Two Belarusian Arrested in Black Box ATM Attack

The Polish authorities have detained two individuals committing so-called ‘Black Box’ attacks, targeting ATMs, whereby criminal offenders attach electronic devices to cash machines and electronically force them into spraying all the money. The Polish authorities did this with the assistance of Europol. 

Following the ATM ‘jackpotting’ attack, which fraudulently led cash machines throughout Europe to deliver Euro 230,000 ($273,000), two Belorussian residents have been arrested. 

According to a press statement released on July 29 by Europol, criminals gained access to ATM cables by piercing or mounting pieces, that further connect the equipment to a laptop physically. This was then used to send relay commands to distribute all of the cash in the ATM. 

An ATM black-box attack is an ATM cash-out sort, a fraud concerning the financial system where the culprit bores troughs in the top of the cash machine, to obtain access to the internal infrastructure of the ATM. The money dispenser of the ATM is then connected to an outside electronic device, or black box, which employs native ATM commands to discharge money, circumventing the necessity for a card or transaction authorization. 

Coordinated by the EU Law Enforcement Agency and its Joint Cyber-Crime Action Task Force (J-CAT), the investigation highlighted that dozen of such “Blackbox” attacks have been committed by criminals in at least seven countries in Europe. 

The hackers attacked only a certain ATM model; Europol stated. The company refused to disclose in its assessment the specific cash machine brand susceptible to attack technology. Meanwhile, the Polish police in Warsaw, Poland on 17 July detained both suspects. The investigation also engaged German, Austrian, Swiss, Slovak, and Czech law enforcement authorities. 

While ATMs are indeed a lucrative target, they often have major physical and virtual weaknesses. ATM vulnerabilities have been a frequent issue since hacker Barnaby Jack persuaded an ATM in 2010 in Black Hat USA at a security conference in 2010 to dump all its money on stage.