ScrutisWeb is a secure solution that aids global organizations in monitoring ATMs, enhancing issue response time, and this solution is accessible through any browser.
The following things could be done with the help of this secure solution:-
- Monitor hardware
- Reboot a terminal
- Shut down a terminal
- Send files
- Receive files
- Modify data remotely
- Monitor the bank card reader
Cybersecurity researchers at Synack recently discovered several vulnerabilities in the ScrutisWeb ATM fleet monitoring software developed by Iagona.
Flaws Discovered
In total, four vulnerabilities were discovered by the researchers at Synack, and here below, we have mentioned them:-
- CVE-2023-33871: Absolute Path Traversal
- CVE-2023-35189: Remote Code Execution
- CVE-2023-38257: Insecure Direct Object Reference
- CVE-2023-35763: Hardcoded encryption key
Successful exploitation of these flaws could enable threat actors to hack ATMs remotely. Exploiting flaws, threat actors can do the following things:-
- Access server configurations.
- Access server logs.
- Access server databases.
- Run arbitrary commands.
- Get encrypted admin passwords.
- Decrypt the encrypted administrator passwords using a hardcoded key.
Remote command execution flaw enables hackers to erase files and establish a foothold, potentially escalating the exploitation in client infrastructure and creating a pivot point for the threat actors.
The CVE-2023-33871 exposes the file access, aiding web app download, while the CVE-2023-38257 and CVE-2023-35763 enable admin log in to the ScrutisWeb console.
Moreover, the hackers gain control to monitor the ATM fleet and perform actions like:-
- Management mode
- File uploads
- Reboots
- Shutdowns
More analysis is needed to check if personal ATMs can get custom software for card theft or illicit transactions, but extra tests were beyond the assessment’s scope.
Recommendations
Here below, we have mentioned all the recommendations offered by the US Cybersecurity and Infrastructure Security Agency (CISA):-
- Reduce online access for control devices to prevent internet exposure.
- Make sure to place the control networks and remote devices behind firewalls, segregating them from corporate systems.
- Prefer secure options like VPNs for remote access, and always update to the latest versions.
Keep informed about the latest Cyber Security News by following us on GoogleNews, Linkedin, Twitter, and Facebook.
