The firm confirmed the incident in its blog post. The attackers posed as default admins and altered the settings to transfer all the funds to their wallet addresses.

As of press time, General Bytes is yet to publicly disclose the number of funds stolen or the number of Bitcoin ATMs impacted by the exploitation. However, the firm advised other ATM operators to update their software immediately.

According to information published by the company, a security bug was identified by the hacker in the CAS admin interface. The attackers scanned the cloud hosting provider Digital Ocean’s IP address space and took advantage of the exposure to identify running CAS services on ports 7777 or 443. Also, the hackers allegedly created a new default admin user, organization, and terminal afterward.

The hacker renamed the default admin user “gb” after scanning the CAS interface. The crypto setting of the two-way machine was altered through the wallet settings. As a result of this, funds sent into the ATMs by customers were delivered into the hacker’s wallet through two-way Bitcoin ATMs.

In addition, a URL call on the page used for default installation and creating the first administration user on the server was wielded by the hacker to create an admin user. General Bytes has, however, claimed that the database was not accessed despite the violation. According to the company, all passwords, password hashes, salts, API keys, and private keys are intact.

Get full details here
https://coins-gazette.com/post-detail/the-server-of-a-popular-bitcoin-atm-maker-general-bytes-has-been-attacked