The attacker could upload his java application remotely via the master service interface used by terminals to upload videos and run it using BATM user privileges. We notified customers to shut down their CAS servers as soon as possible. We noticed the first signs of a break-in on Friday night, right after midnight on Saturday, 18 March (UTC+1). The GENERAL BYTES Cloud service and other standalone servers run by operators suffered security breaches. It’s not mentioned what these videos are used for (presumably security cameras), but the master server interface allowing for the video uploads is where things went horribly wrong.įrom the General Bytes statement regarding the March 18 incident:

The ATMs, located in various convenience stores, function along the lines of regular banking ATMs except your dealings are all in the cryptocurrency realm.Īs Ars Technica notes, a particular feature of the affected ATMs is the ability to upload video. Bitcoin ATMs have experienced a severe bout of cash drain after a zero-day bug was exploited to steal a total of $1.5 million in digital currency.

Download antimalwarebyte