ATM Encryption Flaws Expose Software Supply Chain Risks

Security researcher uncovers encryption vulnerabilities

Security researcher Matt Burch has identified nine vulnerabilities in CryptoPro Secure Disk, a disk encryption and pre-boot authentication software manufactured by German firm CryptWare. The flaws could have allowed attackers to bypass integrity checks and gain full access to encrypted devices, according to findings Burch presented at the Black Hat and Defcon security conferences in Las Vegas this month.

CryptoPro is marketed to ATM manufacturers and deployed in some machines, including those using Diebold Nixdorf's Vynamic Security Suite. However, the software's reach extends beyond financial services—CryptWare also sells it as a security solution for embedded device makers and large organizations running Microsoft Windows.

Patches deployed but adoption remains complex

CryptWare managing director Uwe Saame confirmed the company patched all nine vulnerabilities in two releases: version 7.7.2 in early November and version 7.7.3 in early December. Burch validated the fixes and noted that CryptWare was responsive throughout the disclosure process, though the company does not appear to publicly release detailed update notes.

Diebold Nixdorf spokesperson Michael Jacobsen stated that only two of the nine vulnerabilities affected the company's Vynamic Security Hard Disk Encryption product. The ATM manufacturer issued fixes in December and emphasized that the two relevant bugs could not have been exploited independently to compromise a Diebold Nixdorf ATM.

Supply chain creates multi-layered patching challenge

The incident illustrates a fundamental problem in software supply chains: even after a vendor releases a patch, companies integrating that software must develop tailored fixes, and end customers must then learn about and install those updates. For systems deployed in the field—particularly ATMs and embedded devices that cannot be easily paused for maintenance—this process becomes especially difficult.

Jacobsen explained that when Diebold Nixdorf identifies a security issue, the company assesses impact, develops updates through internal processes, and coordinates deployment with customers based on their service agreements and change-management procedures.

Why it matters

As AI tools make it easier to analyze software and identify vulnerabilities—even for researchers without deep domain expertise—the traditional model of "security through obscurity" becomes increasingly untenable. Organizations relying on niche security products embedded across multiple industries face growing pressure to improve transparency and accelerate patch adoption before automated vulnerability discovery outpaces their ability to respond.

AI amplifies the urgency

Burch emphasized that artificial intelligence is fundamentally changing the threat landscape. "AI really blows away the obscurity model," he said. "You don't need to fully understand how something works anymore to move forward and potentially have a big impact."

While Burch's research began with ATM security, he believes the implications extend far beyond financial services. "From the perspective of ATMs and the financial network, there are a lot of layers, and I think as a result of that, things just get implemented a certain way and then there's limited technical insight—bugs can get overlooked or they don't get addressed," he explained.

These findings were first reported by WIRED.