Zero-day Vulnerability: Hackers use vulnerability in Bitcoin ATMs

Anyone who wants to buy units of the cryptocurrency Bitcoin quickly and anonymously has been able to use special machines for this for quite some time. However, a vulnerability can be found on some devices. The loophole has allowed hackers to steal from customers.

Once a customer uses one of the affected machines to buy or deposit the cryptocurrency, the transaction in question is forwarded to the hackers. A zero-day vulnerability in General Bytes machines is responsible for this. The company makes ATMs that offer more than 40 different cryptocurrencies. The machines are controlled via a Crypto Application Server (CAS), which carries out the actual transaction. General Bytes ATMs can be found in many places in Europe.

While General Bytes makes the machines, customers such as retailers are usually responsible for operating the machines and the associated server. Noisy bleeding computer a bug in the CAS software meant attackers could use a URL call to create a new administrator account called “gb” on the server. The hackers could then adjust the settings to their liking.

Operators need to install patches

It is currently unclear how many servers have been hacked. This also leaves open what damage the hackers could do. General Bytes recommends vending machine operators shut down the machines until two patches are installed on the associated servers. In addition, the machine owners must ensure that they configure their firewall so that no foreign IP addresses can connect to the server. Despite the vulnerability, the attacks could have been prevented quite easily.