As computer technologies are widely used in credit and financial institutions, risk management is an extremely relevant topic in the information technology security in banking structures. This article is focused on the problems of assessing the risks of information security breaches in automated teller machine (ATM). To increase the level of security of banking services for individuals and legal entities in accordance with the recommendations of information security standards by analyzing the risk of information security violations in electronic banking technologies (on the example of the “Brute force” and “Black box” attacks). Empirical methods of scientific knowledge (observation, measurement, experiment), theoretical methods (analysis, synthesis, induction, deduction, abstraction, formalization), graphical interpretation of information, probability theory methods. Standards for effective management of information security management at the enterprise are considered. The advantage of social engineering methods over the “Brute force” method of PIN codes is shown quantitatively. The time characteristics of commission and protective measures against attacks of the “Black box” type are analyzed. A method for improving the effectiveness of the response and protection of ATMs from attacks of the “Black box” type is proposed. The influence of school literature on scientific and technical progress is analyzed. Based on this, recommendations of the authors are given.
Over the past decades, the conditions for the operation of commercial banks in all countries of the
world have undergone significant changes. The factors of scientific and technological progress have led
both to the emergence of new financial instruments and opportunities for banks [
The ISO/IEC 27000 series of international standards includes information security standards published jointly by the International Standardization Organization (ISO) and the International Electrotechnical Commission (IEC). The set consists of best practices and recommendations in the field of information security for creation, development and maintenance of information security management systems (ISMS). The combined application of these technical documents is depicted on the Figure 1. Each of them aims to investigate specific problems in information security management.
In addition, the set of standardization documents of the Central Bank of the Russian Federation
contains a unified approach to ensuring information security of banking system organizations (ISBS)
and recommendations for standardization (RS) with regard to the requirements of Russian legislation.
The fundamental standard in the reviewed area is STO BR IsBS-1.0-2014 “Ensuring information
security of organizations in the Russian Federation’s banking system. General Provisions", its goals
and objectives can be found at [
Cyberspace is an important component of modern society. If one country launches a large-scale
attack on the power plants or commercial banks of another country, military measures can be taken not
only in the virtual, but also in the real world. A cyberattack that disrupts normal functioning, leads to
panic, riots or loss of life, can trigger a loud forceful response [
According to the data achieved by the FinCERT of the Bank of Russia and the information represented in the reporting form 0403203, the main reason for the execution of cyberattacks in the banking sector is misinformation (97% in 2018, and 92% in 2017). For legal entities, the indicator was 39%2.
PIN code should contain four characters, each represented with digits from 0 to 9. Omitting the real situation when automated teller machines (ATMs) block or “eat” the card after three incorrect PIN codes, and considering the fact that PIN code brute forcing is technically not harder than social engineering, we will determine the time required for the search.
The number of possible code combinations is N = 104 −10 = 9990 (ten digits appearing together in four positions, excluding numbers with four identical digits). 2 Main Development Trends in Information security in Credit and Finances for the Period 2019–2021. Moscow: Central Bank of the Russian Federation, 2019, 26 p. URL: https://www.cbr.ru/Content/Document/File/83253/onrib_2021.pdf (accessed on 02.04.2020) (in Russian). 1. The probability of correct guess at the first step is P1 = 1 N ; 2. The product of the 1 ( N −1) probability (one step less) and the conditional probability after 1 N
N −1 =
N completing the first step 1 −
. The probability of correct guess at the second step is P2 = 1 ⋅
N −1 = 1
;
N −1 N N 3. The product of the 1 ( N − 2) probability (two steps less), the conditional probability after the second step 1 −
1 N −1
N − 2 = , and the conditional probability after the first step (known)
N −1 1 − 1 N −1 1 N − 2 N −1 1 = . The probability of correct guess at the third step is P3 = ⋅ ⋅ = ; N N N − 2 N −1 N N 4. The product of the 1 ( N − 3) probability (three steps behind), the conditional probability after the third step 1 −
1 N − 2
N − 3 =, the conditional probability after the second step (known)
N − 2 1 − P = 4
N −1 The 1 N − 2 = , and the conditional probability after the first step (known) 1 −
N −1 probability of finding the correct answer at the 1 N − 3 N − 2 N −1 1
⋅ ⋅ ⋅ = .
N − 3 N − 2 N −1 N N 1 N −1
=
N N
fourth
.
step
is
At any step, the probability of guessing the PIN code is PN =
[
N ⋅1 + ⋅ 2 + ... + ⋅ N = ⋅ (1 + 2 + ... + N ) =
N 1 ( N + 1) ⋅ N ⋅
= 2
N + 1 2 (1) Let's assume that each step takes 15 sec =hour . Then, the mathematical 15 =hour 60 ⋅ 60
1 240 expectation of finding the PIN code is
≈ 21 hour .
2 ⋅ 240
Successful social engineering techniques are limited to minutes, so they are definitely better to use
for criminal purposes [
Thus, mutually beneficial cooperation is organized: mobile operators list phones of popular banks in their SIM card SDN, banks advertise these operators on their plastic cards, while customers improve their literacy and security.
1
N 9991
Ensuring the security of banking information systems is a complex process performed according to
a number of different methodologies and requires compliance with many standards, such as IS DB
ISBS, GOST R ISO/IEC 15408 [
A significant threat to the banking sector is hardware and software systems designed to steal money
from ATMs, that are called Black boxes - equipment with special software that connects to a dispenser
(money issuing mechanism) instead of commercial bank's experts’ working computers. Further, the
ATM gets controlled by cybercriminals, and the data is transferred using contactless technologies (for
example, from a smartphone) [
Thus, according to the Black box cyberattack statistics for 2012–2018, there is a rapid increase in the number of cases in all sampled countries (Figure 2).
The statistics published in the European Payment Terminal Crimes Report (Table 1) [
H1 2017
H1 2018
H1 2019
H1 2020 % +/– 19/20 1,604 €27m 1,696 €12.2m 2,046 €15.1m 2,376 €11.4m 1,829 €12.6m H1 2016
H1 2017
H1 2018
H1 2019
H1 2020 % +/– 19/20 28 €0.41m
114 €1.51m
61 €0.25m
35 €0.00m
129 €1.00m –23% +11% +269%
N/A
Source: European Association for Secure Transactions (EAST)3
According to the Director of Security at BI.ZONE [
Considering the above-mentioned facts, it can be affirmed that Black box attacks are a relevant and dangerous attack vector in the current environment, despite the protective measures applied by banks. Let's consider their main characteristics and offer relevant protection methods. 3.1.
As we know, Black box is a logical type of cyberattacks that allows criminals to steal money from
the ATM safe [
To perform a Black box attack, criminals need a device with interface controllers to connect to the
dispenser port and a software to manage it. Typical interfaces are RS232, RS485 or USB. Single-board
computers or laptops are usually used as a control device due to their mobility. To connect the Black
box device, it is necessary to disconnect the dispenser from the ATM control unit, but if the RS485
protocol is used, it can be paralleled. There have also been recorded cases of using smartphones,
controlled from the outside, as Black box devices [
Let's list the key features of Black box attacks: 1. The attacker needs to gain access to the dispenser interface or the central bus of ATM devices. 2. Interaction with the ATM dispenser occurs from a separate device, so the attack does not leave traces of the operations performed in security logs. 3. To create a Black box device, cybercriminals require knowledge of the ATM’s internal mechanisms and its software. 4. The success of the attack does not depend on the operating system (OS), processing center and ATM management software. 5. Official utilities issued by banking software developers are used to interact with the dispenser. Usually, utilities have protection against malicious use, yet cybercriminals bypass it by changing the program code. 3.2.
Having received an idea of the attack method and the resources required for it, we will analyze the temporal characteristics of its execution.
According to the analytical article [
1) opening the ATM service area - Tv . Depending on the method, it takes from 3 seconds to 2 minutes; a. using a physical key (genuine or a copy) to open the service zone cabinet ( Tv1 ) – few seconds; b. opening the lock of the service zone cabinet ( Tv2 ) – from 30 to 60 seconds; c. cutting a hole in the ATM front panel ( Tv3 ) - from 60 to 150 seconds.
2) connecting the Black box device to the interface or data bus ( Tp ). Depending on the cybercriminal's skills, the process takes 20 to 60 seconds.
3) withdrawal of funds through the dispenser ( Ti ). Depending on the model, the ATM safe can hold up to 8000 banknotes of different denominations, which are in four special cassettes. The ATM contains from 3 to 14 million rubles. This variation is caused by a number of factors, such as the ATM type, its location, banknote discharge rate, and the amount insured.
The ATM type determines the set of functions: cash deposit or cash withdrawal. ATMs for withdrawal initially have more money cassettes, and ATMs for depositing – more empty cassettes. There are also ATMs that work for both withdrawing and depositing cash. They use both full and empty cassettes.
Cassettes can be filled with a different number of bills and bills of various denominations. It depends on the place of installation and the banknote discharge rate. The ATM insurance amount also affects, banks cannot store more funds in an ATM than provisioned in the insurance contract.
The average amount of funds usually found in a fully loaded universal ATM is about 7-8 million
rubles. At a time, the dispenser retrieves a maximum of 40 banknotes from the safe, and the delay
between operations is 20 seconds. Thus, the complete removal of banknotes from the safe will take
4000 seconds (1 hour 7 minutes), which means from 4000 rubles to 200,000 rubles in 20 seconds.
According to the information about the performed attacks, each cash withdrawal procedure took from
1 to 3 hours [
Information about the time frame of the operations was obtained by analyzing publicly available video materials [19] and information from experts in the field of ATM attacks4.
The decisive factor limiting the duration of a cyberattack ( Ta ) is the actions of certain defense systems, including the alarms being triggered and the arrival of the police. The rules for the arrival of law enforcement agencies are not regulated by law, but usually the minimum time for the arrival of a police squad or employees of a private security company ( Tn ) is 4-7 minutes.
The execution a cyberattack consists of three stages, and its duration can be represented as:
Ta < Tn
Ta = Tv + Tp + Ti
Tprep. min = Tv1 min + Tp min = 3 sec + 20 sec = 23 sec
Tprep max = Tv3 max + Tp max = 150 sec+ 60 sec = 210 sec The fundraising process will continue until the arrival of the law enforcement forces:
Textr =Tn − Tp Then, the maximum and the minimum duration of fundraising equals to:
Textr min =Tn max + Tprep min =420 sec− 23 sec =217 sec Smax =Textr min ⋅ 5000 rub = 20 sec
20 sec
Textr max =Tn min + Tprep max =240 sec− 210 sec =30 sec (9)
Every 20 seconds ATM dispenses 40 bills, therefore, with bills of the maximum denomination (5,000 rubles), criminals can withdraw 200,000 rubles every 20 seconds.
Thus, the maximum and minimum amount of money that cybercriminals manage to withdraw before the arrival of law enforcement agencies is equal to: 217 sec
⋅ 5000 rub =2 000 000 rub Smin =Textr max ⋅ 5000 rub = 20 sec 30 sec 20 sec ⋅ 5000 rub =200 000 rub (2) (3) (5) (6) (7) (8) (10) (11)
According to the calculations, cybercriminals can withdraw from 200,000 to 2,000,000 rubles. The Figure 5 shows the dependence of the amount of theft on the arrival time of the police, red lines indicate the interval of the maximum and the minimum amounts if the arrival of the police is in the interval from 4 to 7 minutes. If the opening of the service area was not noticed, then the amount of losses will be even greater, up to the complete withdrawal of the funds available in the safe.
4 A. Osipov and O. Kochetova, Hack Your ATM with Friend's Raspberry.Py, Video, 15:57, 2015.
URL: https://www.youtube.com/watch?v=q5tQWe6YsLM (accessed on 15.01.2021).
Thus, when a Black box attack is performed, damage is possible even with an immediate response
to the fact of its occurrence. This requires monitoring systems and transaction indicators that can signal
an attack, but to completely prevent damage, it is necessary to prevent the opportunity for the attacker
to start using the ATM receiver in such a short time. Next, we will consider the available protective
measures against this type of attacks and propose additional protection methods [
According to ATM vendors' recommendations, it is recommended to use current versions of XFS platforms that provide strong encryption and support physical authentication between the OS and the dispenser. With physical authentication, encryption keys are transmitted only if the legality of access to the safe is confirmed. These measures do not guarantee security, for example, there is a case when cybercriminals managed to bypass physical authentication [20-23].
There are special devices that provide protection against unauthorized connection to the dispenser. For example, ZUB-R, Cerber Lock and ATM Keeper. They allow to perform only operations authenticated by the banking software and expand the monitoring of ATM security events. The main problem with this method of countering cyberattacks is the small percentage of ATMs that use these devices. According to the data provided by ANSER PRO LLC and Artifakts LLC, these devices are used in 15,000 ATMs, which is 7% of the total number of ATMs [24-27].
Thus, the above methods do not provide reliable protection against Black box attacks. We need to develop a reliable way to increase the time it takes for a cybercriminal to access the dispenser. A possible way would be to set a time delay for starting the dispenser after it is turned on. The minimum duration of such a delay is 217 seconds. Using reliable signaling means, this will reduce the number of cases of successful Black box ATM operations.
Currently, the most powerful computing systems belong to Japan, the USA and China. The Japanese supercomputer Fugaku has a peak performance of 537 petaflops; Russian "Christofari" (owned by Sberbank) - 8 petaflops of capacity5.
At the beginning of the XXI century, Chinese researchers were concerned about the lack of inventors in China. Therefore, they sent a delegation to well-known American companies (Apple, Microsoft, Google) and asked people who are “inventing the future” about their lifestyle. Identifying common behavioral patterns has shown that one of their favorite genres of literature is science fiction. Corresponding books were introduced into the literature course outline in China schools, and today such manufacturers as Xiaomi, Tencent, and Huawei, are among the world leaders.
It may be explained with a combination of the inherent traditional formation and the functioning of mirror neurons. Mirror neurons are glial cells of the brain that are being activated not only while performing a certain action, but also while a person observes this action performed by others [24]. Scientific and technological progress is discussed in so-called “hard” science fiction (HSF). The authors propose to increase the amount of HSF offered for study in literature classes and included in the “100 books for schoolchildren” list.
The Office of the Prosecutor General of Russia called cybercrimes a threat to the country's national security, especially given their low detection rate, recorded at a level of no more than 25%6. Banking practice shows the need to improve risk management and information security systems in electronic banking. The implementation of electronic banking systems allows credit institutions to significantly reduce operating expenses, but at the same time, electronic banking is associated with additional sources of traditional banking risks. The advantage of social engineering over technical hacking methods is shown mathematically. Thus, new cybersecurity challenges require the continuous improvement of solutions and the significant revision of risk management procedures applied by banks and their customers while using electronic banking systems (and, in particular, ATMs) [26].
The measures considered in this article are aimed at improving the efficiency of responding to information security incidents and, in particular, at developing a system for protecting customers from social engineering methods and ATMs, from Black box attacks. The article analyzes Brute Force and Black box types of cyberattacks on ATMs. The scientific novelty of the work consists in the solution proposed by the authors on weakening the social engineering techniques as a result of comparing their effectiveness with the effectiveness of the Brute force method. The practical significance of the work lies in determining the temporal features of the Black box attack and developing additional ATM protection measures.
Efficient development of electronic banking requires both traditional measures to improve financial and computer literacy, and the local adaptation of foreign experience to unlock the scientific and technical potential.
Translation of this article into English was organized with the support of Anna B. Bakh and the Center for translation and internal review of the Financial University under the Government of the Russian Federation. URL: http://www.fa.ru/org/science/cpvr/Pages/Home.aspx. 5 D. Pisarenko “Russia in a calculation race. Why does our supercomputer power give way even to Saudi Arabia?”. Weekly Newspaper “Arguments & Facts”. 2021. № 8. С. 15.
URL: https://aif.ru/society/science/gonka_vychisleniy_pochemu_nashi_superkompyutery_otstayut_ot_zarubezhnyh (accessed on 04.03.2021). 6 General Procurator’s Office say that cybercrime constitutes a danger to Homeland Security”. URL: https://tass.ru/obschestvo/11451173 (reference date 24.05.2021).