CVE-2023-24063
📋 TL;DR
This vulnerability allows physical attackers to bypass disk encryption on Diebold Nixdorf ATMs by manipulating the /etc/mtab file during the Pre-Boot Authorization process. Attackers with physical access to the hard disk can potentially access encrypted data without proper authentication. This affects Diebold Nixdorf Vynamic Security Suite installations before version 3.3.0 SR10.
💻 Affected Systems
- Diebold Nixdorf Vynamic Security Suite (VSS)
📦 What is this software?
Vynamic Security Suite by Dieboldnixdorf
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of ATM security, allowing attackers to extract sensitive financial data, manipulate transactions, or install persistent malware on ATM systems.
Likely Case
Physical attackers bypass disk encryption to access sensitive ATM configuration data, potentially enabling further attacks or financial fraud.
If Mitigated
Limited impact if physical security controls prevent unauthorized access to ATM hardware components.
🎯 Exploit Status
Exploitation requires physical access to manipulate the hard disk, but the technique is documented in DEF CON 32 presentation and white paper.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.3.0 SR10 or later
Vendor Advisory: https://www.dieboldnixdorf.com/en-us/banking/portfolio/software/security/
Restart Required: Yes
Instructions:
1. Contact Diebold Nixdorf for patch availability. 2. Apply VSS update to version 3.3.0 SR10 or later. 3. Reboot ATM system to activate the fix.
🔧 Temporary Workarounds
Enhanced Physical Security
allStrengthen physical access controls to prevent unauthorized access to ATM hardware components.
Disk Tamper Detection
allImplement physical tamper detection mechanisms and regular integrity checks of ATM hardware.
🧯 If You Can't Patch
- Implement strict physical security controls and surveillance for all ATM locations
- Conduct regular physical security audits and integrity checks of ATM hardware
🔍 How to Verify
Check if Vulnerable:
Check VSS version using vendor-provided tools or check if /etc/mtab validation is missing during PBA process.Check Version:
Use Diebold Nixdorf VSS management tools to check current versionVerify Fix Applied:
Verify VSS version is 3.3.0 SR10 or later and test PBA process with manipulated /etc/mtab to confirm rejection.📡 Detection & Monitoring
Log Indicators:
- Failed PBA attempts with unusual timing
- Physical tamper detection alerts
- Unexpected system reboots or PBA process anomalies
Network Indicators:
- Unusual physical access patterns to ATM locations
SIEM Query:
Physical security alerts AND (ATM system events OR PBA failure events)