ATM Flaws Reveal Key Weaknesses in the Software Supply Chain

{"heading_1":"The Vulnerabilities Found in CryptoPro Secure Disk","paragraph_1":"Security researcher Matt Burch identified nine vulnerabilities in CryptoPro Secure Disk, a software used in ATMs and other industries. These vulnerabilities could have been exploited to bypass integrity checks and gain access to encrypted devices.","paragraph_2":"The flaws were discovered during Burch's work on ATM security, but he has since expanded his research to other industries. The software is marketed to ATM makers and used in some ATMs, including as part of Diebold Nixdorf's Vynamic Security Suite.","paragraph_3":"The vulnerabilities were patched in two phases with CryptoPro version 7.7.2 in early November and 7.7.3 in early December. The company, CryptWare, has maintenance agreements with all customers and notifies them in advance about security findings and the timeline for resolving them.","paragraph_4":"Diebold Nixdorf, the ATM maker, issued fixes related to the two relevant vulnerabilities in December. However, these fixes could not have been exploited on their own to compromise a Diebold Nixdorf ATM. The challenge lies in the software supply chain, where developers need to release patches, companies need to develop tailored fixes, and customers need to install the patches in the field.","paragraph_5":"Burch emphasizes the importance of transparency and patch adoption in critical industries like the financial sector and medical device manufacturing. The use of AI systems has made it easier to evaluate software and find vulnerabilities, even for researchers or attackers who don't have granular expertise in a given area."}