Security News > 2023 > March > Bitcoin ATM customers hacked by video upload that was actually an app
In August 2022, we wrote how General Bytes had fallen victim to a server-side bug in which remote attackers could trick a customer's ATM server into giving them access to the "Set up a brand new system" configuration pages.
In the General Bytes ATM server the unauthorised access path that got the attackers into the "Start from scratch" setup screens didn't neutralise any data on the infiltrated device first.
So the crooks could abuse the server's "Set up a new administrative account" process to create an additional admin user on an existing system.
The 2022 attack was orchestrated simply through malevolent configuration changes, with the underlying operating system and server software left untouched.
What to do? If you run General Bytes Coin ATM systems, read the company's breach report, which tells you how to look for so-called IoCs, and what to do while you wait for patches to be published.
In an about-turn that will take the company in the opposite direction to most other contemporary service-oriented companies, General Bytes insists that "It is theoretically impossible to secure a system granting access to multiple operators at the same time where some of them are bad actors."