22/11/2022 - Reading time 6 min
How to protect the ATM Fascia against logical attacks?
Multiplicity of points of sale and independent cash machines to access cash 24 x 7
Consumers demand for access to their cash 24 hours a day, 7 days a week and its increased convenience have led to multiple points of sale and independent cash machines being installed in shopping centres, car parks and other retail location.
Easy access to cash for consumers is essential to the business and wider community to keep the economy turning over.
All this has led to the increased consumer demand for access to cash in often more unsecured, unguarded environments, as well as the resulting increased risks and costs associated with the transportation, storage and processing of cash. This gives criminals more opportunities to get their hands on what they love most-anonymous cash-meaning that those operatives who handle cash run the risk of being robbed or attacked, sadly often experiencing physical violence.
Therefore with the clear importance of cash to consumers it is essential that cash protection measures are introduced to ensure the availability of cash through the ATM channel.
ATM Protection & physical attacks
ATM attacks : a mix of malware and hardware attacks
As can be seen from the figures produced by the European ATM Security Team, EAST, across Europe the impact of Covid saw ATM attacks generally decrease but are expected to reach pre Covid levels shortly.
Since 2020, ATM related physical attacks were up 6% (from 3,722 to 3,947 incidents). Attacks due to ram raids and ATM burglary were down 40% (from 749 to 447 incidents). ATM explosive attacks (including explosive gas and solid explosive attacks) were down 32% (from 923 to 629 incidents).
Losses due to ATM related physical attacks were €10 million, a 55% decrease from the €22 million reported during 2020. 64% of these losses were due to explosive attacks, which were down 56% from €14.59 million to €6.35 million.
ATM malware and logical attacks against ATMs were down 74% (from 202 to 52). All the reported attacks were aimed at ATM jackpotting, either using black box attacks or malware. A black box attack is the connection of an unauthorised device which sends dispense commands directly to the ATM cash dispenser, to ‘cash-out’ or ‘jackpot’ the ATM. Related losses fell from €1.2 million to €0.7 million)
Here are brief descriptions of the methods deployed in the most recent ATM attacks:
- Burglary / ram raids attacks: the ATM is attacked and either ripped out (Ram Raid) or the safe attacked in-situ (Burglary). The attacks can be carried out by brute force, or by using explosives
- Cash trapping: a type of fraud that involves taking cash dispensed by an ATM during a transaction. The criminal installs a device in the shutter, so that when the ATM attempts to dispense the cash, the notes are trapped and the customer cannot access them. When the customer has left the ATM the criminal then returns and takes the trapped cash.
- Blackbox attack: it is a type of jackpotting attack. The criminal makes holes in the fascia of the ATM, in order to reach the relevant hardware interface e.g. USB port. Then, the criminal connects an unauthorised device e.g. laptop which is then used to send dispense commands directly to the ATM Cash dispenser, in order to cash out the ATM.
image Positive technologies
It is therefore important that the most appropriate counter measures are introduced, OCP have a proven defense against these attacks as can be seen when visiting the OCP web site.
Solutions to protect ATMs from fascia attacks
Today's Solution : detecting the attack and an instant response
The usual way to undertake a 'blackbox or 'logical attack' is to gain entry to the inside of the ATM upper cabinet by making a hole in the fascia.
Oberthur Cash Protection's ATM fascia security solution will detect this type of attack no matter where in the fascia the attack is made and then automatically switch off the ATM dispenser so the criminals will not be successful.
Physical attacks against ATMs are widespread. As the types of attacks evolve with increasing success rates, cash losses climb. OCP can help you stop them now.
Equipping the ATM fascia with a tailored protection solution effectively combats all attempts to break-in via the fascia these include the following:
- TPF™ (TAMPER PROOF FASCIA SOLUTION) : This kit protects the sensitive points of the ATM fascia and reacts to the typical vibrations of percussion tools, hammers, drills, diamond saws, hydraulic pressure tools as well as thermal tools such as torches and thermal lances.
- DES™ (DEVICE ENHANCE SHUTTER) : The DES™provides a unique means of radically preventing the introduction of gases or solid explosive materials into the safe. It is positioned in the banknote transit area between the shutter and the safe opening.
ATM fascia protection in France
The implementation of ATM Fascia solutions in France
In 2013, The French Government introduced a regulation to prevent physical attacks on ATMs by using ink staining solutions. History has shown that this was an effective initiative; as can be seen by the dramatic 68% decrease in the number of ATM physical attacks from 304 in 2013 to just 18 attacks in 2022 May 2022. (Source French Gendarmerie).
The success of the cash protection offered by Intelligent Banknote Neutralization Systems, IBNS, against this kind of attacking France forced the criminals to move to other local countries such as Germany.
Criminals are inventive and share attack methodologies which explains why there has been an increase in the number of black box or logical attacks in many countries.
Case : implementation of anti-black box attack solution
Major French banking institutions have been most reactive, having decided to protect their ATM estates against jackpotting attacks by being the first to install fascia protection.
That has again been shown to be a smart action with the number of black box attacks decreasing by 70% since its Introduction in 2020.
The future of ATM Fascia Protection
The ATM market : global overview of tomorrow
Due to the adoption of non-cash payments, bank branch closures and the change in the market dynamics for Independent ATM deployers the number of ATMs in the top five countries - China, Japan, USA, Brazil and India are either decreasing or in the case of India the rate of growth is decreasing.
However, the recent RBR study also shows that in most other countries the number of ATMs have increased and that the worldwide total is likely to only fall to 3.2m by 2024 which Is around the same number as were in installed in 2015. By 2024 for the first time the number of ATMs installed in the above top 5 countries will now be matched by all the ATMs installed in all the other countries added together.
OCP believe that traditional cash dispensing ATMs will continue to be replaced by cash recycling models, new functions will be introduced.
To meet the customer demand for cash ATMs will be increasingly installed in new, often less secure locations, which will mean that there will be a need to install Intelligent Banknote Neutralisation Systems to provide cash protection in ATM and the CiT operations.
There is a clear ongoing demand for cash despite the adoption on non-cash payments, which has been encouraged by the Covid pandemic, transaction levels and the value of cash withdrawn is showing a return to pre Covid levels in many countries.
Cash is practical, inexpensive, quick, no need for a bank account and anonymous, together with its unlimited tradability is precisely what makes it the most desirable commodity and payment method, even in the digital age.
Unfortunately, for the very same reasons cash is also the preferred target of criminals therefore it is important that appropriate cash protection measures continue to be installed.
OCP's view is that this should be a layered approach with for example CEN gas safes and fascia protection against logical attacks.
But at the heart of any ATM security strategy should be IBNS, this is proven to deter ATM physical attacks as the incentive for criminals is removed, they know that any attack will result in the banknotes being indelibly stained so have a greatly reduced value or none at all.
How ATM Technology can be used to protect users from virus transmission
There has always been consumer concern over the transfer of germs and virus from using ATM keyboards, it is not unusual to see customers using pens or door keys to depress the keys on the PIN pad. This concern was made worse as it is clear that surfaces have contributed to the spread of the pandemic.
As a result, consumers, employees and members of the public have changed their behavior to avoid touching surfaces such as ATM touch screens, which might expose them to Covid-19. This change in behavior creates anxiety and worry for everyday business on a global level.
In this time of crisis, the Oberthur Group has built on its well proven Bioguard™ technology to develop an effective anti-viral, antifungal and antibacterial treatment for ATMs so that customers can use the ATM screens and Pin Pads in confidence that they will not be exposed to Covid or other germs and viruses.
The purpose of Bioguard™ is to contribute to the restoration of trust in our society and to prevent future pandemics by protecting surfaces against viruses, bacteria and fungus with an environmentally friendly technology, which has already been successfully used in the banknote industry for over 10 years. Once a surface has been treated with Bioguard™, it benefits from long-lasting protection.
Physical and logical attacks against ATMs are widespread. As the types of attacks evolve with increasing success rates, cash losses climb. Oberthur Cash Protection’s ATM fascia protection kits respond to the different types of attacks that can occur at the ATM’s critical
points. Don’t wait for an attack to happen. Prevent it!”
Amélie Magdziak, ATM Sales Manager, Oberthur Cash Protection