Cybersecurity (opens in new tab) researchers have discovered multiple vulnerabilities in the cash dispenser used by a popular ATM manufacturer that can be exploited to make cash withdrawals.
The vulnerabilities in the Wincor Cineo ATMs with the RM3 and CMD-V5 dispensers were discovered by Positive Technologies (opens in new tab)’ Vladimir Kononovich and independent researcher Alexey Stennikov.
The researchers managed to bypass the protection against black-box attacks in modern ATMs by accessing the dispenser controller's USB port, in order to install an outdated or modified firmware version, which enabled them to bypass the encryption (opens in new tab) and make cash withdrawals.
We're looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won't take more than 60 seconds of your time, and we'd hugely appreciate if you'd share your experiences with us.
>> Click here to start the survey in a new window (opens in new tab) <<
The researchers note that Wincor is currently owned by Diebold Nixdorf, which is one of the largest ATM manufacturers in the world, with its over a million installed ATMs giving it about 32% share of the global market.
In a 2018 research (opens in new tab), Positive Technologies demonstrated that about 69% of the ATMs were vulnerable to what are known as black-box attacks, and can be broken into in minutes.
However, the researchers note that the current generation of ATMs, including the Wincor Cineo, have built-in protection against black-box attacks thanks to end-to-end encryption between the ATM’s computer and the cash dispenser.
"In the case of Wincor Cineo, we managed to figure out the command encryption used in the interaction between the PC and the controller, and bypass the protection against black-box attacks,” notes Kononovich (opens in new tab).
He adds that the researchers got hold of the same dispensing controller as the one used in Wincor's ATMs at “a popular website.” They then exploited bugs in the controller code and old encryption keys to connect to an ATM using their own computer, to upload older firmware, and bypass the encryption.
Kononovich says that some manufacturers rely on security through obscurity, and bank on the fact that it’ll be difficult for hackers to procure the hardware inside their ATMs to find vulnerabilities.
“However, our research shows that such equipment is not difficult to find on the open market and analyze, which can be used by criminal groups,” concludes Kononovich.