This new type of malware, which I posted about yesterday, reportedly needs to be installed inside each "individual" machine. Therefore it suggests an inside job, and it suggests that the malware cannot spread from one ATM to another. Still, it exemplifies the constant evolution of hackers capacity to get increasingly closer to penetrating, what was once thought impenetrable. As the article from PC Authority states below, this type of malware has the capacity to make skimmers and camera's look primitive. Speaking of primitive, remember, NEVER TYPE...SWIPE!
Sneaky malware code can steal bank details at the ATM - News - PC Authority
Covering your PIN code with your hand is no defense against new malware targeting ATMs that has appeared in the Ukraine and Russia, recording card transactions at the machine, including PIN, security number and account details
An ATM based malware script has been discovered with the potential to sit invisible within ATM machines and record all private transactions without detection.
New Scientist is reporting that the malware, hidden as executable code in the ATM framework, is likely to be the work of an inside job at the bank or ATM, because the code needs to be installed inside the actual machine.
The malware is extremely difficult to detect, because it looks like an ordinary piece of ATM code.
According to the report, virus checkers are said to be useless on the malware, as criminal networks have camouflaged the malware within various Windows utilities inside the machine.
Security experts are alarmed at just how easy and brazen the ATM malware is. It has the ability to record customers PIN and their 3-digit security number; a security detail often thought to be one of the last defenses against fraud.
No matter how much a customer may try to cover their hands over their PIN at the ATM, this malware can still steal all account details with relative ease. This scam goes way beyond the typical use of PIN cameras and false keyboards at the cash box.
This kind of malware has the potential to make common skimming practices seem downright ancient. Other unconventional skimming attacks have been looked at in university experiments and in theory, but this is one
of the first times that an attack using malicious code has been found in the public arena.
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_sejb839SaqrobPJgG-V7rqWe9XcgOIFU1ZVyO6zUIELBRNVDPvnqn09cCtx6MiOQQ3mmvAfEXD6KJkK_RnVTcOeql20th37rRazMNXJriZXASgrP5DiQmUlEp4DsaJo25ZxymJbgiDqvdFmv4z0_rg=s0-d)
This story sounds a bit dubious at best. The ATM software doesn't have access to the PIN in plaintext, so malware on such a device would not compromise the security of the PIN.