ExcessShiv comments on Cybercrooks use Raspberry Pi to steal ATM cash

Technology

89,627 readers

13,807 active

2,300 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 3 years ago

moderators

[–] ExcessShiv@lemmy.dbzer0.com 9 points 1 year ago (2 children)

I just work a pretty standard engineering job at a large company (basically regular office work, not a critical industry like power or pharma), and any MAC that isn't approved by IT is simply not a allowed to interface with anything whatsoever. It's insane that a bank has this loose IT security.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Pika@sh.itjust.works 3 points 1 year ago (1 child)

, Agreed. Like, I'm not surprised that it was allowed to interface with the ATM because at that layer, I think the jump would have been from the switch to the ATM(although the ATM should habe not accepted the connection imo). So it would have never gone through any security. But it blows my mind that it was allowed to access a mail server as part of the routing, And even more so that it was allowed to go from that mail server to the outside world to establish a second route into the establishment. Like, how did it never hit any type of security or blocker anywhere in that process?

permalink

fedilink

source

parent

hideshow 1 child comment

[–] ExcessShiv@lemmy.dbzer0.com 3 points 1 year ago*

Even at that layer it should require site specific knowledge to gain access to the network, knowledge like specific IP ranges, netmask and VLAN, that they really shouldn't have. This bank managed to mess up literally every single step of the IT security chain, it's almost impressive.

permalink

fedilink

source

parent