r/blackhat • u/wiredmagazine • 7d ago

ATM Flaws Reveal Key Weaknesses in the Software Supply Chain

https://www.wired.com/story/atm-flaws-reveal-key-weaknesses-in-the-software-supply-chain/
• Upvotes

76% Upvoted

3 comments sorted by

•

u/wiredmagazine 7d ago

For the past five years, security researcher Matt Burch has immersed himself in the esoteric and high-stakes world of ATM security, in which small software flaws can sometimes expose cold, hard cash. As Burch has bored deeper into the computers powering these digital lock boxes—and continued to find vulnerabilities in key digital security systems—he has started working to raise the alarm, not just about overlooked ATM flaws, but about how that same software used in other industries can introduce weaknesses in an array of critical systems.

At the Black Hat and Defcon security conferences in Las Vegas this month, Burch presented findings about nine vulnerabilities that have been fixed in disk encryption and pre-boot authentication software called CryptoPro Secure Disk. The flaws could have been exploited to bypass CryptoPro's integrity checks and gain full access to encrypted devices.

Made by the German software firm CryptWare, CryptoPro is marketed to ATM makers and is used in some ATMs, including as part of Diebold Nixdorf's Vynamic Security Suite. But CryptoPro is also sold as a security solution for other embedded-device makers, as well as big organizations using Microsoft Windows, underscoring the supply chain challenge of addressing bugs when software is widely implemented in numerous industries.

Read the full story at the link above.

•

u/Just_Worldliness_714 7d ago

The real story here isn't the ATM angle, it's that CryptoPro Secure Disk gets reused as generic pre-boot auth/disk encryption across totally unrelated embedded device categories. Nine bugs in one vendor's pre-boot auth stack means every OEM that licensed it inherited those bugs silently - this is the same supply chain pattern as XZ or the Heartbleed blast radius, just less famous because "ATM security researcher" doesn't grab headlines the way "core internet infrastructure" does.