Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data

guest · Nov 12, 2019

Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data
November 11, 2019
https://finance.yahoo.com/news/security-researchers-discover-flaws-u-110000512.html

A pair of security researchers has discovered two vulnerabilities in ATMs widely used across the U.S. that could allow a determined criminal to steal cash and customer data.

Brenda So and Trey Keown, of New York-based Red Balloon Security Inc., found the flaws in machines manufactured by Nautilus Hyosung America Inc., the largest provider of ATMs in the U.S. By gaining access to the same network as the target ATM, the researchers were able to obtain full control of the machine and bypass its security measures. They also discovered master keys to the ATMs for sale on Amazon.com -- something other researchers have previously pointed out.

The researchers said they reported the flaws to the company in the summer and a fix was developed within a week. “Nautilus Hyosung America has already issued firmware security updates to mitigate possible threats,” the company said in the statement.
All of the vulnerabilities that were discovered could be accessed remotely, meaning an attacker would not need physical access to the ATM in order to hack it, only to be on the same network.
Click to expand...

guest · Aug 8, 2020

Hackers can still steal wads of cash from ATMs. Here's the vulnerabilities that could let them in.
August 6, 2020
https://www.cyberscoop.com/atm-vulnerabilities-cash-red-balloon-def-con-2020/

Thanks to a pair of zero-day vulnerabilities in a popular ATM, hackers could be pilfering off customers’ sensitive banking information or withdrawing hefty wads of cash, according to research from New York-based Red Balloon Security.

If exploited properly, one of the vulnerabilities the researchers found in Nautilus Hyosung America ATMs would allow attackers to essentially empty the machines of cash, the researchers, Brenda So and Trey Keown, told CyberScoop. The root of the vulnerability lies in the way Nautilus implemented eXtensions for Financial Services, the software used to dispense money.

“Have things improved? We realize although the vulnerabilities have been patched there are still other vulnerabilities [on that interface] that we found within a relatively short period of time.”
Bloomberg first reported the existence of the flaws last year.
Click to expand...

Log in or Sign up

Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data

guest Guest

guest Guest

Log in or Sign up

Nautilus ATM Flaws Could Allow Hackers Access to Cash, Data

guest Guest

guest Guest

Useful Searches