Wednesday, May 22, 2024

ATM “black box” – A New Attack to Dispense Money from ATM Terminal

Attackers have adopted a new attack method that includes connecting an external device and also contains parts of the software stack of the attacked ATM.

ATM manufacturer Diebold Nixdorf alerted that they spotted an increase in several jackpotting attacks with black boxes against ProCash terminals in certain European countries.

New black box Attack Type

Jackpotting attack is a type of physical attack in which attackers need to gain Physical access to the targeting ATM Machine.

Then they would connect their device the “black box”, to the dispenser and targets the communication to the cash-handling device directly.

Based on the new incidents Diebold Nixdorf observed that attackers are destroying fascia(front door) of the ATM to gain physical access to the head compartment.

Once they gained access than the “USB cable between the CMD-V4 dispenser and the special electronics, or the cable between special electronics and the ATM PC, was unplugged.”

The unplugged cable connected with a black box of the attacker to dispense the case from the ATM illegally.

In some incidents, it was spotted that the black box contains individual parts of the software stack of the attacked ATM.

“The investigation into how these parts were obtained by the fraudster is ongoing. One possibility could be via an offline attack against an unencrypted hard disc”, reads the PDF report published by Diebold Nixdorf.

Diebold Nixdorf recommended implementing proper countermeasures to thwart these types of attacks and to protect the ATM fleet. Also recommended to check event alerts at regular intervals.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Advanced ATM penetration testing methods.

ATM Black box attacks – ATM Jackpotting


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles