Diebold Nixdorf 2100xe USB automated teller machines (ATMs) are vulnerable to physical attacks on the communication channel between the cash and check deposit module (CCDM) and the host computer. An attacker with physical access to internal ATM components may be able to exploit this vulnerability to commit deposit forgery.
Diebold Nixdorf ProCash 2100xe USB ATMs running Wincor Probase version 1.1.30 do not encrypt, authenticate, or verify the integrity of messages between the CCDM and the host computer. An attacker with physical access to internal ATM components can intercept and modify messages, such as the amount and value of currency being deposited, and send modified messages to the host computer.
A similar vulnerability identified as CVE-2020-10124 is decribed in VU#815655. CVE-2020-10124 affects the bunch note acceptor (BNA) in ATMs supplied by a different vendor. The BNA is functionally similar to the CCDM.
By modifying deposit transaction messages, an attacker may be able to commit deposit forgery. Such an attack requires two separate transactions. The attacker must first deposit actual currency and modify messages from the CCDM to the host computer to indicate a greater amount or value than was actually deposited. Then the attacker must make a withdrawal for an artificially increased amount or value of currency. This second transaction may need to occur at an ATM operated by a different financial institution (i.e., a not-on-us or OFF-US transaction).
Diebold Nixdorf released a document titled "Potential CCDM Deposit Forgery" on February 27, 2020 that details the recommended procedures for addressing this vulnerability. Contact the vendor to obtain the document.
The vendor has released an update to secure communications between the CCDM and the host computer. Contact the vendor regarding this software update.
In addition to applying a software update, the vendor recommends limiting physical access to the ATM (including internal components), adjusting deposit transaction business logic, and implementing fraud monitoring. For details about these additional recommended countermeasures, contact the vendor.
This vulnerability was researched and reported by Maxim Kozorez. At the time of the initial report, Maxim Kozorez was associated with Embedi.
Coordinating with Embedi was supported by U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) License No. CYBER2-2019-359003-1, Cyber-Related Sanctions Regulations License issued April 2, 2019 to Licensees: CERT Coordination Center at Carnegie Mellon’s Software Engineering Institute (CERT), U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA), the National Cybersecurity and Communications Integration Center.
This document was written by Eric Hatleback and Laurie Tyzenhaus.
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Notified: 2020-08-17 Updated: 2020-08-20 CVE-2020-9062| Affected
Diebold Nixdorf is aware of this publication and support customers in identifying potential mitigations specific to their environment. For detailed information, please contact your local sales representative or your Diebold Nixdorf security expert at email@example.com.
For this specific case, the Fact Sheet “Potential CCDM Deposit Forgery” was published to inform about the potential risk and respective mitigations. In case you are member of the Banking Industry but have not received this Fact Sheet, please subscribe to ACTive Security Alerts and Fact Sheets to stay informed about security related communication.
Banking related industry peers can register for a free subscription at firstname.lastname@example.org (contact and company details to be included).
Please contact Diebold Nixdorf directly if you need assistance with addressing this vulnerability.
CVE IDs: | CVE-2020-9062
Date Public: | 2020-08-20
Date First Published: | 2020-08-20
Date Last Updated: | 2020-08-24 17:40 UTC
Document Revision: | 2