Kraken’s Security Labs, the cybersecurity arm of the popular crypto exchange Kraken, has reportedly identified several vulnerabilities in the widely used General Bytes BATMtwo Bitcoin ATM.
Standard Admin QR Code
“Our team found that a large number of Bitcoin ATMs are configured with the same default admin QR code, allowing anyone with this QR code to walk up to an ATM and harm it.”
The Kraken Security Labs team wrote this in a blog post announcing the vulnerabilities. To this, Kraken added:
“Our team also found a lack of secure boot mechanisms, as well as critical vulnerabilities in the ATM management system.”
Kraken’s discoveries have both hardware and software implications for General Bytes’ automata.
Only one compartment with lock
According to Kraken, the General Bytes BATMtwo ATM has only a single compartment protected by a lock. Kraken reported the following about this:
“Bypassing that allows direct access to the entire internals of the device. An attacker could damage the cash box, the embedded computer, the webcam and the fingerprint reader.”
As for software, Kraken found that “a lot of common security features were missing.” This makes it easier for hackers to do potential damage. Connecting a USB keyboard to the BATMtwo made it possible to gain full access to the user interface. This would theoretically allow attackers to install applications, copy files, or even make the device send private keys to the attacker.
Improving safety
In the meantime, Kraken has already provided a number of solutions for users as well as owners or operators of Bitcoin ATMs. Kraken advises anyone wishing to use a Bitcoin vending machine to only use those in stores you trust. One should also make sure that it has ‘perimeter protection’. This includes, for example, surveillance cameras.
For owners and operators of General Bytes’ Bitcoin ATMs, Kraken suggests changing the default QR admin code. It then wants to place it in a location where there are security checks, and is advised to follow General Bytes’ general advice. This makes the machines safer for both users and administrators to use.