Bitcoin ATMs drained after hackers exploit zero-day bug
Hackers stole 56 bitcoin from ATMs using zero-day
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Unknown hackers have managed to steal 56 bitcoin, worth approximately $1.5 million, from specialized ATMs designed to distribute cryptocurrency, The worst part is - the stolen funds partially belonged to the ATM’s customers, as well.
According to the report, the ATMs work by allowing customers toconnectit to a crypto application service (CAS) either they, or the company, manages. However, the ATM also allowed customers to upload videos from the terminal to the CAS - which is apparently where the bug was hiding.
A previously unknown, zero-day vulnerability, allowed the threat actors to upload and run a malicious Java application, and use it to drain the CASes operated by both the company, and its customers.
Keeping customers afloat
General Bytes, the company behind the ATMs, addressed the issue 15 hours after being alerted to the flaw. However, the only way to get the funds back is to have the police find and arrest the perpetrators, then confiscate and return the stolen cryptocurrency - which is obviously easier said than done.
“The night of 17-18 March was the most challenging time for us and some of our clients. The entire team has been working around the clock to collect all data regarding the security breach and is continuously working to resolve all cases to help clients back online and continue to operate their ATMs as soon as possible,” the company wrote in an announcement.
“We apologize for what happened and will review all our security procedures and are currently doing everything we can to keep our affected customers afloat.”
Here’s our list of the best endpoint protection services>Bitcoin ATM bug let thieves siphon off crypto withdrawals>Australia gets its first Bitcoin ATM
By uploading and running themalware, the attacker gained access to the ATM’s database, was allowed to read and decrypt encoded API keys needed to access the funds, and finally managed to withdraw the crypto to a separate wallet. Furthemore, the attackers managed to download usernames and password hashes, turn off multi-factor authentication (MFA), and access terminal event logs to scan for customer private keys.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
One of the things General Bytes is changing, going forward, is that it will no longer manage CASes for its customers - they will have to do so themselves (if they decide to stick around at all).
Via:Ars Technica
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
Your doctor may have an AI assistant taking notes during your next Zoom call
