Nine CVEs in the Encryption Guarding ATMs, and a Path to Jackpotting the Cash: Matt Burch at Black Hat 2026

Full-disk encryption is supposed to be the last line of defense on a machine full of money. This research showed what happens when the encryption stores its own keys right next to the lock.

The target was CryptWare CryptoPro Secure Disk, a pre-boot full-disk encryption product used in enterprises and, notably, marketed to ATM manufacturers. Matt Burch found nine vulnerabilities in how it handles pre-boot decryption and where it keeps its secrets.

The failures compound. In certain fail states the software would mount volumes in plaintext, a shallow check let an attacker fake an encrypted disk, and the key material and configuration were stored on the disk itself, so an attacker could recover the program's most guarded secrets and run their own Linux environment during pre-boot.

In his Black Hat 2026 talk, "The Cost of Obscurity: Exploiting the ATM Supply Chain", delivered Wednesday, August 5, Matt Burch disclosed the nine CVEs and released his tooling.

Speaker: Matt Burch — Principal Security Researcher, Atredis Partners

Matt Burch is a Principal Security Researcher at Atredis Partners with two decades in information security and about fifteen years focused on adversarial testing, specializing in ATM, IoT, and mobile research.

At the talk he disclosed nine CVEs and released a tool called ragavan, and he demonstrated how the chain could allow pre-boot code execution, decryption-key recovery, and potentially cash theft through jackpotting. Diebold Nixdorf, which uses CryptoPro components in its Vynamic Security Suite, disputes the real-world impact on its ATMs and shipped an update in December 2025, though it conceded two issues are theoretically applicable.

The research builds on his earlier DEF CON work on defeating ATM disk encryption, and his tools and write-ups are on his GitHub, with supporting analysis on the Atredis Partners research blog.

Anyone working in hardware security, embedded systems, or financial infrastructure will find this a pointed reminder that encryption is only as strong as where it hides its keys.

If the software protecting an ATM's disk can be tricked into mounting in plaintext and keeps its keys on the same disk, how much should we trust obscurity as a security strategy for critical hardware?