Anyone who wants to buy units of the cryptocurrency Bitcoin quickly and anonymously has been able to use special machines for this for quite some time. However, a vulnerability can be found on some devices. The loophole has allowed hackers to steal from customers.
Once a customer uses one of the affected machines to buy or deposit the cryptocurrency, the transaction in question is forwarded to the hackers. A zero-day vulnerability in General Bytes machines is responsible for this. The company makes ATMs that offer more than 40 different cryptocurrencies. The machines are controlled via a Crypto Application Server (CAS), which carries out the actual transaction. General Bytes ATMs can be found in many places in Europe.
While General Bytes makes the machines, customers such as retailers are usually responsible for operating the machines and the associated server. Noisy bleeding computer a bug in the CAS software meant attackers could use a URL call to create a new administrator account called “gb” on the server. The hackers could then adjust the settings to their liking.
It is currently unclear how many servers have been hacked. This also leaves open what damage the hackers could do. General Bytes recommends vending machine operators shut down the machines until two patches are installed on the associated servers. In addition, the machine owners must ensure that they configure their firewall so that no foreign IP addresses can connect to the server. Despite the vulnerability, the attacks could have been prevented quite easily.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments.
