ATM Flaws Reveal Key Weaknesses in the Software Supply Chain
Security researcher Burch presented findings at Black Hat and Defcon detailing nine now-patched vulnerabilities in CryptoPro Secure Disk, a disk encryption and pre-boot authentication tool made by German firm CryptWare. The flaws could have let attackers bypass integrity checks and gain full access to encrypted devices, and the case highlights how deeply embedded, niche security software can spread through the supply chain, making bugs hard to spot and even harder to fully remediate once found.
CryptoPro is used in ATMs, including via Diebold Nixdorf's Vynamic Security Suite, but is also sold more broadly for embedded devices and Windows-based organisations. CryptWare fixed the nine bugs across two updates, versions 7.7.2 and 7.7.3, released in early November and December respectively; Diebold Nixdorf said only two of the flaws affected its systems and that these could not alone have compromised an ATM. Both companies said fixes were distributed to customers, though CryptoPro does not appear to publish public update notes. Burch warned that AI tools are eroding "security through obscurity," making it easier for researchers and attackers alike to probe niche, under-scrutinised software.
- Nine flaws found and fixed in CryptoPro Secure Disk encryption software used in ATMs
- Bugs could have bypassed integrity checks to fully access encrypted devices
- Case shows AI is eroding "security through obscurity" for niche software
New here? Start with this
CryptoPro Secure Disk is software made by German firm CryptWare that encrypts data on a device and checks a user’s identity before the device starts. It is used in some ATMs through Diebold Nixdorf’s Vynamic Security Suite, as well as in other embedded devices and Windows-based organisations.
Software in ATMs often comes from several suppliers, so a flaw in a specialist product can affect systems beyond its maker’s own customers. Finding and fixing such a flaw may require each supplier to identify the affected products and pass updates along to operators.
The case also raises questions about how well-known and tested specialist security software is. Researcher Burch said AI tools can make it easier to examine less familiar software, for both researchers and attackers.
Both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The case shows why organisations should scrutinise every component in their software supply chains, including niche tools that may be widely embedded but receive little attention. Researchers argue that AI-assisted analysis can make this scrutiny more effective, helping uncover serious weaknesses before attackers exploit them and pressing vendors to provide clear fixes and update information.
The case against
The findings do not by themselves show that ATMs were compromised: CryptWare patched the flaws, and Diebold Nixdorf said only two affected its systems and neither alone could compromise an ATM. Vendors also face practical limits in updating software spread across varied customer systems, so the case may support careful, risk-based remediation rather than treating every flaw as evidence that the wider supply chain is unsafe.