GoKawiilResearcher Finds Nine Flaws in CryptoPro Disk Encryption Used in ATMs
Security researcher Matt Burch disclosed nine vulnerabilities in CryptWare's CryptoPro Secure Disk, an encryption and pre-boot authentication tool used in ATMs including Diebold Nixdorf's Vynamic Security Suite. The bugs could have let attackers bypass integrity checks and gain full access to encrypted devices, and CryptWare has since patched them across two software updates released in November and December.
GoKawiil's interpretation of the reporting above, not reported fact.
CryptoPro is not confined to ATMs alone—it's also sold to embedded-device makers and organizations running Windows, meaning a single flawed component can quietly ripple across many critical systems and industries. The case illustrates how deeply layered software supply chains in finance and infrastructure can hide vulnerabilities for years before anyone with the right expertise looks closely enough to find them.
- Matt Burch found nine vulnerabilities in CryptWare's CryptoPro Secure Disk software.
- The flaws could bypass integrity checks to gain full access to encrypted ATM devices.
- CryptWare patched the issues in two updates, versions 7.7.2 and 7.7.3, released in late 2023.
Apricorn Aegis Secure Key 3NXC USB Drive — When software-based disk encryption turns out to have bypassable integrity checks, hardware-encrypted storage with an onboard PIN keypad is a satisfying alternative. The Apricorn Aegis Secure Key 3NXC keeps authentication off the host computer entirely, so your files stay locked even if the machine they're plugged into can't be trusted.
See Apricorn Aegis Secure Key 3NXC USB Drive on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: wired.com — Lily Hay Newman, 2026-08-31
Published there as: “ATM Flaws Reveal Key Weaknesses in the Software Supply Chain”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.