|
Multiple Remote Man-in-the-Middle ATM Attacks Reported
Retail ATM Jackpotting Incidents Are Exploiting Unsecured Personal Remote Monitoring Systems (RMS) in Multiple States Across the U.S.
NAC has been notified by the U.S. Secret Service (USSS) and multiple NAC Members of retail ATM Man-In-The-Middle / Jackpotting attacks that are using personal Remote Monitoring Systems (RMS) to hack into their ATM terminals and have them wrongly dispense all the cash. This is under current active investigation by the USSS and local/state law enforcement with attacks occurring in California, Florida, Illinois, Louisiana, Pennsylvania, and Tennessee. It is strongly believed the criminals are still active with this scheme, and that additional attacks are entirely possible.
Although this is subject to additional review regarding any similar exposures for other manufacturers' equipment, the attacks to date appear to be honing in on Genmega ATMs where the owner has not changed the default “admin” username and password within the GenRMS system, which allows entry to the ATM software program. Once hackers have gained RMS access, they change host IP address settings to 94.130.133.103 and change the withdrawal limit to $800.
This IP address and the related illicit server are then being used to spoof withdrawal authorizations and jackpot the ATM in a small number of transaction attempts. These transactions occur within minutes of each other, often for $800 at a time, until the ATM vault is fully depleted.
In light of this latest news and increased criminal activity involving ATMs, the USSS has issued the following bulletin (DO NOT SHARE THIS LINK/DOCUMENT WITH ANYONE OTHER THAN YOUR COMPANY PERSONNEL OR OTHER NAC MEMBERS).
The threat of REMOTE jackpotting of your retail ATMs is very real and present. Unlike prior schemes, the criminals don't need to connect their laptop/phone/blackbox to the ATM on site - the reprogramming is done by a remote hack - all the criminals need to do is go to the ATM and leisurely take out all the cash. This requires your immediate attention. Please check with your ATM Manufacturer/Distributor/ISO for detailed advice and instructions on protecting your ATM fleet from this current threat.
Bruce Renard
Executive Director
The National ATM Council, Inc.
| 
