Hackers exploit zero-day bug to steal from General Bytes Bitcoin ATMs

Bitcoin ATM manufacturer General Bytes had its servers compromised via a zero-day attack on Thursday that enabled hackers to make themselves the default administrators and modify settings so that all funds would be transferred to their wallet address.

The amount of funds stolen and the number of ATMs compromised have not been disclosed, but the company has urgently advised ATM operators to update their software.

The hack was confirmed by General Bytes, which owns and operates 8,827 Bitcoin ATMs that are accessible in over 120 countries. The company is headquartered in Prague, which is also where the ATMs are manufactured. ATM customers can buy or sell over 40 coins.

The vulnerability has been present since the hacker’s modifications updated its Crypto Application Server (CAS) software to version 20201208 on Thursday.

General Bytes has urged customers to refrain from using its General Bytes ATM servers until it updates its server to patch releases 20220725.22, and 20220531.38 for customers running on 20220531.

Customers have also been advised to modify their server firewall settings so that the CAS admin interface can only be accessed from authorized IP addresses, among other things.

Before reactivating the terminals, General Bytes also reminded customers to review their “SELL Crypto Setting” to ensure that the hackers didn’t modify the settings such that any received funds would instead be transferred to them (and not the customers).

General Bytes stated that several security audits had been conducted since its inception in 2020, none of which identified this vulnerability.

How the attack happened

General Bytes’ security advisory team stated in the blog that the hackers conducted a zero-day vulnerability attack to gain access to the company’s CAS and extract the funds.

The CAS server manages the ATM’s entire operation, which includes the execution of buying and selling of crypto on exchanges and which coins are supported.

Related: Vulnerable: Kraken reveals many US Bitcoin ATMs still use default admin QR codes

The company believes the hackers “scanned for exposed servers running on TCP ports 7777 or 443, including servers hosted on General Bytes’ own cloud service.”

From there, the hackers added themselves as a default admin on the CAS, named Gb, and then proceeded to modify the “buy” and “sell” settings so that any crypto received by the Bitcoin ATM would instead be transferred to the hacker’s wallet address:

“The attacker was able to create an admin user remotely via CAS administrative interface via a URL call on the page that is used for the default installation on the server and creating the first administration user.”