Comment on In search of riches, hackers plant 4G-enabled Raspberry Pi in bank network

ObsidianZed@lemmy.world ⁨8⁩ ⁨months⁩ ago

• cyberpunk007@lemmy.ca ⁨8⁩ ⁨months⁩ ago

  Yup, this is the way. Pretty crazy a bank doesn’t have proper security lol

  source
• pupbiru@aussie.zone ⁨8⁩ ⁨months⁩ ago

  i’d have said that’s less important than TLS or something on your ATM, a VLAN for ATMs that can only access specific services, and all ports not on a VLAN just disabled

  really you just want to stop traffic from being sniffed (stolen credentials) and spoofed (“correct - dispense $10000”)… beyond that, you just have to assume nothing. the services that an ATM connects to should be robust enough that they do all the validation - the ATM is pretty dumb (kinda in the same way as your browser on your computer: it gets no decision making to access your bank; just is input and output)

  MAC addresses are easy to spoof, and physical security is pretty difficult on something like an ATM that’s publicly accessible

  source

  • Saleh@feddit.org ⁨8⁩ ⁨months⁩ ago

    Ahh, i remember how my older brother locked down my internet access after midnight on behalf of my parents, boasting about having set up a MAC-address whitelist in the router some 15 years ago.

    About a week later or so he proceeded to play Battlefield 3 on his early Samsung smartphone all night during summer holidays.

    source
• halcyoncmdr@lemmy.world ⁨8⁩ ⁨months⁩ ago

  Also our bank had some kind of port security so if it wasn’t a recognized MAC address, the port just switched off.

  And serious company will have this as basic security. It’s a fundamental function even available on your consumer grade router at home. While it’s overkill for that use, it’s basic security for a company.

  source

  • jubilationtcornpone@sh.itjust.works ⁨8⁩ ⁨months⁩ ago

    That’s why it’s not surprising at all that a bank didn’t bother to do that. Banks have some of the most egregious security issues.

    And really shitty auditors apparently. A good one would have at least spot checked for unsecured ports.

    source
  • Vinstaal0@feddit.nl ⁨8⁩ ⁨months⁩ ago

    You would be surprised how many companies don’t even have something fundamental like a custom SSID and password, or a backup, etc.

    source

    • halcyoncmdr@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Oh I wouldn’t be surprised at all, most businesses are pretty small. I would be surprised if a Bank was that irresponsible, although not very surprised.

      source
  • pupbiru@aussie.zone ⁨8⁩ ⁨months⁩ ago

    i’d argue that any serious company wouldn’t really bother with MAC identification… they’re so easy to spoof that it adds to operational overhead far more than the benefit it brings

    more likely with these things you’d have a VLAN mapped to a physical port, and if that port were disconnected you’d instantly get a notification and send someone to check it out

    source

    • halcyoncmdr@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Spoofing a MAC is easy but it still requires knowing both what an existing valid address is, and ensuring that it’s not already connected to the network. It’s only operational overhead when a new device is onboarded, after that the impact is minimal.

      A policy that requires sending a tech is fine, but if you have hundreds or thousands of individual locations then you aren’t going to have a tech onsite at every one of them to quickly check and fix an issue, and you don’t really want to have to trust an end user to verify and/or make physical changes on site if you can avoid it.

      source

      • lazynooblet@lazysoci.al ⁨8⁩ ⁨months⁩ ago

        This is still trivial. A Pi with 2 NICs and a Linux bridge. Using the 2 ports, effectively put the Pi in between the device you want to spoof and the rest of the network. Now you can see the traffic, the MAC addresses etc.

        source

        • -> View More Comments
      • Zorsith@lemmy.blahaj.zone ⁨8⁩ ⁨months⁩ ago

        Don’t really need to send a tech immediately. More efficient to get a gas station clerk (or whoever works where the ATM may be located) to verify nobody is trying to fuck with it on-site and they didn’t lose power/internet at their location, before escalation.

        source
  • AreaKode@lemmy.world ⁨8⁩ ⁨months⁩ ago

    … Which financial company do you work for?

    A major one.

    source

    • TheRagingGeek@lemmy.world ⁨8⁩ ⁨months⁩ ago

      Any of the major banks consider breaches as cost of doing business at their scale compared to smaller banks. My bank prides itself on never having a breach, and it is insufferable to develop code for, but I guess it’s the price of security

      source
    • TropicalDingdong@lemmy.world ⁨8⁩ ⁨months⁩ ago

      That’s why it’s not surprising at all that a bank didn’t bother to do that. Banks have some of the most egregious security issues.

      Image

      source

      • FauxLiving@lemmy.world ⁨8⁩ ⁨months⁩ ago

        Same as anywhere else. Complacency, lax auditing, temporary fixes which are in place for years, non-technical people making technical decisions (choosing convenience over security, generally).

        source
      • Lost_My_Mind@lemmy.world ⁨8⁩ ⁨months⁩ ago

        Remember when John Stewart only had SOME grey hair?

        Hey, no judgement. 2020 had my hair looking like santa claus.

        source

        • -> View More Comments