Cybersecurity researchers have discovered multiple vulnerabilities in the cash dispenser used by a popular ATM manufacturer that can be exploited to make cash withdrawals.
The vulnerabilities in the Wincor Cineo ATMs with the RM3 and CMD-V5 dispensers were discovered by Positive Technologies’ Vladimir Kononovich and independent researcher Alexey Stennikov.
The researchers managed to bypass the protection against black-box attacks in modern ATMs by accessing the dispenser controller’s USB port, in order to install an outdated or modified firmware version, which enabled them to bypass the encryption and make cash withdrawals.
The researchers note that Wincor is currently owned by Diebold Nixdorf, which is one of the largest ATM manufacturers in the world, with its over a million installed ATMs giving it about 32% share of the global market.
Free money
In a 2018 research, Positive Technologies demonstrated that about 69% of the ATMs were vulnerable to what are known as black-box attacks, and can be broken into in minutes.
However, the researchers note that the current generation of ATMs, including the Wincor Cineo, have built-in protection against black-box attacks thanks to end-to-end encryption between the ATM’s computer and the cash dispenser.
“In the case of Wincor Cineo, we managed to figure out the command encryption used in the interaction between the PC and the controller, and bypass the protection against black-box attacks,” notes Kononovich.
He adds that the researchers got hold of the same dispensing controller as the one used in Wincor’s ATMs at “a popular website.” They then exploited bugs in the controller code and old encryption keys to connect to an ATM using their own computer, to upload older firmware, and bypass the encryption.
Kononovich says that some manufacturers rely on security through obscurity, and bank on the fact that it’ll be difficult for hackers to procure the hardware inside their ATMs to find vulnerabilities.
“However, our research shows that such equipment is not difficult to find on the open market and analyze, which can be used by criminal groups,” concludes Kononovich.
