Cracking open an ATM sounds like the plot of a heist movie, but for security researcher Matt Burch it’s been a five-year obsession with the software running inside those armored boxes. At the Black Hat and Defcon conferences in Las Vegas this month, he laid out nine vulnerabilities in a piece of disk encryption and pre-boot authentication software called CryptoPro Secure Disk — and the story is bigger than any single cash machine.
The flaws, all now patched, could have been chained to bypass CryptoPro’s integrity checks and hand an attacker full access to encrypted devices. That’s exactly the kind of protection you’d want between a thief and a machine stuffed with money. But the more interesting part is where else this code lives.
CryptoPro is made by the German firm CryptWare and marketed to ATM makers — it ships inside Diebold Nixdorf’s Vynamic Security Suite, among others. It’s also sold to embedded-device manufacturers and large organizations running Microsoft Windows. According to CryptWare managing director Uwe Saame, the company has hundreds of customers spanning automotive, banking, government, manufacturing, research, finance and healthcare, plus extensive installations in the ATM sector.
“ATMs are what brought me down this path, but I think there may be an even higher impact of these findings beyond that,” Burch says. His point: financial systems are built in so many layers that bugs get overlooked or quietly ignored.
To CryptWare’s credit, the fixes arrived fast. Saame says the nine bugs were patched in two phases — CryptoPro version 7.7.2 in early November and 7.7.3 in early December. Burch, who describes the disclosure process as prompt and collaborative, verified that the patches actually close the holes he found. CryptWare doesn’t publish update notes publicly, but Saame says maintenance agreements keep customers notified ahead of any findings, often with the new version in hand before official release.
Diebold Nixdorf, meanwhile, is playing down the ATM angle. Spokesperson Michael Jacobsen says only two of the nine vulnerabilities touch its Vynamic Security Hard Disk Encryption, that fixes went out in December, and that neither bug could have compromised one of its machines on its own.
Here’s the real lesson, and it’s a supply-chain one. A single library baked into products across a dozen industries means a single fix has to travel a long, awkward road: the developer ships a patch, each vendor tailors it to their own software, and then customers have to actually hear about it and install it — no small feat for machines running unattended in the field.
Burch also has a warning about the future. Security researchers have spent decades arguing that hiding niche software — “security through obscurity” — is no defense. Now AI is turning that argument into an emergency.
“AI really blows away the obscurity model,” he says. “You don’t need to fully understand how something works anymore to move forward and potentially have a big impact.”
