Bitcoin ATMs Hacked: Hackers Exploit Zero-Day Bug to Drain Machines
The emergence of cryptocurrencies has become a major financial force, transforming the way people buy and sell digital assets. Bitcoin ATMs provide an accessible and convenient way for users to access these digital currencies. Unfortunately, such convenience has come with its own risks, as recent news of a General Bytes Bitcoin ATM hack has highlighted. The attack resulted in the theft of $1.5 million in crypto and has highlighted the importance of understanding the security risks associated with these machines.
Summary of Attack
The attack occurred between the 17th and 18th of March 2023 and was conducted by an attacker who uploaded and ran malicious software to gain access to the ATM’s database. This allowed them to read and decrypt encoded API keys needed to access funds, which were then used to withdraw crypto to a separate wallet.
Vulnerability Explained
Bitcoin ATMs allow customers to connect to a centralized authentication server (CAS) either they, or the company, manages. Customers are allowed to upload videos from the terminal to the CAS. This is where the bug was hiding which allowed the attacker access to the funds in the ATM. The bug was a zero-day vulnerability, meaning that it was previously unknown and had no existing patch or fix available.
Response from General Bytes
General Bytes responded quickly and addressed the issue 15 hours after being alerted to the flaw. Despite this prompt response, it was not quick enough to prevent the theft of $1.5 million in crypto. General Bytes released an update to their software which patched the flaw and prevented any further attempts at exploiting it.
Conclusion
The attack on General Bytes Bitcoin ATM serves as a reminder that security risks associated with these machines should be taken into consideration when using them. It is important to ensure that all security measures are up-to-date, including updates on software and updates on firmware for the ATM itself. Regularly checking for potential vulnerabilities is also essential in order to prevent similar attacks from happening again in the future.
