The term jackpotting is used to describe a method criminals use to steal money from an ATM. The thieves gain physical access through a small hole opened in the machine. They replace the existing hard drive and connect an external drive with a new connection. They then press an internal button that restarts the device so that it is under the control of the external drive. After that, they can make the ATM dispense all of its cash.
Types of jackpotting
- Black box attack: The attackers connect their own device to the ATM's cash dispenser, bypassing the ATM's computer and sending commands directly to the dispenser.
- Malware attack: Malware is installed on the ATM's computer. The software makes the ATM dispense cash on a specific command.
In both methods, the attackers need physical access to the ATM.
Countermeasures
- Encrypting the communication between the ATM computer and the cash dispenser
- Locks and alarm systems that prevent unauthorized access to the top section of the ATM
- Keeping the operating system and ATM software up to date
- Application control that allows only approved software to run
- Preventing the system from booting from external devices
Why does it matter?
In jackpotting attacks, money is stolen directly from the ATM's safe, not from cardholders' accounts. The loss therefore belongs to the bank that owns the ATM. The attacks usually target ATMs in locations with poor maintenance or little surveillance.
