Two of the largest ATM manufacturers, Diebold Nixdorf and NCR, today released software updates to address bugs that could have been exploited for “deposit fraud” attacks.
Deposit forgery attacks occur when fraudsters are able to hack ATM software to modify the amount and value of currency deposited onto a bank card.
Such attacks are usually followed by rapid cash withdrawals, either on weekends or through transactions at other banks, with the fraudsters trying to tap into the non-existent funds before the banks detect any errors in the account balances.
Two similar bugs affect Diebold Nixdorf and NCR ATMs
Deposit forgery bugs are rare, but two were discovered last year and patched this year. Diebold Nixdorf has updated CVE-2020-9062, an issue affecting ProCash 2100xe ATMs running Wincor Probase software, while NCR has updated CVE-2020-10124, a bug in SelfServ ATMs running APTRA XFS software.
At their core, both bugs are the same, according to details published today by the CERT Coordination Center at Carnegie Mellon University.
CERT/CC states that ATMs do not encrypt, check, or verify the integrity of messages sent between the ATMs and the host computer.
An attacker who has physical access to connect to the ATM can tamper with these messages when cash and artificially inflate the deposited money.
Diebold and NCR secured their devices by releasing software updates that make it difficult for communications between the cash deposit unit and the computer.
Publication and reporting delayed due to sanctions
Both vulnerabilities, and others, have been discovered by security researchers working at Embedi, a Moscow-based security firm that was sanctioned by the U.S. Treasury Department in June 2018 for alleged collaboration with the Federal Security Service (FSB), Russia.
Before working with Embedi researchers to coordinate the public disclosure of these bugs, CERT/CC at CMU had to obtain special permission from the Office of Foreign Assets Control (OFAC) at the U.S..
