{"id":621048,"date":"2023-03-23T09:48:41","date_gmt":"2023-03-23T14:48:41","guid":{"rendered":"https:\/\/news.sellorbuyhomefast.com\/index.php\/2023\/03\/23\/bitcoin-atms-drained-after-hackers-exploit-zero-day-bug\/"},"modified":"2023-03-23T09:48:41","modified_gmt":"2023-03-23T14:48:41","slug":"bitcoin-atms-drained-after-hackers-exploit-zero-day-bug","status":"publish","type":"post","link":"https:\/\/newsycanuse.com\/index.php\/2023\/03\/23\/bitcoin-atms-drained-after-hackers-exploit-zero-day-bug\/","title":{"rendered":"Bitcoin ATMs drained after hackers exploit zero-day bug"},"content":{"rendered":"<article aria-label=\"article\" data-id=\"pUxM7eMtaABP4PvacPnXBi\">\n<header>\n<nav aria-label=\"Breadcrumbs\">\n<ol>\n<li>\n<a href=\"https:\/\/www.techradar.com\" aria-label=\"Return to Home\">Home<\/a>\n<\/li>\n<li>\n<a href=\"https:\/\/www.techradar.com\/news\" aria-label=\"Return to News\">News<\/a>\n<\/li>\n<li>\n<a href=\"https:\/\/www.techradar.com\/computing\" aria-label=\"Return to Computing\">Computing<\/a>\n<\/li>\n<\/ol>\n<\/nav>\n<\/header>\n<section>\n<div itemprop=\"image\" itemscope itemtype=\"https:\/\/schema.org\/ImageObject\">\n<div>\n<picture><source type=\"image\/webp\" alt=\"Cryptocurrencies\" onerror=\"if(this.src &#038;&#038; this.src.indexOf('missing-image.svg') !== -1){return true;};this.parentNode.replaceChild(window.missingImage(),this)\"   data-original-mos=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\" data-pin-media=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\"><source type=\"image\/jpeg\" alt=\"Cryptocurrencies\" onerror=\"if(this.src &#038;&#038; this.src.indexOf('missing-image.svg') !== -1){return true;};this.parentNode.replaceChild(window.missingImage(),this)\"   data-original-mos=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\" data-pin-media=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\"><img decoding=\"async\" src=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE-320-80.jpg\" alt=\"Cryptocurrencies\" onerror=\"if(this.src &#038;&#038; this.src.indexOf('missing-image.svg') !== -1){return true;};this.parentNode.replaceChild(window.missingImage(),this)\"   data-original-mos=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\" data-pin-media=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\"><\/picture>\n<\/div>\n<p><meta itemprop=\"url\" content=\"https:\/\/cdn.mos.cms.futurecdn.net\/jpmXp7DBBx8KGSZ96oqbeE.jpg\"><br \/>\n<meta itemprop=\"height\" content=\"600\"><br \/>\n<meta itemprop=\"width\" content=\"338\"><figcaption itemprop=\"caption description\">\n<span itemprop=\"copyrightHolder\">(Image credit: Shutterstock \/ Wit Olszewksi)<\/span><br \/>\n<\/figcaption><\/div>\n<div id=\"article-body\">\n<p>Unknown hackers have managed to steal 56 bitcoin, worth approximately $1.5 million, from specialized ATMs designed to distribute cryptocurrency, The worst part is &#8211; the stolen funds partially belonged to the ATM\u2019s customers, as well.<\/p>\n<p>According to the report, the ATMs work by allowing customers to <a href=\"https:\/\/www.techradar.com\/best\/firewall\" target=\"_blank\" rel=\"noopener\">connect<\/a><span> (opens in new tab)<\/span> it to a crypto application service (CAS) either they, or the company, manages. However, the ATM also allowed customers to upload videos from the terminal to the CAS &#8211; which is apparently where the bug was hiding.\u00a0<\/p>\n<p>A previously unknown, zero-day vulnerability, allowed the threat actors to upload and run a malicious Java application, and use it to drain the CASes operated by both the company, and its customers.\u00a0<\/p>\n<h2 id=\"keeping-customers-afloat\">Keeping customers afloat<\/h2>\n<p>General Bytes, the company behind the ATMs, addressed the issue 15 hours after being alerted to the flaw. However, the only way to get the funds back is to have the police find and arrest the perpetrators, then confiscate and return the stolen cryptocurrency &#8211; which is obviously easier said than done.<\/p>\n<p>\u201cThe night of 17-18 March was the most challenging time for us and some of our clients. The entire team has been working around the clock to collect all data regarding the security breach and is continuously working to resolve all cases to help clients back online and continue to operate their ATMs as soon as possible,\u201d the company wrote in an announcement.\u00a0<\/p>\n<p>\u201cWe apologize for what happened and will review all our security procedures and are currently doing everything we can to keep our affected customers afloat.\u201d<\/p>\n<p>By uploading and running the <a href=\"https:\/\/www.techradar.com\/best\/best-malware-removal\">malware<\/a>, the attacker gained access to the ATM\u2019s database, was allowed to read and decrypt encoded API keys needed to access the funds, and finally managed to withdraw the crypto to a separate wallet. Furthemore, the attackers managed to download usernames and password hashes, turn off multi-factor authentication (MFA), and access terminal event logs to scan for customer private keys.\u00a0<\/p>\n<p>One of the things General Bytes is changing, going forward, is that it will no longer manage CASes for its customers &#8211; they will have to do so themselves (if they decide to stick around at all).<\/p>\n<ul>\n<li>Here&#8217;s our list of the <a href=\"https:\/\/www.techradar.com\/best\/best-identity-theft-protection\" target=\"_blank\" rel=\"noopener\">best ID theft protection<\/a><span> (opens in new tab)<\/span> right now<\/li>\n<\/ul>\n<p>Via: <a href=\"https:\/\/arstechnica.com\/information-technology\/2023\/03\/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug\/\" target=\"_blank\" data-url=\"https:\/\/arstechnica.com\/information-technology\/2023\/03\/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug\/\" rel=\"noopener\">Ars Technica<\/a><span> (opens in new tab)<\/span><\/p>\n<\/div>\n<div data-hydrate=\"true\" data-reactroot id=\"slice-container-newsletterForm-articleInbodyContent\">\n<section>\n<p>Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!<\/p>\n<\/section>\n<\/div>\n<div data-reactroot id=\"slice-container-authorBio\">\n<p>Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he\u2019s written for numerous media outlets, including Al Jazeera Balkans. He\u2019s also held several modules on content writing for Represent Communications.<\/p>\n<\/div>\n<\/section>\n<p><a href=\"https:\/\/www.techradar.com\/news\/bitcoin-atms-drained-after-hackers-exploit-zero-day-bug\" class=\"button purchase\" rel=\"nofollow noopener\" target=\"_blank\">Read More<\/a><br \/>\n Diego Mayoral<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Home News Computing (Image credit: Shutterstock \/ Wit Olszewksi) Unknown hackers have managed to steal 56 bitcoin, worth approximately $1.5 million, from specialized ATMs designed to distribute cryptocurrency, The worst part is &#8211; the stolen funds partially belonged to the ATM\u2019s customers, as well.According to the report, the ATMs work by allowing customers to connect<\/p>\n","protected":false},"author":1,"featured_media":621049,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4041,31350,46],"tags":[],"class_list":["post-621048","post","type-post","status-publish","format-standard","has-post-thumbnail","category-bitcoin","category-drained","category-technology"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/621048","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/comments?post=621048"}],"version-history":[{"count":0,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/posts\/621048\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media\/621049"}],"wp:attachment":[{"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/media?parent=621048"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/categories?post=621048"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newsycanuse.com\/index.php\/wp-json\/wp\/v2\/tags?post=621048"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}