Version 20220725:
New Features:
Terminal: Added ability to turn on bitcoin donations for Ukraine on machine. See KB article how to do that.
Terminal/Server: Added possibility to withdraw cash by OTP sent via text message without use of redeem ticket
Server: Added ability to handle terminal notifications in Java in server extensions. See INotificationListener.java
BATMTwoUltra: Added support for BNR connection via USB.
BATMTwoUltra: Added support for selfie camera.
Improvements:
Terminal: Added support for Metamask ETH address QR code format.
Terminal: Improved cash acceptance speed by BNR.
Terminal: Updated French language translations.
Terminal: Improved animation performance of price chart in screen saver when switching between crypto currency pairs.
Terminal: Improved dispense to reject box dispense test when some of the cassettes are empty.
Server: Reverse proxy installation checks for FQDN.
Server: Added database indexes to transaction record for faster filtering by fiat and crypto currency.
Server: Improved textual explanation of phoneline type check in server admin.
Server: Improved textual explanation of terminal publish settings.
Bug Fixes:
BATMTwoUltra: Number of BNR fixes.
Terminal: Terminal didn't download new configuration automatically from server when server ip was changed.
Terminal: Face capture photo capture and camera preparation for QR code scanning could overlap.
Server: Fixed ETH purchase in BitGo
Server: Fixed BitGo null fields being sent with create address request.

IMPORTANT: We are sorry to inform you that 30minutes ago security issue has been identified in our CAS admin service which allows attacker to create a CAS user with administrative rights and therefore modify terminal cryptosettings for example by setting invalid payment address cryptosetting or setting his own sell wallet. We recommend you to:
0. Immediately limit access to your CAS admin (TCP port 7777 or 443) on firewall only for your IP addresses (for example home or office).
1. Review list of the CAS users on your server and make sure no new user is on your CAS server and check their permissions.
2. Review your cryptocurrency crypto-settings by executing cryptosetting tests.
3. Contact GB support if you need any assistance. Make sure you mention your server version.
4. If you don't know how to change your firewall settings shutdown your admin and master service until the patch is provided.

We will inform you once we have more information.

Releases containing security fix are being pushed to our distribution servers. We expect them to become available in next 30 minutes. Stay tuned we will post more information in next 30 minutes.

Information about the incident including the solution is here:
https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2785509377/Security+Incident+August+18th+2022

As a part of ongoing investigation we would like to ask you to fill the following form: https://forms.gle/JSDpQweHY4uAQdN5A

We recommend ATM operators that don't hide their ATM server and terminals behind VPN completely yet to do so. It will make their network more secure for the future. It becomes appearent that having critical infrastructure accessible on public internet is not the future proof concept.

Dear customers, today we received a report from a BATM operator that lost coins from his BUY wallet. Based on the logs provided we believe that this Operator upgraded his server to the patched version - but forgot to delete the unpaired Terminal that the attacker created while he had access to the server. Please (again) review all users that are listed in your CAS - and revoke access to the ones that you are unsure of including user 'gb'. Also DELETE ALL unpaired terminals - so the attacker cannot connect his own terminal to your server. Also delete all terminals on your server that might be paired but are not yours.

Dear customers,
Please be careful when you are unpairing terminals.

When you unpair terminal you are allowing any terminal with particular serial number to connect to your server and access hot wallet. Server trusts only to terminal that first pairs with the server after unpairing.

Unpair only terminals when you have information from physical location that machine is unable to connect to server.

Attackers are trying to emulate terminals with serial number of their choice and try to trick you into unpairing existing terminals.

To further protect yourself please move your terminal network behind VPN.

Version 20220815:
New Features:
Server: Added support for Premium tier - a tier above Registered tier.
Server/Terminal: Added possibility to allow CAS users entering different parts of terminal administration.
Every user generates his own QR code for entering terminal administration.
Terminal: Added Montenegro flag in terminal UI.
Improvements:
Server: First half of admin UI is rewritten to ReactJS.
Server: Added ability to create restore points via batm-manage.
Server: Added ability to assign identity to sell and withdraw transactions.
Server: EveryTrade renamed to WhaleBooks.
Server: Don't report Binance rate source misconfiguration as an exception.
Server: Added ability to allow only withdrawals by same identity as sell was created.
Terminal: Printer disconnected should be a warning.
Terminal: Added ability to cancel diagnostic test.
Terminal: Faster camera preview on some screens.
Terminal: Terminal reboot action is performed only when terminal gets to a home screen or screensaver.
Bug Fixes:
Server: Various Veriff fixes.

Version 20220930:
New Features:
Server/Terminal: Added experimental support for credit card payments using card reader for buy direction.
Server: Added support for secondary output queue. What queue transaction should be enqueued to is determined by extension only.
Improvements:
Server: Further rewrite of Admin UI to ReactJS.
Server: Resend of failed batch transaction is now able to resend all transactions that were in the batch.
Server: Overages in sell transactions now don't cause transaction to fail when new option Allow Overage is enabled.
Server: Added ability to enqueue also transactions for wallets that do not support sendMany.
Server: Added ability to import blacklisted addresses in admin via CSV.
Server: Added database index to GDPR audit log table.
Server: Added ability to mark transaction as withdrawn via server extensions.
Server: Chainalysis scoring provider now performs scoring of ERC20 tokens also on ETH main network.
Server: Identity images are now exported in zip.
Server: Added ability to set allowed period for transaction buy resending in the organization.
Server: Added new notifications for verification process.
Server: Added 3 attempts when connection to SMTP server fails when sending email.
Server: Removed DAI, BCH support from CoinMate.io exchange.
Server: Added ADA support to CoinMate.io and Kraken exchange.
Server: Added ability to read server configuration properties from extension.
Server/Terminal: Added custom transaction failed template for buy printed receipt.
Terminal/Server: Added possibility to set separate help videos for Buy and Sell flows.
Terminal: Added Privacy Policy & Custom Privacy Notice to standard terminal UI.
Terminal: Increased size of QR code image for Bitcoin Lightning on screen.

Version 20221001:
New Featrues:
Server/Terminal: Added support for GMKit.

Important security announcement:
There has been reported incident in eastern europe where an attacker was able to cheat CranePI MEI SCN bill acceptor due to old firmware present in the head of the bill acceptor device.
Please make sure your bill acceptor's application firmware is at least on version 5.30.
See attached picture describing how to find out what application version firmware is your bill acceptor on. Recyclers are not affected by this issue.
If you are not sure how to upgrade firmware of the bill acceptor remotely please contact our support department via email at support@generalbytes.com.
This security issue is important. It is not related to GB software however it can lead to significant financial loss if left unresolved.

Dear Operators.
Please note that mentioned the firmware upgrade is needed only for BILL ACCEPTORs not for RECYCLERs.
We are getting reports where operators bricked their RECYCLER heads by uploading BILL ACCEPTOR firmware into them.
DO NOT upload bill acceptor firmwares into recycler heads. As the only fix after this is to send them to CranePI service center.

Dear operators, please check the status of your invoices on your servers and on the cloud. Please note that if you have multiple unpaid invoices older than 60days you are in direct breach of licensing conditions and you might be operating machines illegaly. Lets be fair partners - we provide software updates plus making sure that solution is secure and you pay licensing fees.
Thank you

Version 20221118:
New Features:
Server/Terminal: Added support for OpenVPN client running on terminal.
Server/Terminal: Hardware configuration pinning.
Server/Terminal: Added support for HNL currency (Honduran lempira)
Improvements:
Terminal: Showing insufficient limit before insert money screen.
Terminal: Cryptocurrency icons should show up faster on the screen
Terminal: Remote BNR firmware update is now possible when terminal is connected via USB.
Terminal/Server: Terminal displays QR code that user can scan to initiate Veriff verification.
Server: Wallet sending is now asynchronous from exchange re-buy.
Server: Server now waits only 50 seconds for response from wallet.
Server: Identities, Skins and Terminal permission templates, Message Templates should now load faster in admin.
Server: Transactions have newly separate statuses for exchange and wallet.
Server: Skin palette elements fixed.
Bug Fixes:
Server: Removed marker character from thread name in master log.

⚠️Dear Customers,
We would like to warn you that some of our customers were contacted by fake GB tech support via Telegram asking them for SSH access to their CAS in order to fix 0-day security issue. Don't get yourself into trouble and don't fall for this scam technique.

Dear Customers,
We are currently migrating our phone line services to a new provider. You are not going to be able to reach us by phone.
Until the migration is finished please use our primary emails to reach us using the following emails: support@generalbytes.com or sales@generalbytes.com or using our support desk at https://generalbytes.atlassian.net/servicedesk/customer/portal/1
We are sorry for the temporary inconvenience.

Version 20230120:
New Features:
Server/Terminal: By terminal unrecognized QR codes containing wallet addresses are sent to server for second stage recognition processing.
Leads to improved readability of QR codes that do not follow standards.
This method is also used to collect QR codes that ATM doesn't recognizes, that may be used in future for software improvements.
Terminal: Added support for audio jack upgrade.
Server: Added automatic customer registration when customer is verified by external verification provider such as Veriff and ability to set required fields.
Improvements:
Server: Added possibility to enable rule to Output Queues that will require manual approval for transactions with Risk Score Classification Levels 8 and 9.
Server: Sprites, videos, skins and resource bundles pages rewritten to ReactJS.
Server: Address and phone blacklist pages are rewritten to ReactJS.
Server: Added address parsing for Veriff enterprise
Server: Added REST endpoint to see list of loaded extensions.
Server: Added links on terminal deployment page.
Server: Backup restore improvements
Server: Added option to optionally send information about sent transactions to Chainanalysis.
Server: Show deposit addresses for sell transactions in admin.
Server: Handle null properly when exporting NULL values to CSV.
Server: Increased number of possible withdrawal confirmations to 15.
Server: Added duplicate registration check when customer is registered automatically via Veriff/Onfido.
Server: Added possibility to enable url shortening via Twillio configuration parameters.
Server/Terminal: Added custom error message for blacklisted address
Terminal: No wallet screen contains App store and Google play icons.
Terminal: Welcome text on Welcome screen is auto-resizing to fit one line.
Terminal: Camera focus settings removed from terminal administration as they are no longer used.
Terminal: Improved fingerprint reader initialization.
Terminal: Use selfie camera when main camera is disconnected.
Terminal: Refactored code that works with locales.
Terminal: Updated Croatian translations.
Terminal: TRANSACTION ATTEMPTS REACHED notification text changed.
Bug Fixes:
Terminal: Fixed possible fingerprint detection crashes.
Terminal: Show error toast in terminal admin screen when there is issue with cash device
Server: Submitting cash collection note should not perform redirect

Dear operators,
Tonight we received number of reports from GB operators that their block.io wallets have been deplated by third party.
As a preliminary caution we decided to shutdown our cloud service until the issue is properly investigated.
The issue was reported by operators that use their own servers behind firewall.

Dear Operators,
We are investigating numerous attacks on CAS servers that resulted in loss of crypto funds.
We are sorry but, as a matter of precaution we recommend you to shutdown your admin and master service.
Our cloud service was unfortunatelly breached and therefore it needs to be shut down until we finish the investigation.
The attackers tried to clean the traces by empting the admin.log and master.log evaluate your logs and if you miss data for some period then your server may have been breached.
Meanwhile please invalidate your API keys to your wallets and exchnages as they may have leaked from your server.
We will be providing more details in 2 hours.