For the past five years, security researcher Matt Burch has immersed himself in the esoteric and high-stakes world of ATM security, where small software flaws can sometimes expose cold, hard cash. As Burch has bored deeper into the computers powering these digital lock boxes—and continued to find vulnerabilities in key digital security systems—he has started working to raise the alarm, not just about overlooked ATM flaws, but about how that same software used in other industries can introduce weaknesses in an array of critical systems. The findings he presented at the Black Hat and Defcon security conferences in Las Vegas this month reveal a sobering truth: the software supply chain is only as strong as its most obscure component, and the same code that protects cash machines also guards data in automotive, healthcare, government, and financial systems worldwide.
Nine Vulnerabilities in CryptoPro Secure Disk Expose a Systemic Problem
At Black Hat and Defcon, Burch detailed nine vulnerabilities in a disk encryption and pre-boot authentication software package called CryptoPro Secure Disk, made by the German firm CryptWare. The flaws could have been exploited to bypass CryptoPro’s integrity checks and gain full access to encrypted devices. CryptoPro is marketed primarily to ATM manufacturers and is integrated into systems such as Diebold Nixdorf’s Vynamic Security Suite, but its reach extends far beyond the banking lobby. CryptWare managing director Uwe Saame confirmed to WIRED that the company has hundreds of customers across critical industries, including automotive, banking, government agencies, manufacturing, research, finance, and healthcare, with extensive installations in the ATM sector.
Burch’s research did not stop at identifying the bugs. He worked with CryptWare through a coordinated disclosure process, validating that the patches the company issued actually remediate the vulnerabilities. CryptWare released fixes in two phases: version 7.7.2 in early November and version 7.7.3 in early December. While CryptoPro does not publicly release update notes, Saame stated that the company maintains agreements with all customers and notifies them in advance about security findings and the company’s timeline for resolving them. “As a rule, the new version is already available to our customers before its official publication,” he said.
What Are the CryptoPro Vulnerabilities and How Could They Be Exploited?
The nine vulnerabilities reside in CryptoPro Secure Disk’s pre-boot authentication and disk encryption logic. Pre-boot authentication is a security layer that requires a user to authenticate before the operating system even loads, making it a critical control point for protecting data on a device. If an attacker can bypass these checks, they gain full access to the encrypted drive, effectively neutralizing the encryption itself. Burch demonstrated that the flaws could be used to circumvent CryptoPro’s integrity verification mechanisms, which are designed to prevent unauthorized code from executing during the boot process. An attacker with physical access to a machine—or, in some scenarios, with remote access to the boot chain—could leverage these weaknesses to compromise the entire system.
This is not a theoretical risk. In the context of ATMs, physical access is a given for attackers who target the machines directly. Cash-out attacks, in which criminals break into the ATM chassis and connect directly to internal components, are a well-known threat vector. The CryptoPro flaws would have made such attacks significantly easier, potentially allowing an attacker to bypass disk encryption and extract sensitive data or install malicious software that dispenses cash on command.
Diebold Nixdorf’s Response: Limited Exposure but Broader Implications
Diebold Nixdorf, one of the world’s largest ATM manufacturers, uses CryptoPro software as part of its Vynamic Security Hard Disk Encryption system. In a statement, Diebold Nixdorf spokesperson Michael Jacobsen said that only two of the nine vulnerabilities are relevant to the company’s implementation, and that the company issued fixes related to those two bugs in December. Jacobsen also emphasized that the two flaws could not have been exploited on their own to compromise a Diebold Nixdorf ATM, suggesting that additional layers of security within the Vynamic suite would have mitigated the risk.
That assessment, while reassuring for Diebold Nixdorf customers, does not diminish the broader supply chain concern. The fact that two of nine vulnerabilities applied to one major customer’s integration, while the remaining seven affected other implementations, illustrates the fragmentation of risk in the software supply chain. A single software product, CryptoPro Secure Disk, is embedded in products from multiple vendors, each of which integrates it differently, inherits a different subset of vulnerabilities, and patches on a different timeline. The result is a patchwork of exposure that is difficult for any single organization to assess or control.
What Is the Software Supply Chain Problem in ATM Security and Beyond?
The software supply chain problem in ATM security, and in enterprise security more broadly, is not merely about finding and fixing bugs. It is about the entire lifecycle of vulnerability management across multiple tiers of vendors and integrators. When a researcher like Burch discovers flaws in a foundational component like CryptoPro Secure Disk, the remediation process involves at least three distinct stages. First, the original developer (CryptWare) must write and release a patch. Second, each company that has embedded CryptoPro into its own product (such as Diebold Nixdorf) must develop a tailored update that works with its specific integration. Third, the end customers—banks, government agencies, manufacturers, healthcare providers—must receive notification of the patch, understand its relevance to their systems, and apply it to devices that may be deployed in the field, often in remote or hard-to-reach locations.
Each of these stages introduces delays and friction. ATMs, for example, are often located in retail environments, outdoor kiosks, or branch lobbies where they cannot easily be taken offline for maintenance. Updating an ATM’s boot-level security software typically requires a physical visit from a technician, a coordinated downtime window, and careful testing to ensure that the patch does not interfere with the machine’s core functionality. For embedded devices in manufacturing or healthcare, the stakes are even higher: a failed update could halt a production line or disrupt a medical device.
Burch captured the essence of the problem when he said, “ATMs are what brought me down this path, but I think there may be an even higher impact of these findings beyond that. From the perspective of ATMs and the financial network, there are a lot of layers, and I think as a result of that, things just get implemented a certain way and then there’s limited technical insight—bugs can get overlooked or they don’t get addressed.”
How Does the Software Supply Chain for ATMs Create Unique Risk?
ATMs are a particularly instructive case study in software supply chain risk because they combine high-value assets (cash), long deployment lifetimes (often 10 years or more), and complex multi-vendor software stacks. A typical ATM runs a customized version of Microsoft Windows or a Linux-based embedded OS, overlayed with ATM-specific middleware from the manufacturer, third-party security software like CryptoPro Secure Disk, and application-level software from the bank or payment processor. Each layer introduces its own dependencies and vulnerabilities.
The financial network’s “many layers,” as Burch described them, create a situation where no single party has complete visibility into the entire security posture. The ATM manufacturer knows its own hardware and software but may not deeply scrutinize third-party components. The bank knows its own network and policies but may not have the technical expertise to assess the security of pre-boot encryption software. The third-party vendor, like CryptWare, knows its own product but may not understand how it is integrated into every customer’s environment. Information asymmetry and limited technical insight across the supply chain mean that bugs can persist for years before they are discovered, and even longer before they are fully patched.
Saame’s statement that CryptWare has “hundreds of customers across critical industries” underscores the amplification effect. A vulnerability in CryptoPro is not just an ATM problem; it is an automotive problem, a government problem, a healthcare problem. The same software that protects a cash machine’s encrypted hard drive may also protect a manufacturing robot’s control system or a hospital’s patient records. The supply chain interconnections mean that a flaw in one component can propagate risk across sectors that have little else in common.
The Patch Deployment Challenge: Why Fixes Don’t Always Reach the Field
Even when patches are available, the gap between release and deployment can be wide and dangerous. CryptWare released its fixes in November and December, and Diebold Nixdorf issued its tailored updates in December. But the actual application of those updates to ATMs in the field depends on each bank’s operational model, service agreements, and change-management processes. As Jacobsen noted, “For deployed ATMs, updates are coordinated with each customer based on their operating model, service agreements, and change-management processes.”
This is a polite way of saying that some customers may apply the patch immediately, while others may take weeks or months, and some may never apply it at all if the machine is decommissioned or replaced before the update reaches it. In the ATM world, where machines are often owned by independent deployers or managed by third-party service providers, the chain of responsibility for security updates is not always clear. The result is a long tail of unpatched systems that remain vulnerable long after the fix is available.
This pattern is not unique to ATMs. It is a well-documented weakness in the broader software supply chain, affecting everything from enterprise servers to consumer routers to medical devices. The difference is that ATMs have a direct physical consequence: an unpatched vulnerability can lead to the loss of cash. That makes the ATM sector a bellwether for supply chain security practices that will eventually matter to every industry that relies on embedded software.
What Are the Broader Implications for Critical Infrastructure?
Burch’s research arrives at a time when the software supply chain is under intense scrutiny from regulators, policymakers, and industry consortia. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published guidelines for software supply chain security, and the European Union is moving toward the Cyber Resilience Act, which would impose stricter requirements on software vendors and integrators. The CryptoPro case illustrates why such regulation is necessary, but also why it is difficult to implement effectively.
CryptWare is a German company selling to a global market. Its customers include governments, banks, and critical infrastructure operators in multiple jurisdictions. The vulnerabilities Burch found were disclosed and patched responsibly, but the timeline from discovery to patch to field deployment was measured in months, not days. For a zero-day exploit that could be weaponized by criminals or nation-state actors, that timeline is an invitation to attack.
The fact that CryptoPro is used in both ATMs and other critical sectors raises the stakes considerably. A vulnerability that allows an attacker to bypass disk encryption on a government laptop is a national security concern. A vulnerability that allows the same on a healthcare device could compromise patient data or even patient safety. The supply chain that links these systems together is not just a technical issue; it is a policy and governance issue that requires coordination across industries, borders, and regulatory frameworks.
How the ATM Industry Can Strengthen Its Software Supply Chain
The ATM industry has several levers it can pull to reduce the risk of supply chain vulnerabilities. First, manufacturers can mandate that third-party software components undergo independent security reviews before they are integrated into products. Burch’s work is an example of the kind of deep, independent analysis that is necessary but often lacking. Second, banks and deployers can demand transparency from their vendors about the software components used in their ATMs, including version numbers, patch histories, and known vulnerabilities. Third, the industry can adopt standardized update mechanisms that make it easier to deploy patches to fielded machines, reducing the friction that currently delays remediation.
None of these steps are easy. They require investment, coordination, and a willingness to share information that many companies consider proprietary. But the alternative is a continued cycle of discovery, disclosure, and delayed patching that leaves ATMs—and the systems that depend on the same software—exposed to unnecessary risk.
A Forward-Looking Perspective on Supply Chain Resilience
Matt Burch’s five-year journey into ATM security has yielded more than a list of vulnerabilities. It has revealed a structural weakness in the way critical software is developed, distributed, and maintained across industries. The nine flaws in CryptoPro Secure Disk have been fixed, and the responsible parties have acted in good faith. But the underlying supply chain dynamics that allowed those flaws to persist for years, and that will delay their remediation in the field, remain largely unchanged. The real test of the industry’s resilience will not be whether it can find and patch bugs, but whether it can build a system in which patches reach every vulnerable device before attackers can exploit them. That is a challenge that no single company can solve alone, and one that will define the security of digital infrastructure for years to come.
