General Bytes Bitcoin ATMs Hit by Zero-Day Cyberattack

General Bytes Bitcoin ATMs Targeted in Cyberattack Using Zero-Day Vulnerability

In a striking cyberattack on General Bytes, a prominent Bitcoin ATM manufacturer, attackers exploited a zero-day vulnerability in the company’s software to steal cryptocurrency directly from its Bitcoin ATMs. General Bytes disclosed that the attack leveraged a security gap in their Crypto Application Server (CAS), a software solution managing Bitcoin ATMs remotely. This incident has raised alarm within the cryptocurrency community, highlighting the security risks in decentralized finance and cryptocurrency systems.

Understanding the Attack: Exploiting CAS Vulnerabilities

The CAS software at the heart of the incident allows businesses to manage Bitcoin ATMs (BATMs) from a centralized interface, typically accessed via a desktop or mobile browser. Attackers targeted this system's management interface, using it to create an unauthorized administrator account remotely. By finding the installation page and creating a user with elevated privileges, the attacker gained direct access to the Bitcoin ATMs’ transaction systems.

General Bytes reported that the vulnerability in question has existed in CAS software versions since 2020. However, it only recently became known to the company after this cyberattack. The flaw allowed malicious actors to add a new administrator user by scanning public IP addresses for CAS services, especially those on DigitalOcean's IP address space, where many CAS instances were hosted.

Analyzing the Zero-Day Vulnerability in CAS

A zero-day vulnerability is a previously unknown flaw in software that attackers can exploit before developers patch it. Here, the CAS software’s admin interface presented a critical vulnerability that allowed anyone with access to add a new admin user, bypassing typical authentication and verification protocols. By scanning for open CAS services on ports 443 and 7777, the threat actor could locate vulnerable systems and add a new admin user named “GB,” gaining instant access to the Bitcoin ATMs under that CAS's control.

This attack method underscores the risks associated with centralized control interfaces. When these interfaces have vulnerabilities, any connected device, like a Bitcoin ATM, becomes susceptible to unauthorized access and manipulation.

Immediate Responses and Long-Term Implications for Bitcoin ATMs

In response to the incident, General Bytes issued two new CAS software versions, 20220531.38 and 20220725.22, addressing the zero-day vulnerability and introducing additional security measures to block unauthorized access. The company has advised all CAS users to update to these versions immediately and to review their administrative settings for any unexpected entries.

However, this attack has broader implications. Cryptocurrency infrastructure remains a lucrative target for cybercriminals due to the irreversible nature of transactions, the difficulty of tracking stolen cryptocurrency, and the overall lack of standard security regulations in the decentralized finance space.

Lessons Learned: Strengthening Cryptocurrency Infrastructure Security

1. Regular Security Audits and Patching

Given the serious nature of zero-day vulnerabilities, especially in software controlling financial devices, regular security audits are crucial. This includes testing for vulnerabilities across CAS, encryption protocols, and server interfaces that can serve as attack vectors. Patching software in a timely manner can be challenging, but it is essential to address known issues before attackers can exploit them.

2. Monitoring Access Logs and Administrative Changes

Attackers in this case were able to create an admin user remotely. To detect similar threats, companies can implement monitoring protocols that flag unusual administrative actions, such as creating or modifying users with high-level access.

3. Rethinking Decentralized Security Protocols

While decentralization remains at the core of cryptocurrency, the infrastructure supporting it often relies on centralized software like CAS, which presents a security paradox. Balancing the advantages of decentralized transactions with robust security for centralized management interfaces is crucial.

4. Collaboration with Hosting Providers

General Bytes’ case reveals that attackers used DigitalOcean’s IP space to locate vulnerable CAS servers. By collaborating closely with hosting providers, companies can gain better visibility into access attempts and potential breaches, especially in cloud environments.

Moving Forward: What Bitcoin ATM Operators Can Do

For Bitcoin ATM operators, this incident serves as a wake-up call to reassess security practices and regularly update software to patch vulnerabilities. Additionally, human error often plays a role in successful breaches. Training staff on cybersecurity best practices and understanding common attack vectors can help protect ATMs and their customers from future attacks.

For further insight on training against cybersecurity threats, refer to our Security Awareness Training for Employees.

Editor's Note: This blog was updated on November 15, 2024.