Text 29871, 117 rader
Skriven 2015-12-29 09:04:05 av David Drummond (3:640/305)
  Kommentar till text 29864 av mark lewis (1:3634/12.73)
Ärende: Rules of Echomail
=========================
On 29/12/2015 6:10 AM, mark lewis -> David Drummond wrote:
 DD>>>> AFAIK RFID does NOT work at ATMs - at least any of the ones I've
 DD>>>> used.

 ml>>> i didn't say it did... read what's in front of you, eh?! i said that
 ml>>> they move the money to certain accounts and then clean them out via
 ml>>> ATMs... i never said anything about the money taken via RFID reaping
 ml>>> was placed /directly/ into an account serviced by ATMs...

 DD>> Read what is in front of you.

 DD>> RFID terminals are in no way attached to ATMs - The RFID data doesn't
 DD>> contain the PIN (required for ATM transactions).

 ml> i never said they were or could be... fucking read!

 ml>>> RFID reap -> fake or hacked retail account -> another account -> etc
 ->>>> ATM serviced account

 DD>> Yeah, yeah. Watch out for the flying pigs while doing that.

 ml> yes, how else do you think the money gets from your account to the
 ml> retailers?


 ml> 1. the card is read.
 ml> 2. the transaction is authorized.
 ml> 3. the money transferred from your account into the retailer's account.

 ml> 4. at this point, if the retailer is hacked or not ligitimate, the money
 ml> may be moved to other accounts which may be accessed via ATM... likely
 ml> it will be shuffled between several accounts before being harvested...

Your proposition bares the same veracity as the idea of routed echomail. We do
not live in your your little hypothetical world of proof of concept attacks.

 DD>>>> Have you seen these USB connections?

 ml>>> yes...

 DD>> You are unique in the world.

 ml> no i'm not... they are easily seen in pictures as well as in the rooms
 ml> where the equipment is housed... i've seen both while following up on
 ml> research...

Must use different terminals in your area to what they do here.

 DD>>>> As yet there is no reported evidence of this happening, in this
 DD>>>> country at least.

 ml>>> you depend on the news for too much... everyone already knows that the
 ml>>> news is jaded one way or the other and only report maybe half of what
 ml>>> they are aware of...

 DD>> If it is happening, someone is aware of it.

 ml> yup, at least the crooks... others may not even be aware of it yet...

Not the banks, nor the pepole losing the money from their accounts?

 ml> that's like the thing that was done many years back where someone would
 ml> get some sort of small cheap item sent to them and their CC charged up
 ml> to $20 for it... rarely did anyone ever bother to dispute it because the
 ml> charge amount was so small...

I suspect if someone made multiple $100.00 hits on my account I would notice.
YMMV

[...]

 ml>>> i'm not a conspiracy theorist... your hypothetical is someone else's
 ml>>> reality...

 DD>> But not mine.

 ml> then you will be the one to suffer when it does hit you in the back of
 ml> the head...

Along with those routed echomail messages?

 DD>>>> BTW - My role at work doesn't involve financial transactions, just
 DD>>>> personal data.

 ml>>> i said security... it doesn't matter if it is financial or personal
 ml>>> or corporate data... isn't that data on those RFID card personal
 ml>>> data?

 DD>> I am of the opinion it is just a few numbers. Nothing about me
 DD>> personally at all.

 ml> it isn't about you at all... it is all about getting $$$ from you and
 ml> moving on fast enough that they aren't caught...

Or noticed?

 ml>>> are you sure that your network is not being used to shuttle stolen
 ml>>> data out onto the internet highway on to its next destination?

 DD>> That network has no direct contact with the outside world.

 DD>> All data must go through authenticating proxies.

 ml> they're no trouble to tunnel data out of with the necessary
 ml> credentials... many networks have found that out the hard way... once
 ml> authenticated, traffic is allowed to flow... one can easily encrypt a
 ml> VPN through an https tunnel and there goes your safeguards...

I "might" be able - our users are not. This is NOT a public network.

-- 

regards
David

--- Mozilla/5.0 (Windows NT 6.3; rv:31.0) Gecko/20100101 Thunderbird/31.7.0
 * Origin: Cleveland, Qld, Australia (3:640/305)