ATM Fleet Monitoring Software Flaws Let Attackers Hack ATMs Remotely

ScrutisWeb is a secure solution that aids global organizations in monitoring ATMs, enhancing issue response time, and this solution is accessible through any browser.

The following things could be done with the help of this secure solution:-

  • Monitor hardware
  • Reboot a terminal
  • Shut down a terminal
  • Send files
  • Receive files
  • Modify data remotely
  • Monitor the bank card reader

Cybersecurity researchers at Synack recently discovered several vulnerabilities in the ScrutisWeb ATM fleet monitoring software developed by Iagona.

Flaws Discovered

In total, four vulnerabilities were discovered by the researchers at Synack, and here below, we have mentioned them:-

Successful exploitation of these flaws could enable threat actors to hack ATMs remotely. Exploiting flaws, threat actors can do the following things:-

  • Access server configurations.
  • Access server logs.
  • Access server databases.
  • Run arbitrary commands.
  • Get encrypted admin passwords.
  • Decrypt the encrypted administrator passwords using a hardcoded key.

Remote command execution flaw enables hackers to erase files and establish a foothold, potentially escalating the exploitation in client infrastructure and creating a pivot point for the threat actors.

The CVE-2023-33871 exposes the file access, aiding web app download, while the CVE-2023-38257 and CVE-2023-35763 enable admin log in to the ScrutisWeb console.

Moreover, the hackers gain control to monitor the ATM fleet and perform actions like:-

  • Management mode
  • File uploads
  • Reboots
  • Shutdowns

More analysis is needed to check if personal ATMs can get custom software for card theft or illicit transactions, but extra tests were beyond the assessment’s scope.

Recommendations

Here below, we have mentioned all the recommendations offered by the US Cybersecurity and Infrastructure Security Agency (CISA):-

  • Reduce online access for control devices to prevent internet exposure.
  • Make sure to place the control networks and remote devices behind firewalls, segregating them from corporate systems.
  • Prefer secure options like VPNs for remote access, and always update to the latest versions.

Keep informed about the latest Cyber Security News by following us on GoogleNewsLinkedinTwitter, and Facebook.

Tushar Subhra

Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Recent Posts

Lumma Stealer Upgraded with PowerShell Tools and Advanced Evasion Techniques

Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has…

38 minutes ago

New Noodlophile Malware Spreads Through Fake AI Video Generation Platforms

Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a…

47 minutes ago

Kimsuky Hacker Group Deploys New Phishing Techniques and Malware Campaigns

The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,”…

54 minutes ago

APT37 Hackers Use Weaponized LNK Files and Dropbox for Command-and-Control Operations

The North Korean state-sponsored hacking group APT37, also known as ScarCruft, launched a spear phishing…

1 hour ago

Open Source Linux Firewall IPFire 2.29 – Core Update 194 Released: What’s New!

IPFire, the powerful open-source firewall, has unveiled its latest release, IPFire 2.29 – Core Update…

5 hours ago

Threat Actors Leverage DDoS Attacks as Smokescreens for Data Theft

Distributed Denial of Service (DDoS) attacks, once seen as crude tools for disruption wielded by…

5 hours ago