April 6, 2015

Most of the ATM skimming attacks written about on this blog conclude with security personnel intervening before the thieves manage to recover their skimmers along with the stolen card data and PINs. However, an increasingly common form of ATM fraud — physical destruction — costs banks plenty, even when crooks walk away with nothing but bruised egos and sore limbs.

An ATM technician and KrebsOnSecurity reader shared photos of a recent attack in which three would-be robbers went to town on a wall-mounted cash machine with crowbars and hammers.

Thieves with crowbars did massive and costly damage to this ATM, but were thwarted in cracking the safe.

Thieves with crowbars did massive and costly damage to this ATM, but were thwarted in cracking the safe.

According to the technician, the burglars ruined a $13,000 cash acceptor, a $5,000 check scanner, a $900 monitor, and a $700 card reader, among many other pricey items. Hardly any part of the machine escaped damage.

This thief-ravaged ATM is totaled.

This thief-ravaged ATM is totaled.

The carnage from this incident looks like something out of a bad Transformers movie.

Decepticons, attack!

Decepticons, attack!

For all their work, the closest that the crooks got to the money was chipping the safe hinge.

Turns out, ATM cash safes are pretty tough.

Turns out, ATM cash safes are pretty tough.

The thieves in this case clearly didn’t have the right tools for the job. The real pros come armed with thermal tools to cut into the thick metal parts, as described in a recent update from the European ATM Security Team (EAST). As shown in the images below, the crooks draped flame-retardant cloth around the ATM while they set to work cutting into the cash machine with a gas-powered torch.

Source: European ATM Security Team (EAST)

Real pros bring the proper tools for the job.

In December 2014, I wrote about a spike in attacks on ATMs in Europe in which thieves attempt to blast open the cash machines with explosive gas. Since then, Bloomberg Business has published “Boom,” a detailed look at the growth of explosive gas attacks on ATMs since 2013.


58 thoughts on “Hacking ATMs, Literally

  1. mbi

    I’m surprised its taken so long to escalate it this level. In the movies crooks are blowing up safes all the time. With far more damage done to the machine, its probably cheaper to warn tampering will cause the cash to be sprayed with dye or destroyed.

  2. jdmurray

    How does one learn to do something well?

    Practice, practice, practice!

  3. Donald J Trump

    Holy sh#t batman ,I think these criminals need to find a new line of work LOL

    1. SeymourB

      If they were competent enough to have a line of work, they wouldn’t be criminals.

        1. SeymourB

          Thanks, I’ll be here all week… try the meatloaf!

    2. Bruce Wayne

      Haha! Very perceptive Robin.
      Thanks for the laugh!

    1. Bob

      ATM theft, or attempted theft, used to happen on a regular basis in San Antonio. I haven’t seen a report of it recently. Quite often security video would show the thieves driving off in a pickup truck, dragging the ATM behind because it was anchored to something and was too heavy to lift into the bed of the pickup truck.

  4. Anonymous

    Is Iron Oxide and Aluminum Powder really that hard to find?

  5. Columbus_viaLA

    “…bad Transformers movie.”

    What a redundancy!

  6. terry the censor

    > something out of a bad Transformers movie.

    Are there good ones?

    1. Lucas Cooper

      The one from 1986 is pretty good 😉

    2. Phil Cooper

      Only if they don’t involve Micheal Bay.

      So no, there have been exactly NO good live-action Transformers movies.

      The 86 animated job was passable, at best.

  7. meh

    Looks like a pretty exposed area, how did they get away with that and nobody heard anything or confronted them?

  8. Tim

    how come the ATM components cost so much? 900 for a monitor??? 5000 for the scanner????

    1. Fuzzy1

      To quote Judd Hirsch’s character from Independence Day:

      “You don’t actually think they spend $20,000 on a hammer, $30,000 on a toilet seat, do you?”

    2. F-3000

      I’d guess that the high price has at least partially something to do with the fact that ATM monitors are on 24/7, and how many of ’em you’ve seen with image burns? Been something like 10 to 15 years since I last saw such.

      1. SeymourB

        Yeah, if you look into monitors for security systems and the like, the prices are usually nosebleed worthy.

        For starters they’re very small monitors, which aren’t in vogue with the “50in TVs are small” average consumer, meaning there’s very limited production runs. Small runs increase the per unit price because the production line setup costs are fixed and get divided by the number of units run off the line… run a million units, the setup cost is a tiny part of each individual part’s price, run 1000 units, the setup cost is a huge part of the price.

        That’s the real reason most military parts are expensive; they’re not off-the-shelf parts, they’re custom build to specification parts, often using components that aren’t off-the-shelf but are also built to specification, and the production runs are very small. So you have very expensive components used to create very expensive parts and the price quickly snowballs.

        I’m reminded of the stories of navy ships whose electronics had excellent uptimes because they sourced off the shelf parts from radio shack, instead of getting hardened parts through official channels. The radio shack parts will work perfectly fine… unless they were hit by enemy countermeasures, then the electronics would have been fried. Of course the reason they went with radio shack is because there were a very small number of the correct parts manufactured, so the Navy was forever running out of components and having to order another production run, which required lead time that they didn’t have… rinse, wash, repeat.

        Of course some military parts are expensive just to hide “secret” budgets. The wisdom comes in knowing that a complete ship-borne radar system that only has 20 units in the world is naturally going to be very expensive… while a toilet plunger is a toilet plunger. Charging $5000 each for the latter is hiding a budget.

  9. Rider

    A $900 monitor? holly diebold price gouging Batman.

  10. am

    It drives me crazy that I can think or about 20 better ways to make money the legal way. With more money…and consistant income. A day’s work for a day’s pay. Anything else is nothing but trouble.

  11. John

    Surprised they didn’t remember season 1 of Breaking Bad and try the thermite route on taking out the hinges..

  12. Soy Tenley

    From the Bloomberg Business article “Boom” that Brian had linked at the end of his article :

    “As far as anyone knows, there has never been a gas attack on an American ATM. The leading theory points to the country’s primitive ATM cards. Along with Mongolia, Papua New Guinea, and not many other countries, the U.S. doesn’t require its plastic to contain an encryption chip, so stealing cards remains an effective, nonviolent way to get at the cash in an ATM. Encryption chip requirements are coming to the U.S. later this year, though. And given the gas raid’s many advantages, it may be only a matter of time until the back of an American ATM comes rocketing off.”

  13. Aztech

    This looks to me like maybe a customer could have done it. If he had walked up to the ATM for the umpteenth time to find the ATM “out of service” again, maybe a customer blew their stack. This is something I’ve wanted to do to my bank’s ATM on a number of occasions, since theirs is broke down so often. We need more good old fashioned ATM crime like this.

  14. HAVANCOURT

    For those interested the following is a blog that follows ATM related crimes and malware. A lot of focus on skimming as well as straight up theft of ATMs.

    http://www.atmsecurity.com/

  15. JCitizen

    I’d assume comically that most crooks doing this blow up the money too. I seem to remember reading this in wild west history. A true expert can do it without so much as singeing the paper.

  16. SirVeillance

    They might have fared better if they sold the ATM for parts.

  17. grimone

    I wonder if they would be deterred if there was one of those exploding ink capsules in the safe with the money. One that would detonate in cases the safe was not open properly?

  18. jim

    Personally, I am supprised. So much damage. I still wonder why they haven’t stollen one, and rebooked it to the network, to siphon off the names in ATM land. Surely, they , the bad guys, are smart enough to raise a ruze, a simple Brazilian movie from long ago, had the hero’s steal a device, and reconnect the device to a network, call home and request updates , wouldn’t have to really take a machine now, just copy the components, add a embedded os, and go happy, on a compromised system.
    But, maybe that is just Hollywood.

  19. iceman

    In Portugal the use propane gas tanks and blow them up next to the hinges to get into the cash.

  20. Mark Allyn

    Once upon a time, when we children abused a privilege or a toy, mommy would take it away from up as punishment.

    Now, when will these convenience stores and gas stations realize this is not worth is and simply remove the ATMs?

    1. meh

      The only reason ATMs exist is because the bank was too cheap to pay a teller $10/hr.

      1. Soy Tenley

        Banks are not open at 7 am in the morning or a 9 pm at night.

  21. Corey Nachreiner

    Yup… this sort of ATM hacking is kickin’ it ole’ school. Reminds me of the ATM theft (hacking) from the Barbershop movie back in 2002

  22. Le Monsieur

    In my neck o` the woods the criminals break in to the store/shop/various premises and await the security guys coming to refill the ATM..they then pounce from the shadows..thus dispensing with the need of “explosive gas” etc or for anything other than the correct keys obtained from said “held up” security guys.

  23. rick blaine

    This was just a hit on an ATM that was just plain destruction.

    No attempt at anything but that, pure and simple. So far I don’t see anyone here entertaining that OLD fashioned idea. Its like tipping over outhouses before inside plumbing.

Comments are closed.