Cash machines look simple from the outside, but the computers inside them run security software also sold to organizations in automotive, healthcare, and government. That overlap is exactly what turned a study of ATMs into a much wider warning about how fragile shared code can be.
- Researcher Matt Burch spent five years studying ATM security and found flaws that reach far past banking.
- Nine vulnerabilities in CryptoPro Secure Disk were patched across two software releases.
- The bigger lesson is how slowly fixes travel once one product lands inside many industries.
Five Years Inside the Money Box
Security researcher Matt Burch has spent roughly five years studying the machines that hand out cash. His interest started with ATMs, where a small software mistake can put real money within reach. The deeper he looked, the more he noticed something bigger. The same code protecting a bank lobby machine also runs in plenty of other places, and that is where his attention shifted.
At the Black Hat and Defcon security conferences in Las Vegas this year, Burch shared findings on nine vulnerabilities in a disk encryption and pre-boot authentication product called CryptoPro Secure Disk. His work showed the flaws could have let someone slip past the software’s integrity checks and reach a fully encrypted device. All nine have been fixed.
One Product, Many Doors
CryptoPro comes from the German software firm CryptWare. It is marketed to ATM makers and shows up in some cash machines, including as part of Diebold Nixdorf’s Vynamic Security Suite. But the product does not stop at banking. CryptWare managing director Uwe Saame says the company has hundreds of customers across automotive, banking, government agencies, manufacturing, research, finance, and healthcare, plus a wide footprint in the ATM sector.
That reach is the whole point. When a single security tool is built into products across so many fields, a bug in that tool is not one company’s problem. Affected organizations need to understand which underlying system components contain the shared code and which updates their configurations require.
Saame says the nine bugs were patched in two phases, arriving in CryptoPro versions 7.7.2 and 7.7.3. Burch confirmed the patches actually close the holes he reported, and he describes the company as quick and cooperative during the disclosure process. CryptoPro does not publish public update notes, but Saame says the firm keeps maintenance agreements with its customers and tells them about security findings ahead of time, often making a new version available before its official release.
Why Fixes Move So Slowly
Diebold Nixdorf spokesperson Michael Jacobsen says only two of the nine vulnerabilities apply to its Vynamic Security Hard Disk Encryption, the spot where the ATM maker uses CryptoPro code. He says the company issued fixes for those two and that neither flaw could have been used on its own to break into a Diebold Nixdorf machine.
Even with a patch ready, getting it into the field is its own hurdle. First the original developer ships a fix. Then any company that built the product into its own systems has to shape a version that fits. Only after that do the end customers hear about the update and install it, and machines running out in the world cannot always be paused for maintenance on short notice. Jacobsen says that when an issue turns up, his company checks the impact, finds affected products and setups, builds updates, then coordinates rollout with each customer based on their service agreements and change management routines. That careful process helps, though it also explains why a known fix can take a long time to reach every deployed device.
What This Story Should Prompt You to Ask
The takeaway for any organization is worth sitting with. Ask what third-party software lives inside the products you depend on, what secure software development practices the vendor follows, and how quickly its fixes would actually reach your equipment. A patch that exists but never gets installed protects no one. Shared code brings real convenience, and it also spreads risk to places you might never think to check. Knowing where that borrowed software sits is the first honest step toward keeping it safe.
