Amid an emerging trend of ATM frauds, the security agencies have advised the banks to bolster security measures like physically concealing of LAN and other cables in the ATM premises as also ensure proper encryption of the network and the messages relayed by the ATM switch or backend authorisation machines for banking transactions.
This comes amid increasing incidents of Man in the Middle (MiTM) attacks on ATMs wherein the fraudsters seek to infiltrate the computer networks of the ATM, compromise it and withdraw cash fraudulently.
The advisory has warned that the MiTM attacks have been increasing under which messages sent by ‘’ATM Switch’’ to ‘’ATM Host’’ are altered by attackers to withdraw cash fraudulently.
Security agencies have discovered that cyber fraud gangs are adopting the new modus operandi to withdraw money from ATMs, sources said.
As per the latest trend, the fraudsters first tamper with the Internet network (LAN) cable of the ATM. ATM cards are then inserted in the cash dispensing machine and “payment declined” messages from ATM Switch are altered to “successful cash withdrawal transactions” and subsequently cash is withdrawn from the machines.
Such attackers first insert a device between the ATM machine and the router or data switch in the ATM premises.
This device has the capability to modify the responses from the authorization host (ATM Switch) which is connected to the ATM through LAN. The fraudster then uses restricted cards (or blocked cards) to submit a withdrawal request.
When the ‘’ATM Switch’’ sends a declined message, the attacker, through the device inserted by him in the network, alters the response to approve the transaction and cash is withdrawn successfully, the sources said.
In view of this threat, the agencies have advised the banks to ensure end-to-end encryption in the communication network from the ‘’ATM Terminal’’ or the computer and the ‘’ATM Switch’’ which authorises the transaction from the backend, they said.
The banks have been advised to physically secure the network cables, input/output port within the ATM premises.
The Reserve Bank of India has also issued a similar advisory following the security agencies’ alert.
According to the Indian Computer Emergency Response Team (CERT-In), as many as 1,59,761 cyber security incidents relating to digital banking were reported in 2018 followed by 2,46,514 incidents in 2019 and 2,90,445 cases in 2020.