Hackers have exploited a zero-day vulnerability in Common Bytes Bitcoin ATM servers to steal cryptocurrency from prospects.
When prospects would deposit or buy cryptocurrency through the ATM, the funds would as an alternative be siphoned off by the hackers
Common Bytes is the producer of Bitcoin ATMs that, relying on the product, enable folks to buy or promote over 40 totally different cryptocurrencies.
The Bitcoin ATMs are managed by a distant Crypto Application Server (CAS), which manages the ATM’s operation, what cryptocurrencies are supported, and executes the purchases and gross sales of cryptocurrency on exchanges.
Hackers exploit CAS zero-day
Yesterday, BleepingComputer was contacted by a Common Bytes buyer who advised us that hackers had been stealing bitcoin from their ATMs.
In line with a Common Bytes safety advisory revealed on August 18th, the assaults had been carried out utilizing a zero-day vulnerability within the firm’s Crypto Software Server (CAS).
“The attacker was capable of create an admin person remotely through CAS administrative interface through a URL name on the web page that’s used for the default set up on the server and creating the primary administration person,” reads the Common Bytes advisory.
“This vulnerability has been current in CAS software program since model 20201208.”
Common Bytes believes that the risk actors scanned the web for uncovered servers working on TCP ports 7777 or 443, together with servers hosted at Digital Ocean and Common Bytes’ personal cloud service.
The risk actors then exploited the bug so as to add a default admin person named ‘gb’ to the CAS and modified the ‘purchase’ and ‘promote’ crypto settings and ‘invalid cost tackle’ to make use of a cryptocurrency pockets beneath the hacker’s management.
As soon as the risk actos modified these settings, any cryptocurrency acquired by CAS was forwarded to the hackers as an alternative.
“Two-way ATMs began to ahead cash to the attacker’s pockets when prospects despatched cash to ATM,” explains the safety advisory.
Common Bytes is warning prospects to not function their Bitcoin ATMs till they’ve utilized two server patch releases, 20220531.38 and 20220725.22, on their servers.
Additionally they supplied a checklist of steps to carry out on the gadgets earlier than they’re put again into service.
You will need to do not forget that the risk actors wouldn’t have been capable of carry out these assaults if the servers had been firewalled solely to permit connections from trusted IP addresses.
Subsequently, it’s important to configure firewalls solely to permit entry to the Crypto Software Server from a trusted IP tackle, resembling from the ATM’s location or the client’s workplaces.
In line with info supplied by BinaryEdge, there are at present eighteen Common Bytes Crypto Software Servers nonetheless uncovered to the Web, with the bulk positioned in Canada.
It’s unclear what number of servers had been breached utilizing this vulnerability and the way a lot cryptocurrency was stolen.
BleepingComputer contacted Common Bytes yesterday with additional questions in regards to the assault however didn’t obtain a response.
