ATM Fleet Monitoring Software Flaws Let Attackers Hack ATMs Remotely

ScrutisWeb is a secure solution that aids global organizations in monitoring ATMs, enhancing issue response time, and this solution is accessible through any browser.

The following things could be done with the help of this secure solution:-

  • Monitor hardware
  • Reboot a terminal
  • Shut down a terminal
  • Send files
  • Receive files
  • Modify data remotely
  • Monitor the bank card reader

Cybersecurity researchers at Synack recently discovered several vulnerabilities in the ScrutisWeb ATM fleet monitoring software developed by Iagona.

Flaws Discovered

In total, four vulnerabilities were discovered by the researchers at Synack, and here below, we have mentioned them:-

Successful exploitation of these flaws could enable threat actors to hack ATMs remotely. Exploiting flaws, threat actors can do the following things:-

  • Access server configurations.
  • Access server logs.
  • Access server databases.
  • Run arbitrary commands.
  • Get encrypted admin passwords.
  • Decrypt the encrypted administrator passwords using a hardcoded key.

Remote command execution flaw enables hackers to erase files and establish a foothold, potentially escalating the exploitation in client infrastructure and creating a pivot point for the threat actors.

The CVE-2023-33871 exposes the file access, aiding web app download, while the CVE-2023-38257 and CVE-2023-35763 enable admin log in to the ScrutisWeb console.

Moreover, the hackers gain control to monitor the ATM fleet and perform actions like:-

  • Management mode
  • File uploads
  • Reboots
  • Shutdowns

More analysis is needed to check if personal ATMs can get custom software for card theft or illicit transactions, but extra tests were beyond the assessment’s scope.

Recommendations

Here below, we have mentioned all the recommendations offered by the US Cybersecurity and Infrastructure Security Agency (CISA):-

  • Reduce online access for control devices to prevent internet exposure.
  • Make sure to place the control networks and remote devices behind firewalls, segregating them from corporate systems.
  • Prefer secure options like VPNs for remote access, and always update to the latest versions.

Keep informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges in Organizational Environments

A startling discovery by BeyondTrust researchers has unveiled a critical vulnerability in Microsoft Entra ID…

1 day ago

Threat Actors Exploit Google Apps Script to Host Phishing Sites

The Cofense Phishing Defense Center has uncovered a highly strategic phishing campaign that leverages Google…

1 day ago

Dadsec Hacker Group Uses Tycoon2FA Infrastructure to Steal Office365 Credentials

Cybersecurity researchers from Trustwave’s Threat Intelligence Team have uncovered a large-scale phishing campaign orchestrated by…

1 day ago

Beware: Weaponized AI Tool Installers Infect Devices with Ransomware

Cisco Talos has uncovered a series of malicious threats masquerading as legitimate AI tool installers,…

1 day ago

Pure Crypter Uses Multiple Evasion Methods to Bypass Windows 11 24H2 Security Features

Pure Crypter, a well-known malware-as-a-service (MaaS) loader, has been recognized as a crucial tool for…

1 day ago

Attackers Exploit Microsoft Entra Billing Roles to Escalate Privileges

A recent discovery by security researchers at BeyondTrust has revealed a critical, yet by-design, security…

1 day ago