NCR patches ATM vulnerabilities

ATM maker NCR has issued software security updates after researchers reported flaws in encryption of communications between ATM computers and dispensers that could enable attackers to steal cash.

The researchers found that attackers could install obsolete insecure software on the controller of an ATM cash dispenser and issue commands to dispense cash.

Criminals could steal cash in this way by taking advantage of poor physical security to connect a computer to the dispenser, Positive Technologies researchers Vladimir Kononovich and Alexey Stennikov told attendees of the Black Hat USA security conference in Las Vegas.

“Our research indicated that not all requests from the ATM computer to the dispenser were encrypted,” said Alexey Stennikov, head of hardware security analysis at Positive Technologies.

“Instead, encryption was applied only to requests deemed critical by the manufacturer, such as dispensing cash. But some of the so-called non-critical requests can be just as dangerous.”

The first vulnerability, CVE-2017-17668, was caused by insufficient protection of the memory write mechanism in the NCR S1 dispenser controller.

On firmware versions prior to 0x0156, the researchers found that an unauthenticated user could execute arbitrary code, bypass the prohibition on firmware downgrading, and install obsolete firmware versions containing known vulnerabilities.

A similar vulnerability, CVE-2018-5717, was found in the NCR S2 dispenser. Firmware version 0x0108 corrects the issue.

ATM logic attacks using physical or network access have become a frequent occurrence in recent years. According to the European Association for Secure Transactions (East), 114 black box attacks were performed in 11 European countries in the first six months of 2017.