ATM Flaws Reveal Key Weaknesses in the Software Supply Chain
ATM Flaws Reveal Key Weaknesses in the Software Supply Chain
ATM 漏洞揭示了软件供应链的关键弱点
For the past five years, security researcher Matt Burch has immersed himself in the esoteric and high-stakes world of ATM security, in which small software flaws can sometimes expose cold, hard cash. As Burch has bored deeper into the computers powering these digital lock boxes—and continued to find vulnerabilities in key digital security systems—he has started working to raise the alarm, not just about overlooked ATM flaws, but about how that same software used in other industries can introduce weaknesses in an array of critical systems.
在过去的五年里，安全研究员 Matt Burch 一直沉浸在 ATM 安全这个深奥且高风险的领域中，在这里，微小的软件缺陷有时会导致真金白银的损失。随着 Burch 对驱动这些“数字保险箱”的计算机进行深入研究，并不断发现关键数字安全系统中的漏洞，他开始发出警示：这不仅关乎被忽视的 ATM 漏洞，更关乎这些在其他行业中使用的相同软件，是如何在各类关键系统中引入弱点的。
At the Black Hat and Defcon security conferences in Las Vegas this month, Burch presented findings about nine vulnerabilities that have been fixed in disk encryption and pre-boot authentication software called CryptoPro Secure Disk. The flaws could have been exploited to bypass CryptoPro’s integrity checks and gain full access to encrypted devices.
在本月于拉斯维加斯举行的 Black Hat 和 Defcon 安全会议上，Burch 展示了他发现的九个漏洞，这些漏洞已在名为 CryptoPro Secure Disk 的磁盘加密和预启动身份验证软件中得到修复。这些缺陷曾可被利用来绕过 CryptoPro 的完整性检查，从而获得对加密设备的完全访问权限。
Made by the German software firm CryptWare, CryptoPro is marketed to ATM makers and is used in some ATMs, including as part of Diebold Nixdorf’s Vynamic Security Suite. But CryptoPro is also sold as a security solution for other embedded-device makers, as well as big organizations using Microsoft Windows, underscoring the supply chain challenge of addressing bugs when software is widely implemented in numerous industries.
CryptoPro 由德国软件公司 CryptWare 开发，主要面向 ATM 制造商销售，并被用于部分 ATM 机中，包括作为 Diebold Nixdorf 公司 Vynamic 安全套件的一部分。但 CryptoPro 也作为安全解决方案出售给其他嵌入式设备制造商，以及使用微软 Windows 的大型组织，这凸显了当软件在众多行业中被广泛应用时，修复漏洞所面临的供应链挑战。
“ATMs are what brought me down this path, but I think there may be an even higher impact of these findings beyond that,” Burch says. “From the perspective of ATMs and the financial network, there are a lot of layers, and I think as a result of that, things just get implemented a certain way and then there’s limited technical insight—bugs can get overlooked or they don’t get addressed.”
“ATM 是我走上这条研究道路的起点，但我认为这些发现的影响力可能远不止于此，”Burch 说。“从 ATM 和金融网络的角度来看，它们有很多层级，我认为正因如此，系统往往以某种特定的方式实现，导致技术洞察力有限——漏洞可能会被忽视，或者无法得到解决。”
CryptWare managing director Uwe Saame tells WIRED that the company patched the nine bugs in two phases with CryptoPro version 7.7.2 in early November and 7.7.3 in early December. He adds that there are hundreds of CryptoPro customers across critical industries including “automotive, banking, government agencies, manufacturing, research, finance, and healthcare. There are also extensive installations in the ATM sector.”
CryptWare 总经理 Uwe Saame 告诉《连线》（WIRED），该公司分两个阶段修复了这九个漏洞，分别是在 11 月初发布的 CryptoPro 7.7.2 版本和 12 月初发布的 7.7.3 版本。他补充说，CryptoPro 在汽车、银行、政府机构、制造、研究、金融和医疗保健等关键行业拥有数百家客户，“在 ATM 领域也有广泛的安装。”
Burch says the company was prompt and collaborative throughout his disclosure process and he validated that the patches actually fix the vulnerabilities he found.
Burch 表示，该公司在他的整个漏洞披露过程中表现得非常迅速且积极配合，他也验证了这些补丁确实修复了他所发现的漏洞。
While CryptoPro does not publicly release update notes, Saame says that the company has maintenance agreements with all customers and notifies them in advance about any security findings as well as the company’s timeline for resolving them. “As a rule, the new version is already available to our customers before its official publication,” he says.
虽然 CryptoPro 不会公开发布更新说明，但 Saame 表示，公司与所有客户都签有维护协议，会提前通知他们任何安全发现以及公司解决这些问题的进度表。“通常情况下，新版本在正式发布前就已经提供给我们的客户了，”他说。
Diebold Nixdorf spokesperson Michael Jacobsen tells WIRED in a statement that only two of the nine vulnerabilities are relevant to Diebold Nixdorf’s Vynamic Security Hard Disk Encryption, the system where the ATM maker uses CryptoPro software. Jacobsen says that Diebold Nixdorf issued fixes related to those two bugs in December, but that they could not have been exploited on their own to compromise a Diebold Nixdorf ATM.
Diebold Nixdorf 发言人 Michael Jacobsen 在一份声明中告诉《连线》，这九个漏洞中只有两个与 Diebold Nixdorf 的 Vynamic 安全硬盘加密系统相关，该系统正是这家 ATM 制造商使用 CryptoPro 软件的地方。Jacobsen 表示，Diebold Nixdorf 已于 12 月发布了针对这两个漏洞的修复程序，但这些漏洞本身无法被利用来入侵 Diebold Nixdorf 的 ATM 机。
In ATMs, embedded devices, and enterprise security more broadly, the challenge of the software supply chain comes from all of the steps to actually apply fixes in the world. As in this case, a developer has to release a patch, then companies that implement the product in their own software need to develop a tailored fix, and then customers need to actually hear about and install that patch—which can be difficult for systems that are running in the field or can’t easily be paused and updated.
在 ATM、嵌入式设备以及更广泛的企业安全领域，软件供应链的挑战来自于在现实世界中应用修复程序的每一个步骤。正如本案所示，开发人员必须发布补丁，然后将该产品集成到自身软件中的公司需要开发定制的修复程序，接着客户需要获知并安装该补丁——对于那些正在运行中或难以轻易暂停并更新的系统来说，这可能非常困难。
Speaking generally about this challenge, Jacobsen, the Diebold Nixdorf spokesperson, says that “when a security issue is identified, Diebold Nixdorf assesses the impact, identifies affected products and configurations, and develops any needed updates through our product security and engineering processes. We then notify impacted customers and provide updates through standard software distribution channels, including the Global Security Portal where applicable. For deployed ATMs, updates are coordinated with each customer based on their operating model, service agreements, and change-management processes.”
在谈到这一挑战时，Diebold Nixdorf 发言人 Jacobsen 表示：“当发现安全问题时，Diebold Nixdorf 会评估影响，确定受影响的产品和配置，并通过我们的产品安全和工程流程开发所需的更新。然后，我们通知受影响的客户，并通过标准软件分发渠道（包括适用的全球安全门户）提供更新。对于已部署的 ATM，更新会根据每个客户的运营模式、服务协议和变更管理流程进行协调。”
Security researchers have warned for decades about the danger of relying on “security through obscurity” by trying to hide software from view or keep it locked away. And, as a result of this work, internet-of-things manufacturers and those in critical industries like the financial sector and medical device manufacturing have made some progress on transparency and promoting patch adoption. But Burch points out that as AI systems make it easier to evaluate software and find vulnerabilities—even for researchers or attackers who don’t have granular expertise in a given area—it is more pressing than ever to shed light on niche security products.
几十年来，安全研究人员一直警告说，试图通过隐藏软件或将其锁起来以实现“隐蔽式安全”（security through obscurity）是极其危险的。得益于这些研究工作，物联网制造商以及金融和医疗设备制造等关键行业的企业在透明度和促进补丁采用方面取得了一些进展。但 Burch 指出，随着人工智能系统使评估软件和发现漏洞变得更加容易——即使对于在特定领域没有深入专业知识的研究人员或攻击者来说也是如此——揭开小众安全产品的面纱变得比以往任何时候都更加紧迫。
“AI really blows away the obscurity model,” Burch says. “You don’t need to fully understand how something works anymore to move forward and potentially have a big impact.”
“人工智能彻底摧毁了隐蔽性模型，”Burch 说。“你不再需要完全理解某样东西是如何运作的，就能采取行动并可能产生巨大的影响。”
Updated 8/31/2026 at 8 am EDT: Added additional details from CryptoWorks. 更新于美国东部时间 2026 年 8 月 31 日上午 8 点：增加了来自 CryptoWorks 的更多细节。