Diebold Nixdorf ProCash 2100xe USB ATM does not adequately secure communications between CCDM and host

Overview

Diebold Nixdorf 2100xe USB automated teller machines (ATMs) are vulnerable to physical attacks on the communication channel between the cash and check deposit module (CCDM) and the host computer. An attacker with physical access to internal ATM components may be able to exploit this vulnerability to commit deposit forgery.

Description

Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer. An attacker with physical access to internal ATM components can intercept and modify messages, such as the amount and value of currency being deposited, and send modified messages to the host computer.

A similar vulnerability identified as CVE-2020-10124 is decribed in VU#815655. CVE-2020-10124 affects the bunch note acceptor (BNA) in ATMs supplied by a different vendor. The BNA is functionally similar to the CCDM.

Impact

By modifying deposit transaction messages, an attacker may be able to commit deposit forgery. Such an attack requires two separate transactions. The attacker must first deposit actual currency and modify messages from the CCDM to the host computer to indicate a greater amount or value than was actually deposited. Then the attacker must make a withdrawal for an artificially increased amount or value of currency. This second transaction may need to occur at an ATM operated by a different financial institution (i.e., a not-on-us or OFF-US transaction).

Solution

Obtain advice from vendor

Diebold Nixdorf released a document titled “Potential CCDM Deposit Forgery” on February 27, 2020 that details the recommended procedures for addressing this vulnerability. Contact the vendor to obtain the document.

Apply an update

The vendor has released an update to secure communications between the CCDM and the host computer. Contact the vendor regarding this software update.

Consider additional countermeasures

In addition to applying a software update, the vendor recommends limiting physical access to the ATM (including internal components), adjusting deposit transaction business logic, and implementing fraud monitoring. For details about these additional recommended countermeasures, contact the vendor.

Acknowledgements

This vulnerability was researched and reported by Maxim Kozorez. At the time of the initial report, Maxim Kozorez was associated with Embedi.

Coordinating with Embedi was supported by U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) License No. CYBER2-2019-359003-1, Cyber-Related Sanctions Regulations License issued April 2, 2019 to Licensees: CERT Coordination Center at Carnegie Mellon’s Software Engineering Institute (CERT), U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA), the National Cybersecurity and Communications Integration Center.

This document was written by Eric Hatleback and Laurie Tyzenhaus.

Vendor Information

221785

Filter by status: All Affected Not Affected Unknown

Filter by content: __ Additional information available

__ Sort by: Status Alphabetical

Expand all

Diebold Nixdorf __ Affected

Notified: 2020-08-17 Updated: 2020-08-20 CVE-2020-9062	Affected

Vendor Statement

Diebold Nixdorf is aware of this publication and support customers in identifying potential mitigations specific to their environment. For detailed information, please contact your local sales representative or your Diebold Nixdorf security expert at [email protected].

For this specific case, the Fact Sheet “Potential CCDM Deposit Forgery” was published to inform about the potential risk and respective mitigations. In case you are member of the Banking Industry but have not received this Fact Sheet, please subscribe to ACTive Security Alerts and Fact Sheets to stay informed about security related communication.

Banking related industry peers can register for a free subscription at [email protected] (contact and company details to be included).

CERT Addendum

Please contact Diebold Nixdorf directly if you need assistance with addressing this vulnerability.

References

• <https://home.treasury.gov/news/press-releases/sm0410&gt;
• <https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20180611.aspx&gt;
• <https://www.treasury.gov/resource-center/sanctions/Programs/Documents/cyber_eo.pdf&gt;

Other Information

CVE IDs:	CVE-2020-9062
Date Public:	2020-08-20 Date First Published: