What does it look like from the point of view of bankers?

1) The following happens on the recordings from video cameras: a certain person opens the upper compartment (service area), connects a “magic box” to the ATM, closes the upper compartment and leaves. A little later, several people, seemingly ordinary customers, walk up to the ATM, and withdraw huge amounts of money.

2) Then the carder returns and retrieves its small magic device from the ATM. Usually the fact of an ATM attack with a “black box” is detected only after a few days: when an empty safe and a cash withdrawal log do not match. As a result, the bank employees can only scratch their heads .

🦑 ATM Communication Analysis :


1) As noted in @UndercodeTesting, the interaction between the system unit and peripheral devices is via USB, RS232 or SDC. The carder connects directly to the port of the peripheral device and sends him commands - bypassing the host. It is quite simple, because standard interfaces do not require any specific drivers. And the proprietary protocols by which the peripherals and the host interact do not require authorization (after all, the device is inside the trusted zone); and therefore, these unprotected protocols by which the peripherals and the host interact are easily tapped and are easily susceptible to a playback attack.


2) T.O. carders can use a software or hardware traffic analyzer, connecting it directly to the port of a specific peripheral device (for example, to a card reader) - to collect transmitted data. Using a traffic analyzer, the carder will find out all the technical details of the ATM operation, including the undocumented functions of its periphery (for example, the function of changing the firmware of a peripheral device). As a result, the carder gains full control over the ATM. At the same time, it is quite difficult to detect the presence of a traffic analyzer.


3) Direct control over the banknote dispenser means that the ATM cassettes can be emptied without any fixation in the logs that the software deployed on the host normally brings in. For those unfamiliar with the hardware and software architecture of an ATM, this is really what magic might look like.


Written by Undercode
▁ ▂ ▄ ｕ𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ATM HACKING REQUIRE :

Where do the “black boxes” come from?

> ATM vendors and subcontractors are developing debugging utilities to diagnose the hardware of the ATM, including the electromechanics responsible for cash withdrawals.

> Among such utilities: ATMDesk , RapidFire ATM XFS . The figure below shows some more of these diagnostic utilities.