Version 20230120:
New Features:
Server/Terminal: By terminal unrecognized QR codes containing wallet addresses are sent to server for second stage recognition processing.
Leads to improved readability of QR codes that do not follow standards.
This method is also used to collect QR codes that ATM doesn't recognizes, that may be used in future for software improvements.
Terminal: Added support for audio jack upgrade.
Server: Added automatic customer registration when customer is verified by external verification provider such as Veriff and ability to set required fields.
Improvements:
Server: Added possibility to enable rule to Output Queues that will require manual approval for transactions with Risk Score Classification Levels 8 and 9.
Server: Sprites, videos, skins and resource bundles pages rewritten to ReactJS.
Server: Address and phone blacklist pages are rewritten to ReactJS.
Server: Added address parsing for Veriff enterprise
Server: Added REST endpoint to see list of loaded extensions.
Server: Added links on terminal deployment page.
Server: Backup restore improvements
Server: Added option to optionally send information about sent transactions to Chainanalysis.
Server: Show deposit addresses for sell transactions in admin.
Server: Handle null properly when exporting NULL values to CSV.
Server: Increased number of possible withdrawal confirmations to 15.
Server: Added duplicate registration check when customer is registered automatically via Veriff/Onfido.
Server: Added possibility to enable url shortening via Twillio configuration parameters.
Server/Terminal: Added custom error message for blacklisted address
Terminal: No wallet screen contains App store and Google play icons.
Terminal: Welcome text on Welcome screen is auto-resizing to fit one line.
Terminal: Camera focus settings removed from terminal administration as they are no longer used.
Terminal: Improved fingerprint reader initialization.
Terminal: Use selfie camera when main camera is disconnected.
Terminal: Refactored code that works with locales.
Terminal: Updated Croatian translations.
Terminal: TRANSACTION ATTEMPTS REACHED notification text changed.
Bug Fixes:
Terminal: Fixed possible fingerprint detection crashes.
Terminal: Show error toast in terminal admin screen when there is issue with cash device
Server: Submitting cash collection note should not perform redirect

Dear operators,
Tonight we received number of reports from GB operators that their block.io wallets have been deplated by third party.
As a preliminary caution we decided to shutdown our cloud service until the issue is properly investigated.
The issue was reported by operators that use their own servers behind firewall.

Dear Operators,
We are investigating numerous attacks on CAS servers that resulted in loss of crypto funds.
We are sorry but, as a matter of precaution we recommend you to shutdown your admin and master service.
Our cloud service was unfortunatelly breached and therefore it needs to be shut down until we finish the investigation.
The attackers tried to clean the traces by empting the admin.log and master.log evaluate your logs and if you miss data for some period then your server may have been breached.
Meanwhile please invalidate your API keys to your wallets and exchnages as they may have leaked from your server.
We will be providing more details in 2 hours.

Dear Operators,
We ask you to keep your master and admin services off until we provide you with a new software release that patches exploited vulnerability.
Here is the document describing security incident: https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2885222430/Security+Incident+March+17-18th+2023

New server patch releases 20221118.48 and 20230120.44 fixing the vulnerability have been released.
Please note that even after upgrading to this version do not have ports 7741 or 7777 exposed to internet.
Keep them behind the VPN.
Make sure you read our security incident report.
If you know some operator that is operating GB ATM software please let them know about the issue.
Most of the breaches happen even after the fix is available.
We will be sending out information on social media and emails however not everybody reads those.

GB just released a new patch that addresses many of the VPN issues that some of you faced during the CAS server installation, as well as minimizing sensitive information storage in the database.
We are working hard to help you transition to your own infrastructure - secured behind a VPN. Documentation updates and new patches will continue to be released in upcoming days.
More info on new patch releases is located here: generalbytes.com/patch
It is recommended to upgrade these patches.
We additionally encourage larger operators to conduct an independent security review of our software into their security polices.
We are ready to address any findings that such a review produces.

Operators that need IT help with installing and securing their own new standalone CAS servers behind VPN might find this interesting:

Exaio Systems Consultants ( https://exaio.com ) contacted General Bytes after the incident offering their help to other operators as they have been providing these services in past to one of the operators in the USA. Feel free to contact them via their website.


Please note that Exaio is not in any way affiliated with General Bytes.

Dear Operators,
We have registered cases when ATM operators restored backups on their new server together with malware from the old server. Please see the new section “Moving data from old server” in our incident report.

We also released new patch releases 20230120.46 and 20221118.50 that contain more VPN fixes, improvements and simplifies creation of user VPNs to access CAS using batm-manage command. It is highly recommended to upgrade to this version.

And lastly we encourage operators that are still running 20221118 to upgrade to 20230120 as we plan next week to stop providing patch releases to 20221118.

Please do not operate your servers on the public internet. Please operate them only when moved behind VPN.

New patch releases 20221118.52 and 20230120.48 have been released.

Dear Operators,

We put together an article in our KB that focuses on the security aspect of operating a Bitcoin ATM business.

Please make sure you read it.
GENERAL BYTES team

https://generalbytes.atlassian.net/wiki/spaces/ESD/pages/2893283329/Best+Practices+Security

Dear Operators,
Please notice the availability of a new patch release 20230120.55 that addresses security improvements as well as stability of client VPN connections.
We encourage you to upgrade to this version. Please note that version 20221118 has already reached its EOL and is no longer receiving any patches.
Staying on version 20221118 version represents high security risk for your business.

This weekend one of the operators suffered ETH loss because he didn’t revoke the old API keys to his Infura wallet as was recommended in one of the steps of our Incident report. We encourage you to go over the incident report again and double check that you performed all of the steps even if you think you were not affected by the March 17th incident.

Version 20230228:
Improvements:
Terminal: Show REDEEM TICKET button when withdrawal by phone is disabled.
Terminal: Updated Bulgarian translation
Terminal: Updated Spanish translation
Terminal: Added ability to receive OTP via voice when withdrawal by phone is enabled.
Extensions: Identity verification providers are now part of opensource Extensions.
Extensions: Improved Exceptions logging coming from Extensions.
Extensions: Added getIdentityRemainingLimits to Extensions API
Extensions: Added identityCreated to Extensions API.
Extensions: Identity custom fields are now accessible from Extensions API.
Server: When setting up 2FA allow user initial setup key to be backed in keypass manager.
Server: Don't show SHOW SSN button on Identity page when there is no SSN set.
Server: Added support for setting standard balance on dispenser cassettes.
Server: Responsive sizes added to search input in ReactJS
Server: Removed DASH support in Coinmate exchange implementation
Server: Improved transaction scoring logging in master.log
Server: Surveillance photos page rewritten to ReactJS.
Server: Terminal events page rewritten to ReactJS.
Server: Terminal location page rewritten to ReactJS.
Server: Terminal template page rewritten to ReactJS.
Server: Terminal detail page rewritten to ReactJS.
Server: Terminal cash page rewritten to ReactJS.
Server: Terminal cash collection page rewritten to ReactJS.
Server: Cashbox analytics rewritten to ReactJS.
Server: Terminal incidents page rewritten to ReactJS.
Server: Banknote history page rewritten to ReactJS.
Bug Fixes:
Server: Fixed Notification Rule "Customer Enrolled" grammar
Server: Removed unnecessary logging in hasUserPermissionToObject
Terminal: Fixed memory leak caused by Adjustable Duration Toast.

Hi there! In case you are in Miami at Bitcoin Conference, you are very welcome at the booth # 740. 💫

Our team would love to chat with you and show the most advanced Bitcoin ATMs — compact 2-Way BATMTwoUltra, BATMFour with a card reader (NEW!) and the Universal Kiosk II powered by our GMkit 😎

Version 20230515:
New Features:
Server: admin and master services now run under different unix users.
Server: Directory structure of BATM server application was changed.
Server: Directory structure's unix permissions are changed.

Dear Customers,
In the upcoming hour we will start sending you invite links to our new GB partner website.
Invite links will be sent by email and become accessible later (within 24 hours).
An invite link lets you set your new password. The GB partner website username is the same as you had on our cloud website.

Version 20230601:
New Features:
Terminal: Updated Hebrew language support.
Server/Terminal: Added marketing Opt-In SMS/Phone Number option.
Server/Terminal: Added custom string for Fixed fee text on insert money screen
Server/Terminal: Online terminals send information to server what version is is present in restore point or if any
Server/Terminal: Minimum age requirement in AML KYC settings
Improvements:
Server: Trigger new notification for Cashbox Not Armed
Server: Server dump stats now contain number of active terminals
Server: Server dump stats now contain total number of bytes transferred trough TCP port
Server: Server dump stats now contain bytes transferred by other servlets
Server: Server produces Terminal Event and Notification when transaction is not approved by extension
Server: Customer is asked about enabling telemetry during the installation of new server.
Server: Fast track installation rewritten to ReactJS
Server: Transaction analytics rewritten to ReactJS
Server: Server monitoring is now ready for ReactJS
Server: Third party access is now ready for ReactJS
Server: Server dump is ready to be started from ReactJS
Server: Terminal transactions page rewritten to ReactJS.
Server: Behavioral analytics page rewritten to ReactJS.
Server: Cashbox analytics page rewritten to ReactJS.
Server: Output queues page rewritten to ReactJS.
Server: Third party access - WhaleBooks, Morphis and OSW rewritten to ReactJS.
Terminal: Added obfuscating of private key scanned events in log
Terminal: Terminal shows DNS resolve error when is unable to resolve server hostname
Bug Fixes:
Terminal: Deserialization fixes.
Terminal: Terminal crashing in loop when wlan0 interface is not found.
Terminal: Fixed printing loop in Cash collection mode 1.
Terminal: Printer prints black page randomly when you clicked multiple times on button "print cash cashboxes"
Terminal: Unify different behavior on different Collect Phone screens
Server: CASHBACK does not work with Withdraw mode = Withdraw using phone number

Dear Customers,
Please note that version 20230228 and older reached End Of Life and are no longer supported.

Version 20230701:
New Features:
Server/Terminal: Add support for Jamaican Dollar
Server/Terminal: Added Albanian Language translation
Server/Terminal: Added new notifications for acceptor not detected and acceptor disconnected.
Server/Terminal: Added mode for dispensing from BNR loader cassettes only.
Server: Added buy and sell USDT-TRON support via BitGo
Improvements:
Server: Added Italy provinces in Admin.
Server: Added column "province" to identity XML export file and to identity CSV export file
Server: Added Terminal Status Filter for All Errors
Server: Add location public id to list of terminal transactions export on Terminal
Server: Export all locations to CSV and including public ids on "locations" page
Server: Adding location ID and respective hyperlinks to "Location Terminal Deployments" page
Server/Extensions: Added findIdentityBase methods.
Server: Billing UI rewritten to ReactJS.
Server: Server search rewritten to ReactJS.
Server: Terminal uptime analytics rewritten to ReactJS.
Server: Add suspend & unsuspend action to GDPR audit log
Server: Batm install script should create batm user without home and shell
Server: batm-manage send payment has mining fee optional parameter
Server: Modification of "CashLowNotification" so that it lists the amount in individual dispensers
Terminal: Don't log scanned private keys also for other altcoins.
Terminal: Cash dispenser's enhanced error logging in the event log.
Terminal: Added Touchscreen test to diagnostics test on terminal
Bug Fixes:
Server: Circle references in database removed.
Server: Names of video files uploaded on server are now preserved.
Server: Fixed Bitbuy.ca API support

Dear Customers,

🧙‍♂We are excited to offer you exclusive summer discounts. 💸

First, till the end of the current BATMThree stock, you will pay 10% less for each ATM ordered in any configuration. This means you will save between $690 and $1,222 per ATM!

Second, we propose the same 10% discount on BATMTwoPro with printer. With only 50 pieces left in stock, you can save $330 per piece!

Don't miss out on these limited-time offers!

👉 Find out more here. 👈