The ATMs of General Bytes, which has several offices around the world, were the target of robbery. These BATMs can be set up, for example, in stores or other public places to allow people to exchange Bitcoin for other currencies and vice versa.

What happened

Customers installing such ATMs connect the BATM to a Cryptographic Application Server (CAS) that they can manage. In this case, General Bytes managed such a server for them. For some reason the machines provide an option that lets you upload video from the terminal to the CAS using a mechanism known as the host interface.

Over the weekend, General Bytes announced that the CASs he managed Over $1.5 million in Bitcoin withdrawn. An unknown attacker exploits a previously unknown vulnerability to perform the theft. downloading and running a malicious Java application. It then pulled about 56 BTC from various wallets.

After analyzing the situation, the company says the unknown could:

• Access the database.
• Read and decrypt encrypted API keys required to access funds on wallets and exchanges.
• Money transfer from wallet to wallet.
• Download usernames and password hashes and disable 2FA.
• Access terminal event logs and look for instances where customers scanned private keys at an ATM.

General Bytes patched the vulnerability 15 hours after learning about it, but due to the nature of cryptocurrencies, the losses are irreversible. In 2021, it passed “multiple security checks” that did not detect this vulnerability. The company says it will no longer manage CAS on behalf of customers. This means terminal owners must manage the servers themselves.