UPDATED WITH REFERENCES: Black Boxes being heavily utilized in ATM fraud attacks

We have several confirmed reports of recent arrest and the increase in the use of black box ATM machine hacks. There have been confirmed reports out of Russia and in the recent case of Thomas Gilbert (according to MSNBC). Many police departments are operating on memorandum that shows pictures of what the devices look like and some reports are coming in to Investigators that these devices are increasingly showing up as a result of criminal search warrants often times for unrelated issues.

It is believed that the same group responsible for the Home Depot breaches may in fact be related to the increase in the number of these devices being discovered.

 

In the photo above you can clearly see the serial interface utilized to conduct this attack.

Additional information will be released to members of our OSINT-X service. 

NOTHING FOLLOWS 

Related and Updated Information:

Cash machines pay out after USB module gets a call from a Galaxy S4 (Originally Reported by Krebs)

Location: UK
Carders have jackpotted an ATM by inserting a circuit board into the USB ports of an ATM, tricking it into spitting out cash.

The technique was thought to have emulated the cash dispenser of the ATM so the brains of the machine thought everything was normal, buying additional time for the brazen crooks to make off with the cash.

Additional reference material (Pic Above)

Additional Details and Reports:

NCR puts out notice to customers alerting them to be vigilant with this issue 1/6/2015 - This appears to be what alerted Krebs to the issue that he initially reported on

NCR reports black boxing being heavily utilized by criminals in Mexico 1/8/2015

SLC Security obtains independent report of organized criminal activity related in UK, Mexico and Canada via our clients and financial service partners of issues related to black boxing 1/8/2015

SLC Security noted Twitter activity of bragging of successful attacks 1/8/2015 - It is believed that plans and code are being sold to build boxing devices.

FRAUD ALERT: Domain's posing as Valve Corp (Russian)

UPDATE:
We were contacted by the hosting provider Akamai and advised that the domain in the capture below is actually an imposter out of Russia. Upon researching the information provided the registration information of the associated record below does not match other legitimate Akamai domain registrations so we have taken the following actions to correct this bulletin.

1. Removed the Akamai netblock from our temporary block list
2. Blocked all associated domains related to the fraudulant actors
3. Provided an update on the VD blog

We are glad that we were contacted as this helps us in keeping our information accurate. If you reach out to us as Akamai did we will work with you to confirm, verify or remove information that is in error.

Thank You for assisting us Akamai




Original Vuln Disclosure Article:

This isn't in the news but we can tell you that Valve is once again owned. We have seen clear evidence, packet captures and information being sold in the underground that are clearly not for public disclosure. Why don't these "Media" companies hire people that understand media. Valve is another repeat offender with the likes of Sony (which also has issues this week).

Valve keeps trying to keep hackers out but they have to understand that hackers are who made them in the first place. Game on my friends. Let's see if Valve put's out any public statements or see if they can find their Spreadsheets out on the Internet anywhere...     You might wanna try Pastebin guys!

Oh and your still on our blacklist for NOT securing your network the first time.

UPDATE: Oh and it's great that your web servers are now hosting the malware... Maybe they are planning on attacking your customers as well....

12-02-2014,screen-hosting.net,Valve Corp.