{"document":{"acknowledgments":[{"urls":["https://kb.cert.org/vuls/id/815655#acknowledgements"]}],"category":"CERT/CC Vulnerability Note","csaf_version":"2.0","notes":[{"category":"summary","text":"### Overview\r\nNCR SelfServ automated teller machines (ATMs) running APTRA XFS 04.02.01 and 05.01.00 are vulnerable to physical attacks on the communications bus between the host computer and the bunch note accepter (BNA).\r\n\r\n### Description \r\nNCR ATM SelfServ devices running APTRA XFS 04.02.01 and 05.01.00 contain vulnerabilities that can be exploited by an attacker with physical access to the internal components of the ATM, specifically the BNA and the host computer.\r\n\r\n#### CVE-2020-10124\r\nNCR SelfServ ATMs running APTRA XFS 05.01.00 do not encrypt, authenticate, or verify the integrity of messages between the BNA and the host computer. A similar vulnerability is identified as [CVE-2020-9062](https://nvd.nist.gov/vuln/detail?vulnId=2020-9062) in [VU#221785](https://kb.cert.org/vuls/id/221785).  CVE-2020-9062 involves the cash and check deposit module (CCDM) in ATMs from a different vendor. The CCDM is functionally similar to the BNA.\r\n\r\n#### CVE-2020-10125\r\nNCR SelfServ ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate BNA software updates. Keys of this strength can be broken by an attacker in a sufficiently short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code. (CWE-326)\r\n\r\n#### CVE-2020-10126\r\nNCR SelfServ ATMs running APTRA XFS 05.01.00 do not properly validate software updates for the BNA. An attacker with physical access to internal ATM components can restart the host computer. During boot, the update process looks for CAB archives on removable media and executes a specific file without first validating the signature of the CAB archive. This allows an attacker to execute arbitrary code with SYSTEM privileges. (CWE-305)\r\n\r\n### Impact\r\nAn attacker with physical access to the internal components of the ATM, including the BNA, can execute arbitrary code. An attacker may also be able to commit deposit forgery, with or without also executing arbitrary code.\r\n\r\nA deposit forgery attack requires two separate transactions. The attacker must first deposit actual currency and manipulate the message from the BNA to the host computer to indicate a greater amount or value than was actually deposited. Then the attacker must make a withdrawal for an artificially increased amount or value of currency. This second transaction may need to occur at an ATM operated by a different financial institution (i.e., a not-on-us or OFF-US transaction).\r\n\r\n### Solution\r\n\r\n#### Apply an update\r\nUpdate software to APTRA XFS 06.08. The update increases the strength of the RSA keys to limit the window of opportunity for an attacker to crack and misuse the keys (CVE-2020-10125). The update also provides protection against the bypass of the digital signature check (CVE-2020-10126).\r\n\r\n### Acknowledgements\r\nThese vulnerabilities were researched and reported by Roman Bazhin and Dmitry Turchenkov. At the time of the initial report, Roman Bazhin and Dmitry Turchenkov were associated with Embedi.\r\n\r\nCoordinating with Embedi was supported by *U.S. Department of the Treasury, Office of Foreign Assets Control (OFAC) License No. CYBER2-2019-359003-1, Cyber-Related Sanctions Regulations License issued April 2, 2019 to Licensees: CERT Coordination Center at Carnegie Mellon’s Software Engineering Institute (CERT), U.S. Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA), the National Cybersecurity and Communications Integration Center.*\r\n\r\nThis document was written by Eric Hatleback and Laurie Tyzenhaus.","title":"Summary"},{"category":"legal_disclaimer","text":"THIS DOCUMENT IS PROVIDED ON AN 'AS IS' BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. ","title":"Legal Disclaimer"},{"category":"other","text":"CERT/CC Vulnerability Note is a limited advisory. It primarily identifies vendors impacted by the advisory and not specific products. We only support \"known_affected\" and \"known_not_affected\" status. Please consult the vendor's statements and advisory URL if provided by the vendor for more details ","title":"Limitations of Advisory"},{"category":"other","text":"NCR advises all of our customers that it is critically important that APTRA XFS software is kept up to date to ensure that the latest security patches are always installed. We note that the version of software referenced in this report, APTRA XFS 05.01 was released in 2010, and discontinued for support in 2015. Any customer still using unsupported software should upgrade at the earliest possible opportunity. NCR would also note that deposit fraud which might be achievable by exploiting the functionality described in these CVEs does not necessarily result in cash loss. Any Financial Institution that accepts automated deposits has ‘know your customer’ and other fraud mitigation policies in place which limit immediate funds availability. Such mitigations are typically stronger where foreign deposits are accepted, if at all. This form of electronic deposit fraud is unlikely to result in significant loss.","title":"Vendor statment from NCR Corporation"},{"category":"other","text":"There are no additional comments at this time.","title":"CERT/CC comment on NCR Corporation notes"}],"publisher":{"category":"coordinator","contact_details":"Email: cert@cert.org, Phone: +1412 268 5800","issuing_authority":"CERT/CC under DHS/CISA https://www.cisa.gov/cybersecurity also see https://kb.cert.org/ ","name":"CERT/CC","namespace":"https://kb.cert.org/"},"references":[{"url":"https://certcc.github.io/certcc_disclosure_policy","summary":"CERT/CC vulnerability disclosure policy"},{"summary":"CERT/CC document released","category":"self","url":"https://kb.cert.org/vuls/id/815655"},{"url":"https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_","summary":"https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_"},{"url":"https://home.treasury.gov/news/press-releases/sm0410","summary":"https://home.treasury.gov/news/press-releases/sm0410"},{"url":"https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20180611.aspx","summary":"https://www.treasury.gov/resource-center/sanctions/OFAC-Enforcement/Pages/20180611.aspx"},{"url":"https://www.treasury.gov/resource-center/sanctions/Programs/Documents/cyber_eo.pdf","summary":"https://www.treasury.gov/resource-center/sanctions/Programs/Documents/cyber_eo.pdf"},{"url":"https://www.ncr.com/content/dam/ncrcom/content-type/documents/NCR_Security_Alert-2018-13_APTRA_XFS_v5.pdf","summary":"Reference(s) from vendor \"NCR Corporation\""}],"title":"NCR SelfServ ATM BNA contains multiple vulnerabilities","tracking":{"current_release_date":"2020-08-21T17:16:44+00:00","generator":{"engine":{"name":"VINCE","version":"3.0.35"}},"id":"VU#815655","initial_release_date":"2020-08-20 14:21:29.966437+00:00","revision_history":[{"date":"2020-08-21T17:16:44+00:00","number":"1.20200821171644.2","summary":"Released on 2020-08-21T17:16:44+00:00"}],"status":"final","version":"1.20200821171644.2"}},"vulnerabilities":[{"title":"The communications bus between the host computer and the BNA is not encrypted in NCR SelfServ 6632 ATMs running APTRA XFS 05.","notes":[{"category":"summary","text":"The communications bus between the host computer and the BNA is not encrypted in NCR SelfServ 6632 ATMs running APTRA XFS 05.01.00. An attacker who gains physical access to the communications bus can commit deposit forgery by making a deposit, intercepting the communication containing the deposit information, and altering the communication by increasing the value of the actual deposit. Once the altered communication is accepted by the host computer, the attacker can withdraw the increased amount of currency."}],"cve":"CVE-2020-10124","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#815655"}],"product_status":{"known_affected":["CSAFPID-1cfe6914-39ef-11f1-8422-122e2785dc9f"]}},{"title":"NCR SelfServ 6632 ATMs running APTRA XFS 05.","notes":[{"category":"summary","text":"NCR SelfServ 6632 ATMs running APTRA XFS 05.01.00 are vulnerable to malicious code updates. An attacker with access to the BNA's bill validator can trigger the update process by restarting the machine. During the update process, the attacker can bypass the digital signature check by implementing a specially crafted CAB file, thereby executing arbitrary code with SYSTEM privileges."}],"cve":"CVE-2020-10126","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#815655"}],"product_status":{"known_affected":["CSAFPID-1cfeeab0-39ef-11f1-8422-122e2785dc9f"]}},{"title":"NCR SelfServ 6632 ATMs running APTRA XFS 04.","notes":[{"category":"summary","text":"NCR SelfServ 6632 ATMs running APTRA XFS 04.02.01 and 05.01.00 implement 512-bit RSA certificates to validate BNA software updates. Key pairs of this type can be broken by an attacker in a short period of time, thereby enabling the attacker to sign arbitrary files and CAB archives used to update BNA software, as well as bypass application whitelisting, resulting in the ability to execute arbitrary code."}],"cve":"CVE-2020-10125","ids":[{"system_name":"CERT/CC V Identifier ","text":"VU#815655"}],"product_status":{"known_affected":["CSAFPID-1cff6468-39ef-11f1-8422-122e2785dc9f"]}}],"product_tree":{"branches":[{"category":"vendor","name":"NCR Corporation","product":{"name":"NCR Corporation Products","product_id":"CSAFPID-1cfe6914-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"NCR Corporation","product":{"name":"NCR Corporation Products","product_id":"CSAFPID-1cfeeab0-39ef-11f1-8422-122e2785dc9f"}},{"category":"vendor","name":"NCR Corporation","product":{"name":"NCR Corporation Products","product_id":"CSAFPID-1cff6468-39ef-11f1-8422-122e2785dc9f"}}]}}