ATM Flaws Reveal Key Weaknesses in the Software Supply Chain

ATM Flaws Reveal Key Weaknesses in Software Patching

ATM flaws reveal key weaknesses in how critical software gets secured, and the problem stretches far beyond cash machines. At the Black Hat and Defcon security conferences in Las Vegas this month, researcher Burch presented findings on nine vulnerabilities in CryptoPro Secure Disk, a disk encryption and pre-boot authentication tool made by German firm CryptWare. The bugs could have allowed attackers to bypass CryptoPro's integrity checks and gain full access to encrypted devices.

That alone is serious. But the real story is where this software ends up.

A Security Product With Many Homes

CryptoPro is marketed to ATM makers and is used in some machines, including as part of Diebold Nixdorf's Vynamic Security Suite. But it's also sold as a security solution for other embedded-device manufacturers and for large organizations running Microsoft Windows. That breadth is exactly what makes the supply chain problem so thorny. It's a nasty puzzle. A bug in one niche product can ripple across industries that have little else in common, so a flaw in a small payment terminal might end up crippling a hospital's Windows-based admin network, and no one sees it coming.

“ATMs are what brought me down this path, but I think there may be an even higher impact of these findings beyond that,” Burch says. “From the perspective of ATMs and the financial network, there are a lot of layers, and I think as a result of that, things just get implemented a certain way and then there’s limited technical insight,bugs can get overlooked or they don’t get addressed.”

CryptWare managing director Uwe Saame says the company patched all nine bugs in two phases. Version 7.7.2 arrived in early November, and 7.7.3 followed in early December. Burch says CryptWare was prompt and collaborative throughout his disclosure process, and he validated that the patches actually fix what he found.

The Patch Is Only the Beginning

Here's the uncomfortable part: releasing a fix is the easy step. The harder work happens downstream.

Two of the nine vulnerabilities matter. They're the only ones relevant to Vynamic Security Hard Disk Encryption, the system where ATM maker Diebold Nixdorf uses CryptoPro, and that's what spokesperson Michael Jacobsen says. Fixes for those two bugs went out in December. But he insists they couldn't have been exploited on their own to compromise a Diebold Nixdorf ATM, so the risk was never as severe as it might sound.

Still, the chain of custody for a patch is long. A developer releases an update. Then companies that embed the product in their own systems need to build a tailored fix. Then customers need to hear about it, download it, and install it. That last step is brutal for systems running in the field or that can't easily be paused for maintenance.

Speaking generally, Jacobsen describes the process: “When a security issue is identified, Diebold Nixdorf assesses the impact, identifies affected products and configurations, and develops any needed updates through our product security and engineering processes. We then notify impacted customers and provide updates through standard software distribution channels, including the Global Security Portal where applicable. For deployed ATMs, updates are coordinated with each customer based on their operating model, service agreements, and change-management processes.”

That's a lot of steps. Each one is a chance for something to stall.

Who Actually Gets the Fix?

CryptoPro does not seem to publicly release update notes. Burch says he believes the company distributed information about the patches to its customers. But "believes" is not "confirms." And in a world where obscure security products quietly power critical infrastructure, that ambiguity is part of the problem.

Security researchers have warned for decades about the danger of “security through obscurity” , hiding software from view or keeping it locked away. The idea was that if attackers couldn't see the code, they couldn't break it. That approach never really worked, and it's getting worse.

Why AI Changes the Game

Burch points to AI as the force that finally kills the obscurity model. It's that simple. Automated systems are getting better at evaluating software and finding vulnerabilities, even when the researcher doesn't have deep expertise in the specific technology, so those tools can now scan vast codebases and flag weak spots that once required years of specialized knowledge to uncover. And that means niche products that once flew under the radar are now in the crosshairs. They can't hide anymore.

“AI really blows away the obscurity model,” Burch says. “You don’t need to fully understand how something works anymore to move forward and potentially have a big impact.”

That's a double-edged sword. The same tools that help researchers find bugs also help attackers find them faster. The gap between discovery and exploitation is shrinking.

“You don’t need to fully understand how something works anymore to move forward and potentially have a big impact.”

The Real Weakness Is Process

ATM flaws reveal key weaknesses not just in code, but in the human and organizational systems around it. The vulnerabilities in CryptoPro were fixed. That part worked. But the broader ecosystem , ATM makers, embedded-device vendors, enterprise IT departments , still struggles with the same fundamental questions. Who is responsible for ensuring a patch reaches every device? How do you update a machine that's bolted to a wall in a busy retail location? What happens when a customer doesn't have a service agreement that covers prompt updates?

There's no single answer. And that's the point.

Internet-of-things manufacturers and those in critical industries like finance and medical devices have made some progress on transparency and patch adoption. But the CryptoPro case shows how fragile that progress can be. One obscure product, nine bugs, and a supply chain that spans ATMs, embedded systems, and enterprise Windows deployments. The fix exists. Whether it reaches every vulnerable device is another question entirely.

The researchers did their part. The vendor patched. The ATM maker responded. But the supply chain has more links than that, and each one adds friction. That friction is where the next incident will come from.