Banks move to secure ATM machines following brazen cyber attacks

KUALA LUMPUR: In an immediate measure to prevent future hacking of their automated teller machines (ATM), banks will install alarms on the top panel of their machines and seal the CD-ROM slots.

This comes after a meeting between the police and managers of banks affected by the recent spate of ATM hacking in Selangor, Malacca and Johor.

During the meeting, police explained to the bank managers that their machines were compromised by suspects who opened the top of the ATMs and inserted a disc into the slots to infect them with malware.

“We advised them to install more closed-circuit television (CCTV) cameras and improve the mechanisms in the ATM kiosks.

“Some of them were found to have weaknesses and were not foolproof,” said Bukit Aman Commercial Crime Investigation Department deputy director Senior Deputy Comm Datuk Hamza Taib.

Banks, said SDCP Hamza, had outfitted their ATMs to withstand regular heist in the country, which saw thieves physically carting off machines or cutting into them with blow torches, but did not anticipate cyber attacks on their machines.

This was despite reports of similar breaches in the United States, Mexico and Ukraine last year and computer security companies like Symantec having issued advisories against such cases in March.

In its advisory, Symantec also claimed that 95% of ATMs were still running on Windows XP, an old operating system that Microsoft had terminated its security updates or technical support in April.

The sophistication of the malware used exposed such ATMs to serious risk of cyber attacks, said the advisory, detailing how hackers gained control of a machine by infecting it with a malware named Backdoor.Ploutus, allowing them to input commands via SMS.

Petaling Jaya OCPD ACP Azmi Abu Kassim, whose district was the worst hit by the ATM hacking blitz, said banks were not doing enough to secure their ATMs.

“I had a meeting with the managers before Hari Raya and urged them to employ round the clock security guards at their premises.

“But my recommendation was not heeded,” he said.