ATM's Machine - How can it get hacked?

Recently in Malaysia, just days ago (before I wrote this), few ATM machines was hacked and few bank losses for more than few millions RM. This is really serious and it is worst than traditional ways of stealing money from the machine. It shall be flagged as critical issue by the bankers and information security organization and community which request fast and firm action to prevent this. Just imagine if this people get to access and hacked the machine in one month from multiple locations. There will be billions losses and I can't imagine that (or rather afraid to think about it).

It was reported by The Star [3] on the same day and Harian Metero [1] and Utusan [2] on 30th September 2014 upon verification from respective agencies and company.

This is not the first as it happen previously in Montreal where 2 young teenagers unintended hacked into an Bank of Montreal ATM machines during their lunch break [8].

This won't be the last and neither the cases reported here in Malaysia. Regalado from Symantec [4], already raised the alarm since March upon his finding in end of 2013 [7].

As long as the machines is used software to operate, the issue will remain unless the community starts to built workable solutions to detect and prevent this from occurring. This is not possible until the community understand the real issue and root cause of it. People may see this as XP issue or software reside in the ATM machine and they will opt to change this two software. But in my case, these won't be the root cause. These two are merely the trigger button or one of the unlocked door waiting to be opened. The real root cause is from the initial step in software development lifecycle. This is where the community should start to implant their security measurements.

There are many ways to do this and one of the way is to increase the understanding of software developers in writing secure codes. I've wrote few papers which I hope that this will be a step moving towards having software that is harden and difficult to infiltrate:

• Understanding Vulnerabilities by Refining Taxonomy (Proceeding and presented in IAS 2011. Appear in IEEE)
• Classifications and Measurement on C Overflow Vulnerabilities Attack (Published in Journal IJNCAA)
• Vulnerabilities and Exploitation in Computer System - Past, Present and Future. SiSKOM 2013 (ISBN 978-967-12088-0-9), Universiti Teknologi Mara, Shah Alam, Selangor, Malaysia, 3rd - 4th Sep 2013

I won't says that hacking will be impossible as there is no such thing as impossible when you have 'will'. But this is another step for us to create a stronger wall of security.
References:

1. http://www.hmetro.com.my/articles/Trojan_sasarATM//Article
2. http://utusan.com.my/utusan/Jenayah/20140930/je_01/Sindiket-guna-virus-lesap-wang-ATM
3. http://www.thestar.com.my/News/Nation/2014/09/29/seventh-atm-hacked-into-al-rajhi-bank/
4. http://www.hackerjournals.com/?p=23437
5. http://www.hackersnewsbulletin.com/2014/03/windows-xp-flaw-hackers-withdraw-money-atm-just-sending-text-message.html
6. http://securityaffairs.co/wordpress/23421/cyber-crime/rob-atms-couple-sms-messages.html
7. http://www.deccanchronicle.com/140326/technology-latest/article/windows-xp-atms-being-hacked-simple-sms-symantec
8. http://www.forbes.com/sites/jameslyne/2014/06/11/14-year-olds-hack-atm-in-lunch-hour-how-it-happened/
9. http://thehackernews.com/2014/03/hacking-atm-machines-for-cash-with-just.html
10. http://www.dailymail.co.uk/sciencetech/article-2655012/Teens-hack-cash-machine-lunch-break-Stunt-prompts-security-upgrade-Bank-Montreal-ATMs.html

Read More

Defending Against Large Scale Attack - Hong Kong Case

Internet Society Malaysia Chapter THE INTERNET IS FOR EVERYONE Internet Society Malaysia Internet Society Malaysia has invited you to the event 'Defending Against Large Scale Attack - Hong Kong Case' on Internet Society Malaysia Chapter! Check out "Defending Against Large Scale Attack - Hong Kong Case" on Internet Society Malaysia Chapter Internet Society Malaysia Time: August 16, 2014 from 11am to 12:30pm Location: The Hong Kong PolyTechnic University Organized By: Internet Society HONG KONG Event Description: Guest Speaker: Matthew Prince, Co-founder & CEO of CloudFlare    Venue:      Facebook Event  Live Streaming: http://bit.ly/isoctv  See more details and RSVP on Internet Society Malaysia Chapter: http://www.isoc.my/events/event/show?id=5379371%3AEvent%3A34410&xgi=3VmabVnO1QFlzC&xg_source=msg_invite_event About Internet Society Malaysia Chapter the,my 668 members 478 photos 70 videos 103 Events 322 blog posts

Read More

Buffer Overflows on the top of the list again (in 2012) for SCADA system

New attacks against SCADA, old vulnerabilities, very old issues
by paganinip on January 16th, 2013


Stuxnet first and news of countless zero-day vulnerabilities in the wild have strengthened the idea that citizens security is constantly menaced by group of hackers that for different purposes are able to inflict serious damages to the structures that surround us.

Critical infrastructures represent privileged targets for very different actors such as cyber terrorists or foreign state-sponsored hackers, a heated debate is underway in the worldwide security community that is concerned about the cyber threats that need to mitigate in dire economic conditions and with limited budgets.

The security portal ThreatPost recently published the news related to new cyber attacks, malware-based, that hit two Power Plants using USB drivers as method of infection.

The events raised the needs to adopt, at corporate level, best practices for any security aspect included removable storage, a critical issue for security of control system inside critical infrastructures.

According a report from the Department of Homeland Security’s Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), three instance of malware were discovered fortuitously after a scan of an USB drive used to back up control systems configurations. One of the instances detected is considered very sophisticated, increasing the level of alert on the event.

Further analysis revealed other absurd security flaw, for example it was absent a backup management for critical workstations inside the plant.

“The organization also identified during the course of the investigation that it had no backups for the two engineering workstations. Those workstations were vital to the facility operation and, if lost, damaged, or inoperable, could have a significant operational impact. The recommended practice is to maintain a system of ‘hot spares’ or other effective backups for all critical systems.”

The main problem is that majority of control systems are privately owned, and leak of investment in security advantages the work of hackers. Elementary security measures could sensibly improve security level of infrastructures, let’s think to the establishment of proper defensive measures of the correct configuration of any devices exposed in internet.

The report states:

“While the implementation of an antivirus solution presents some challenges in a control system environment, it could have been effective in identifying both the common and the sophisticated malware discovered on the USB drive and the engineering workstations,”

Similar incidents are not rare, in October, ISC-CERT reported the infection of 10 computers linked to another power company’s turbine always via a USB drive…and the list is long.

Summarizing the vulnerability analysis proposed by ICS-CERT :

“in fiscal year 2012, ICS-CERT tracked 171 unique vulnerabilities affecting ICS products. ICS-CERT coordinated the vulnerabilities with 55 different vendors. The total number of different vulnerabilities increased from FY 2011 to FY 2012, but buffer overflows still remained as the most common vulnerability type”

Besides the security aspect, as I mentioned before, it’s necessary to evaluate the financial prospective of cyber security market in the defense sector.

Cyber strategy of any state puts the security of critical infrastructures at the topmost priority, in particular for the global oil and gas industry also in response to recent series of attacks. An analysis from Frost & Sullivan revealed that the market earned revenues of $18.31 billion in 2011 and estimates this to reach $31.27 billion in 2021. The investments are driven by the growth of the sector and related need of physical and cyber security.

Anshul Sharma, Senior Research Analyst at Frost & Sullivan Aerospace, Defence & Security, declared:

“Global oil and gas companies are investing capital in new infrastructure projects, driving the need for security solutions at these facilities,” “With increasing awareness of threats, companies are adopting a security-risk management approach and implementing risk assessment of their facilities to ensure security Return on Investment (ROI).” “The threats may vary from information theft to a terrorist attack, but the economic impact and financial damage in case of an attack will be much more significant,” “It would also depend on the motive of the attacker. For example, a cyber attack to remotely control a SCADA system can have more serious consequences than a cyber attack to steal information.”

It’s clear that new opportunities for cyber security experts will be created in the incoming years, probably something is changing the mind of top manager that are driving the companies of the sector is a profitable business.

Pierluigi Paganini

taken directly from Security Affairs website on January 17, 2013

---

Can't stop copying this information since I'm doing research in this area and related to Buffer Overflow... Hope Mr. Paganini forgive me for copy the complete page...

Read More

Java 7: 0-day Actively Exploited In The Wild

Received an email from Beyond Trust about this exploit... the content is as below

January 10, 2013 

There is a 0day vulnerability (identified flaw, with no patch available) being actively exploited across the Internet in Java. This 0day has already been incorporated into Cool Exploit Kit and Blackhole, in addition to Nuclear Pack and Redkit. Proof of concept code is already publicly available and we expect to see fully functioning exploit code incorporated into even more exploit frameworks within the next few days.

What does this mean to you?

• This vulnerability affects Java 7 versions up to and including the current version of Java, 7u10
• Even if you're only running Java 6, users will be forced to automatically upgrade to version 7 in February of this year. This means further exposure to this vulnerability.

What you can do now to avoid being exploited

• Disable Java entirely
• If you don't need Java, remove it from the system entirely
• Lower and manage desktop privileges with solutions like PowerBroker for Windows
• Scan and detect this vulnerability with Retina Network

As always, we want our customers and users to be prepared for these types of exploits. We've posted a comprehensive writeup about this 0day and how to mitigate your risk.

Learn More About the Java 7 0day

Regards,
BeyondTrust Research Team

---

Looking at the link, I was bit worried since it does not pointed to BeyondTrust website. Google around and found many more discussion about this... (search on Java 7 0day exploit via google)...



Some of the sites talks about it:

1. http://thenextweb.com/insider/2013/01/10/new-java-vulnerability-is-being-exploited-in-the-wild-disabling-java-is-currently-your-only-option/
2. http://www.theregister.co.uk/2013/01/10/java_0day/
3. http://www.networkworld.com/news/2013/011013-java-zero-day-vulnerability-actively-exploited-265723.html
4. http://www.nsaneforums.com/topic/154515-critical-java-0-day-being-massively-exploited-in-the-wild/
5. http://blog.beyondtrust.com/java-0day-exploit-oracle-urges-people-to-run-into-burning-building

However, till today (09 January 2013), I've yet to see this appear on OSVDB, OWASP, or any other vulnerabilities databases sites or advisories sites such as Microsoft, Symantec, Karspersky, IBM, and Homeland Security... I wonder why? might be because I miss that or wrongly searched, or somehow it is yet to be available on these sites.

Read More

Anti Virus Performance - Comparative Result for 2011

(click the picture for clearer view)

As published at FB Cybersafe Malaysia
and as published in AV Comparatives Report 2011

Read More

A year in cybersecurity and cybercrime: 2012 review

Summary: During the year, we have seen the destruction of SOPA and PIPA but the emergence of CISPA and similar laws around the world, a growing trend in hacks and scams, an explosion in malware, and states committing cyberwarfare on their friends and foes. Here's a run-down of what happened in 2012 ... check it out the detail at ZDNet

Read More

Malware: Some interesting sites

I opened my FB and a link shared by SANS (FB SANS Digital Forensics and Incident Response) which shares about Malware Reverse Engineering FB. Followed the link and 'wallawe' ... bunch of interesting sites related to malware; of which I'm interested too (out of many interest that I had).... and here is some of it.

1. History of Decompilation - To whom may have interest to learn about decompilation and its history. Good for beginner.
2. Fake Vodafone Bill - An analysis done on fake Vodafone bill. Who says that your bill is clean despite it came from known sources? Well, this should wake you up and trigger you to have some extra protection in reading PDF files.
3. FOR610: Reverse-Engineering Malware - Malware Analysis Tools and Technique - SANS shares some tips and courses on reading the malicious files by reverse-engineering process. You should not miss this :)
4. Multi Locker - A demonstration by Xylibox on Multi Locker.
5. The Future of Automated Malware Generation -  Take a look on discussion by IO Active Labs Research on future malware, current trend and analysis techniques and future defense mechanism. However, I'm quite concern on current analysis technique which claims as failed to prevent many malware attacks. This is true but rather scary as we don't really know until we are hit by one of them :) (and it was make known to us after that)
6. Malware database and Virus Database - List of malware and virus (computer) that you can use for either to learn to be hackers or ethical hackers :). But beware!!! once in it, you will never know what after that :)
7. Decalage - A tool develop using Python to analyze OLE object
8. EXEInfo - A tool to analyze exe file on window.
9. OfficeMalScanner - A tool to analyze your office document.
10. Flame, Duqu and Stuxnet: In-depth code analysis - A studies by Aleksandr Matrosov and published at ESET blogs. Read this for your own good especially to those having 'old-ways' of internet access (which lack of many security defense.

Read More