CyberSecurity Institute

Trend Micro and Computer Associates have both identified this niche, but some rivals question the immediate need for content filtering on cash points.

The new generation of Automatic Teller Machines (ATMs) are migrating from the IBM OS/2 operating system to Microsoft Windows and IP networks. This saves costs and enhances customer services. But it also means that ATMs are now at risk from computer worms, according to Trend Micro. “Previously isolated cash machines can now be infected by self-launching network viruses via the banks’ IP networks. Infections have the potential to bring down ATM machines, incurring downtime, customer dissatisfaction and increased costs fixing infected machines,” it warns.

Last August, the Nachi (Welchia) worm contaminated the cash machines at two financial institutions. When the Slammer virus hit the back end systems of the Bank of America in January 2003, 13,000 US ATMs became unavailable.

But never fear, Trend Micro is on hand to offer assistance. The Japanese-based firm is launching hardware-based network worm filtering technology specially designed for ATMs at a conference later this month. As well as launching its Network VirusWall 300 hardware, Trend will also be exhibiting at the annual ATM security conference (ATM Sec 4) in London on 25 and 26 October. Raimund Genes, European president of Trend Micro, said that 70 per cent of ATMs are based on either XP or embedded XP. “That’s the way manufacturers are taking the ATM and ticketing machine market,” he said.

Computer Associates offers a software development kit that can be applied to systems based on embedded XP.

Genes argued that producing AV systems for embedded XP terminals is far from straightforward: using existing enterprise content filtering gateways to protect ATMs would be “overkill”. Hardware-based network worm filtering, such as Trend intends to launch offers a better approach, he argued.

But other security vendors question the need for the technology.

Nigel Hawthorn, of security appliance firm Blue Coat Systems, said that ATMs commonly operate on a separate physical network, which is closed. “Sasser hit the back-end systems of banks, not ATM machines,” he said. David Emm, senior technology consultant at anti-virus supplier Kaspersky, agrees. “The threat to ATMs is related to how closely they are integrated with the outside world. Normally ATMS are kept on separate systems. Online financial (ebanking) systems are far more at risk,” he said.

Trend’s Genes said the barriers between the network used by ATMs and the wider Internet are been lowered as banks switch from older telecoms technologies to IP-based networks. He acknowledged that widely deployed AV technology alone is failing to protect enterprises from fast-spreading worms. But Trend’s worm filtering tech would prove far more successful in keeping cashpoints up and running in the face of viral onslaught, he says.

http://www.theregister.co.uk/2004/10/20/atm_viral_peril/

“The need for security is expanding beyond the PC,” wrote Jonathan Singer, an analyst with the Yankee Group, in an e-mail to TechWeb. “Mobile devices such as smart phones and PDAs, which are often used for business purposes without security integration, are opening new avenues for malicious code,” he added.

Early efforts by hacker to engage these devices were relegated to using them as entry points for viruses and worms delivered via e-mail, but as networked handhelds proliferate, tactics have changed. As other devices become networked–such as printers and copiers–and as voice over IP (VoIP) hardware grows in popularity, they’ll be targeted too, or used to launch additional attacks.

“Look for these types of attacks to become pervasive in the next 12 to 24 months,” Singer said.

Behavioral-based anti-virus protection doesn’t rely on one-to-one signatures to match against known malicious code, but examines possible malware for characteristics common to viruses and worms. Among their advantages are a theoretical ability to recognize unknown viruses–thus providing a defense against so-called “zero-day” attacks–less frequent updating, and smaller size.

“In the next two to four years, anti-virus software will migrate from signature recognition to a hybrid of signatures and behavioral recognition,” predicted Singer.

Enterprises should set policies on PDA and smartphone use, said Singer, to protect the network first, make handhelds productive second.

http://story.news.yahoo.com/news?tmpl=story&ncid=1211&e=10&u=/cmp/20041020/tc_cmp/50500906&sid=95609566