by Antonio Requena, Gabriel Gonzalez and Sergio Ruiz.

Nowadays, Bitcoin
and cryptocurrencies might look lees popular than they did just a few years
ago. However, it is still quite common to find Bitcoin ATMs in numerous
locations. 

IOActive
had access to few of these machines, specifically to Lamassu’s Douro ATM (https://lamassu.is). This provided us with the opportunity to assess the security of these
devices – more specifically, to attempt to achieve full control over them.

 

Figure 1. Lamassu Douro Bitcoin ATM

In this post,
we’ll explain all the steps we followed to identify a series of vulnerabilities
(CVE-2024-0175, CVE-2024-0176 and CVE-2024-0177) that allows full control over
these ATMs. For this exercise, we are assuming the role of an attacker with the
same physical access to the device that a regular customer might have. 

Don’t Touch
Me

After
booting up, the screen displays the the UI for the kiosk’s primary application.
However, during boot, for a few seconds the user can interact with the Linux
operative system’s window manager, as illustrated in Figure 2.

Figure 2. Accessing Applications during boot

During this
time, it was possible to pop up a terminal window or run any other installed
application as a low-privilege user.

Look at
the Camera!

In order to
obtain full control over the device, the next step was to perform a privilege
escalation. To achieve this, we exploited the software update mechanism by
creating a file named /tmp/extract/package/updatescript.js with the following payload:

cp =
require(“child_process”)

cp.exec(“cp /bin/sh
/tmp/shuid; chmod +sx /tmp/shuid”)

Next, we
created a file named done.txt in the /tmp/extract folder. This would trigger the watchdog process, which runs as root in
the reviewed machines, to execute the JavaScript payload.

How did we
create these files? Well, that’s an interesting question, as although we gained
access to the graphical interface and the terminal, there was no keyboard
plugged in. While we did have physical access to the devices, so that opening
them and plugging in a keyboard would be too easy, the goal was to gain control
without invasive physical access, therefore we explored a different approach.

The ATM
supports a feature that enables it to read QR codes, and the binary located at /usr/bin/zbarcam could be executed using the touch
controls, so we only had to use a custom QR code containing our payload. Once
the payload was read, a root shell was popped.

The
following video illustrates the paths we followed to exploit the vulnerability.

• 11th July 2023 – Initial contact to report the vulnerabilities.
• 9th October 2023 – The vendor confirmed the issues
  were fixed.
• 25th October 2023 – The vendor asked us to delay publishing
  details about the vulnerabilities.
• 22nd November 2023 – The vendor contacted us and published
  an advisory mentioning the issues were fixed.
• 18^th January 2024 – CVEs have been published by the
  corresponding CNA.