8 ms·

Kraken Security Labs Identifies Vulnerabilities in Commonly Used Bitcoin ATM

107 points by 2bluesc 5y ago

vmception 5y ago
and do what? the article lacks any inspiration, like it says you can get into the admin panel, but what does the admin panel let you do? can you change a subtle address to get some of the bitcoin fees for yourself? raise the fees to 100%? the article then mentions some stuff like access to the bootloader, which of course means you could flash a more capable admin panel into that lets you do way more like take everyone's bitcoin but what about the default admin panel?
- gizdan 5y ago
  I mean all of that tells me that you could do whatever you really want. Never mind the admin panel, even if it won't let you change the wallet, overwriting the firmware would certainly allow you to change the wallet where Bitcoins go.
  - vmception 5y ago
    yeah I know, I already covered that > the article then mentions some stuff like access to the bootloader, which of course means you could flash a more capable admin panel into that lets you do way more like take everyone's bitcoin I was just wondering why they would spend so much time talking about the lower effort stuff, if it doesn't do anything. I'm sure it does something bad, but I can't go over to my convenience store and say "someone might change the convenience fee to a slightly higher percentage!" to get them to do anything, if thats the extent of the attack surface for just the admin panel if its already surveilled, so its useful to be able to say exactly why I can imagine social engineering would allow a fake technician to come and service the machine though, with a hat and a voluntary personal mask mandate not being conspicuous right now. It would look so much more official to have a bunch of cables and computer doing a firmware flash lol.
anonu 5y ago
> Commonly Used Bitcoin ATM Really? How common are Bitcoin ATMs? And if they are geographically common, how often are people using them beyond the novelty factor?
- wcoenen 5y ago
  "Commonly used" is not referring to the number, or usage, of Bitcoin ATMs out there. It is referring to the fact that a large fraction of the existing Bitcoin ATMs are "General Bytes BATMtwo (GBBATM2)" machines.
- Geee 5y ago
  There are quite many. https://coinatmradar.com https://coinatmradar.com
- ravenstine 5y ago
  There's a bunch of them where I live (I'm in LA area though), including the 7-Eleven right down the street from my house. I used it when I was first trying to learn about Bitcoin but haven't used it for a practical reason yet; financially, it makes more sense to use Local Coin Swap if you don't need physical cash.
- NavinF 5y ago
  They're commonly found at hackerspaces.
- carrja99 5y ago
  I live in Missouri and witnessed an elderly woman withdraw cash from one at the mall some time ago. Was really floored by that one!
  - arcticbull 5y ago
    In all seriousness she was probably being scammed. Happens a lot, especially to the elderly. There was a thread about this on r/bitcoin recently.
- xanaxagoras 5y ago
madars 5y ago
It would be interesting to compare this with other low-hanging fruit attack vectors. If you already have physical access, what velocity controls are there in place to prevent me from just repeatedly running cash through the ATM to clear out the entire wallet? vmception is right that long game attacks are way more interesting.
- reedjosh 5y ago
  > running cash through the ATM to clear out the entire wallet? Just guessing, but the machine probably scans the serial numbers on bills.
  - thebean11 5y ago
    That doesn't help too much does it? Since you aren't permanently losing the money using a few 10s of thousands in cash isn't such a big deal.
    - reedjosh 5y ago
      True, but at least you would need unique bills to run through, and law enforcement can then track those bills.
      - KirillPanov 5y ago
        Law enforcement can laugh at you when asked to track those bills...
        minsc__and__boo 5y ago
        https://en.wikipedia.org/wiki/United_States_Secret_Service#Investigative_mission https://en.wikipedia.org/wiki/United_States_Secret_Service#I...
      - Max_aaa 5y ago
        So you basically need access to a cash business for a supply of fresh bills. Also for how long do they keep the serial numbers? After a certain amount of time it is possible for the same bill to enter the machine legitimately. (spelling)
sleepybrett 5y ago
This is probably good for bitcoin.
scoofy 5y ago
This has always been my #1 reason I'll never get into crypto. My bank has insurance, my physical assets aren't accessible to people on the internet. I likely won't lose my entire life savings simply because I either forget my password or I use one, single, vulnerable device, ever. (Yes, I fully realize you crypto-millionaires took a small risk and won big, and kudos to you) The benefit of institutions is that they are able to plan for failure within their system. Yes, this comes with some costs attached, but the costs associated with decentralized and nearly unregulateable commodity markets have not even begun to surface.
- thebean11 5y ago
  If you can lose your currency by forgetting a password or using the wrong device then you set things up incorrectly IMO. There are good ways of doing things where your keys stay on a device, or are only exposed to an offline machine with no network or persistent storage. Obviously it gets a little more technical, that's why services that manage the keys for you are so popular.
  - minsc__and__boo 5y ago
    >then you set things up incorrectly IMO That's precisely the problem with crypto though - most problems get blamed on the user, and not highlighted as the deficit it is for the crypto.
    - thebean11 5y ago
      It's not a deficit because everyday users can use a service that handles private keys for them. Managing private keys and signing transactions is not the level of the tech stack that nontechnical folks were ever meant to be on. It's like complaining that REST APIs aren't user friendly. My point is for someone who understand how keys work a bit better (like a lot of people here) there are better ways to set things up.
      - athrun 5y ago
        If you use a service that handles your private keys and the service gets compromised, then your funds are gone, permanently. This is a very different risk proposition compared to trusting a bank. If the bank gets compromised, it's the bank's problem, not mine.
gpcr1949 5y ago
Interestingly, my location has some monero ATMs that take cash, and the 10% or so fee (and apparently - various vulnerabilities) seems well worth it for what is by all measures a quite low effort hands-off way to get money that is quite anonymous, at least for most low key purposes, such as small recreational drug orders etc.
- minsc__and__boo 5y ago
  Aren't Monero transactions completely obscured anyways? It doesn't make a difference if you using a Bitcoin ATM or transfer to your Kraken account (except a 10% fee for the former).
  - McAtNite 5y ago
    My understanding, and this may be wrong since I don’t actually have Monero, is it’s not since US customers are subject to KYC. While the transaction on the blockchain would be obfuscated, the Exchange as the sender/receiver would still have the withdraw and deposit addresses since they were one of the parties of the transaction. Further transactions after withdrawing would be difficult to discern, but an exchange could be used to track an approximation of how much Monero you own. A cash based ATM purchase would be more difficult to track since no KYC is involved.
    - minsc__and__boo 5y ago
      It doesn't matter if Monero is used with KYC - transactions are obfuscated. That means the transactions can't be traced to your KYC wallet on Kraken, meaning you're spending 10% on an ATM for no reason.
      - McAtNite 5y ago
        Monero itself is not KYC, sorry if I worded that poorly above. The transactions to and from Kraken can definitely be tracked since they would have a record of the actual wallet address you sent your funds to. As for things that happen after that money hits your wallet - you’re right they wouldn’t be able to track it. I checked the Monero subreddit just to see if my understanding of it tracked with what people who actually own it say and it looks like they agree that transferring from a KYC exchange does allow tracking for transactions coming out or into the exchange. https://reddit.com/r/Monero/comments/ppcusq/moving_funds_between_exchanges/ https://reddit.com/r/Monero/comments/ppcusq/moving_funds_bet...
easymovet 5y ago
Why is HN Bitcoin news biased toward FUD?
- gizdan 5y ago
  How is this "biased toward FUD"? The article is written and published by Kraken, one of the largest cryptocurrency exchanges. They've discovered valid vulnerabilities and I'm not sure how it's FUD.
  - easymovet 5y ago
    Never see positive Bitcoin developments on the front page.
Fnoord 5y ago
> However, when reviewing the code behind the admin interface, we found that it contains a hash of a default factory setting administration key. We purchased multiple used ATMs from different sources and our investigation revealed that each had the same default key configuration. A used device should contain no PII, or any other data of the previous owner. However, using default settings is a sane choice when preparing a device for second hand sale. Yes, even if these default settings are insecure; that is solely the responsibility of the new owner.
deleted 5y ago
[deleted]
CryptoPunk 5y ago
Kraken also discovered a major bug in Namecoin in 2013: https://www.coindesk.com/markets/2013/10/28/developers-attempt-to-resurrect-namecoin-after-fundamental-flaw-discovered/ https://www.coindesk.com/markets/2013/10/28/developers-attem...

107 points by 2bluesc 5y ago

and do what? the article lacks any inspiration, like it says you can get into the admin panel, but what does the admin panel let you do? can you change a subtle address to get some of the bitcoin fees for yourself? raise the fees to 100%? the article then mentions some stuff like access to the bootloader, which of course means you could flash a more capable admin panel into that lets you do way more like take everyone's bitcoin but what about the default admin panel?

gizdan 5y ago
I mean all of that tells me that you could do whatever you really want. Never mind the admin panel, even if it won't let you change the wallet, overwriting the firmware would certainly allow you to change the wallet where Bitcoins go.
- vmception 5y ago
  yeah I know, I already covered that > the article then mentions some stuff like access to the bootloader, which of course means you could flash a more capable admin panel into that lets you do way more like take everyone's bitcoin I was just wondering why they would spend so much time talking about the lower effort stuff, if it doesn't do anything. I'm sure it does something bad, but I can't go over to my convenience store and say "someone might change the convenience fee to a slightly higher percentage!" to get them to do anything, if thats the extent of the attack surface for just the admin panel if its already surveilled, so its useful to be able to say exactly why I can imagine social engineering would allow a fake technician to come and service the machine though, with a hat and a voluntary personal mask mandate not being conspicuous right now. It would look so much more official to have a bunch of cables and computer doing a firmware flash lol.

anonu 5y ago

> Commonly Used Bitcoin ATM Really? How common are Bitcoin ATMs? And if they are geographically common, how often are people using them beyond the novelty factor?

wcoenen 5y ago
"Commonly used" is not referring to the number, or usage, of Bitcoin ATMs out there. It is referring to the fact that a large fraction of the existing Bitcoin ATMs are "General Bytes BATMtwo (GBBATM2)" machines.
Geee 5y ago
There are quite many. https://coinatmradar.com https://coinatmradar.com
ravenstine 5y ago
There's a bunch of them where I live (I'm in LA area though), including the 7-Eleven right down the street from my house. I used it when I was first trying to learn about Bitcoin but haven't used it for a practical reason yet; financially, it makes more sense to use Local Coin Swap if you don't need physical cash.
NavinF 5y ago
They're commonly found at hackerspaces.
carrja99 5y ago
I live in Missouri and witnessed an elderly woman withdraw cash from one at the mall some time ago. Was really floored by that one!
- arcticbull 5y ago
  In all seriousness she was probably being scammed. Happens a lot, especially to the elderly. There was a thread about this on r/bitcoin recently.
xanaxagoras 5y ago

madars 5y ago

It would be interesting to compare this with other low-hanging fruit attack vectors. If you already have physical access, what velocity controls are there in place to prevent me from just repeatedly running cash through the ATM to clear out the entire wallet? vmception is right that long game attacks are way more interesting.

reedjosh 5y ago
> running cash through the ATM to clear out the entire wallet? Just guessing, but the machine probably scans the serial numbers on bills.
- thebean11 5y ago
  That doesn't help too much does it? Since you aren't permanently losing the money using a few 10s of thousands in cash isn't such a big deal.
  - reedjosh 5y ago
    True, but at least you would need unique bills to run through, and law enforcement can then track those bills.
    - KirillPanov 5y ago
      Law enforcement can laugh at you when asked to track those bills...
      - minsc__and__boo 5y ago
        https://en.wikipedia.org/wiki/United_States_Secret_Service#Investigative_mission https://en.wikipedia.org/wiki/United_States_Secret_Service#I...
    - Max_aaa 5y ago
      So you basically need access to a cash business for a supply of fresh bills. Also for how long do they keep the serial numbers? After a certain amount of time it is possible for the same bill to enter the machine legitimately. (spelling)

sleepybrett 5y ago

This is probably good for bitcoin.

scoofy 5y ago

This has always been my #1 reason I'll never get into crypto. My bank has insurance, my physical assets aren't accessible to people on the internet. I likely won't lose my entire life savings simply because I either forget my password or I use one, single, vulnerable device, ever. (Yes, I fully realize you crypto-millionaires took a small risk and won big, and kudos to you) The benefit of institutions is that they are able to plan for failure within their system. Yes, this comes with some costs attached, but the costs associated with decentralized and nearly unregulateable commodity markets have not even begun to surface.

thebean11 5y ago
If you can lose your currency by forgetting a password or using the wrong device then you set things up incorrectly IMO. There are good ways of doing things where your keys stay on a device, or are only exposed to an offline machine with no network or persistent storage. Obviously it gets a little more technical, that's why services that manage the keys for you are so popular.
- minsc__and__boo 5y ago
  >then you set things up incorrectly IMO That's precisely the problem with crypto though - most problems get blamed on the user, and not highlighted as the deficit it is for the crypto.
  - thebean11 5y ago
    It's not a deficit because everyday users can use a service that handles private keys for them. Managing private keys and signing transactions is not the level of the tech stack that nontechnical folks were ever meant to be on. It's like complaining that REST APIs aren't user friendly. My point is for someone who understand how keys work a bit better (like a lot of people here) there are better ways to set things up.
    - athrun 5y ago
      If you use a service that handles your private keys and the service gets compromised, then your funds are gone, permanently. This is a very different risk proposition compared to trusting a bank. If the bank gets compromised, it's the bank's problem, not mine.

gpcr1949 5y ago

Interestingly, my location has some monero ATMs that take cash, and the 10% or so fee (and apparently - various vulnerabilities) seems well worth it for what is by all measures a quite low effort hands-off way to get money that is quite anonymous, at least for most low key purposes, such as small recreational drug orders etc.

minsc__and__boo 5y ago
Aren't Monero transactions completely obscured anyways? It doesn't make a difference if you using a Bitcoin ATM or transfer to your Kraken account (except a 10% fee for the former).
- McAtNite 5y ago
  My understanding, and this may be wrong since I don’t actually have Monero, is it’s not since US customers are subject to KYC. While the transaction on the blockchain would be obfuscated, the Exchange as the sender/receiver would still have the withdraw and deposit addresses since they were one of the parties of the transaction. Further transactions after withdrawing would be difficult to discern, but an exchange could be used to track an approximation of how much Monero you own. A cash based ATM purchase would be more difficult to track since no KYC is involved.
  - minsc__and__boo 5y ago
    It doesn't matter if Monero is used with KYC - transactions are obfuscated. That means the transactions can't be traced to your KYC wallet on Kraken, meaning you're spending 10% on an ATM for no reason.
    - McAtNite 5y ago
      Monero itself is not KYC, sorry if I worded that poorly above. The transactions to and from Kraken can definitely be tracked since they would have a record of the actual wallet address you sent your funds to. As for things that happen after that money hits your wallet - you’re right they wouldn’t be able to track it. I checked the Monero subreddit just to see if my understanding of it tracked with what people who actually own it say and it looks like they agree that transferring from a KYC exchange does allow tracking for transactions coming out or into the exchange. https://reddit.com/r/Monero/comments/ppcusq/moving_funds_between_exchanges/ https://reddit.com/r/Monero/comments/ppcusq/moving_funds_bet...

easymovet 5y ago

Why is HN Bitcoin news biased toward FUD?

gizdan 5y ago
How is this "biased toward FUD"? The article is written and published by Kraken, one of the largest cryptocurrency exchanges. They've discovered valid vulnerabilities and I'm not sure how it's FUD.
- easymovet 5y ago
  Never see positive Bitcoin developments on the front page.

Fnoord 5y ago

> However, when reviewing the code behind the admin interface, we found that it contains a hash of a default factory setting administration key. We purchased multiple used ATMs from different sources and our investigation revealed that each had the same default key configuration. A used device should contain no PII, or any other data of the previous owner. However, using default settings is a sane choice when preparing a device for second hand sale. Yes, even if these default settings are insecure; that is solely the responsibility of the new owner.

deleted 5y ago

[deleted]

CryptoPunk 5y ago

Kraken also discovered a major bug in Namecoin in 2013: https://www.coindesk.com/markets/2013/10/28/developers-attempt-to-resurrect-namecoin-after-fundamental-flaw-discovered/ https://www.coindesk.com/markets/2013/10/28/developers-attem...