As cash‑dispensing machines become increasingly network‑enabled, the security of their underlying software has moved to the front page of cyber‑risk discussions. At Black Hat USA 2026, Matt Burch of Atredis Partners presented nine previously unknown vulnerabilities in CryptoWare CryptoPro Secure Disk, a full‑disk encryption (FDE) and pre‑boot authentication solution marketed both to enterprises and to ATM manufacturers.

Technical Deep‑Dive

CryptoPro is integrated into Diebold’s Vynamic Security Suite (VSS) as the hard‑disk‑encryption component. Burch demonstrated that a failure state during pre‑boot decryption could cause the drive to be mounted in clear text. Coupled with a superficial LUKS‑encryption check, an attacker could masquerade a disk as encrypted while forcing the system to expose it as plaintext.

Even more concerning, the research revealed that CryptoPro stores its own key material and configuration values directly on the disk rather than in a protected enclave. This, together with the plaintext‑mount issue, gives an adversary full visibility into the most guarded secrets of the encryption stack. Burch also showed that CryptoPro’s Secure Boot configuration can be subverted to launch an arbitrary Linux environment on the ATM, bypassing the vendor‑supplied firmware.

Why ATMs Are a Prime Target

ATMs consist of a heavily fortified vault at the bottom and a comparatively lightweight computing head at the top. The latter houses the Windows‑based software stack that communicates with banks via the XFS (Extension for Financial Services) API. Burch explained that manufacturers often treat this “head” as a low‑risk component, using lower‑grade steel or even plastic, which makes physical intrusion far easier than breaking into the cash vault.

Once the head unit is accessed, an attacker can inject malicious code that manipulates XFS, enabling the classic “jackpotting” attack—forcing the machine to dispense cash without authorization. Since the first reported jackpotting incidents in 2017, the FBI has logged roughly 2,000 cases, with more than 700 in 2025 alone, amounting to over $20 million in stolen cash.

Industry Response and Ongoing Debate

Diebold Nixdorf, when approached for comment, asserted that it does not employ BitLocker nor CryptoPro Secure Disk for BitLocker, suggesting that the discovered flaws do not directly affect its machines. Nevertheless, the company admitted that components of CryptoPro are present in its Vynamic Security HDE, but declined to detail the exact integration method.

CryptoPro’s developers have been engaged by Diebold to assess the impact, and a joint evaluation is underway. The broader implication is clear: if the vulnerabilities are exploitable, attackers could gain pre‑boot code execution, retrieve encryption keys, and execute a standard jackpotting workflow—potentially compromising millions of dollars across thousands of ATMs worldwide.

Looking Ahead

Regulators and industry bodies are likely to tighten hardware‑security standards and demand more transparent software‑supply‑chain practices. Manufacturers must treat the software layer with the same rigor as the physical vault, instituting robust key‑management, tamper‑evident boot processes, and regular penetration testing to stay ahead of sophisticated cyber‑physical threats.