Text 29880, 125 rader
Skriven 2015-12-28 20:23:02 av mark lewis (1:3634/12.73)
  Kommentar till text 29871 av David Drummond (3:640/305)
Ärende: Rules of Echomail
=========================
29 Dec 15 09:04, you wrote to me:

 ml>> 1. the card is read.
 ml>> 2. the transaction is authorized.
 ml>> 3. the money transferred from your account into the retailer's
 ml>> account.

 ml>> 4. at this point, if the retailer is hacked or not ligitimate, the
 ml>> money may be moved to other accounts which may be accessed via ATM...
 ml>> likely it will be shuffled between several accounts before being
 ml>> harvested...

 DD> Your proposition bares the same veracity as the idea of routed
 DD> echomail. We do not live in your your little hypothetical world of
 DD> proof of concept attacks.

whatever... when you get taken like this, i'm just going to sit back and laugh
my ass off... no finger pointing or "i told you so"... just a huge long belly
laugh...

 DD>>>>> Have you seen these USB connections?

 ml>>>> yes...

 DD>>> You are unique in the world.

 ml>> no i'm not... they are easily seen in pictures as well as in the
 ml>> rooms where the equipment is housed... i've seen both while following
 ml>> up on research...

 DD> Must use different terminals in your area to what they do here.

terminals? they're regular computers! they used to run OS/2 but these days they
run winwhatever...

here's a few articles of interest...

http://krebsonsecurity.com/2015/01/thieves-jackpot-atms-with-black-box-attack/

http://www.theregister.co.uk/2015/01/07/atm_jackpotted_with_samsung_s4/

http://www.wired.com/2013/12/whos-robbing-atms-usb-stick/

http://securityaffairs.co/wordpress/23421/cyber-crime/rob-atms-couple-sms-messages.html


http://www.tomsguide.com/us/atm-hack-cardless,news-19701.html

http://www.wired.com/2014/11/nashville/

https://nakedsecurity.sophos.com/2014/06/11/14-year-olds-find-manual-online-hack-an-atm-during-their-school-lunch-hour/




 DD>>>>> As yet there is no reported evidence of this happening, in this
 DD>>>>> country at least.

 ml>>>> you depend on the news for too much... everyone already knows that
 ml>>>> the news is jaded one way or the other and only report maybe half
 ml>>>> of what they are aware of...

 DD>>> If it is happening, someone is aware of it.

 ml>> yup, at least the crooks... others may not even be aware of it yet...

 DD> Not the banks, nor the pepole losing the money from their accounts?

apparently not... according to you, they'd be crowing from the rooftops...

 ml>> that's like the thing that was done many years back where someone
 ml>> would get some sort of small cheap item sent to them and their CC
 ml>> charged up to $20 for it... rarely did anyone ever bother to dispute
 ml>> it because the charge amount was so small...

 DD> I suspect if someone made multiple $100.00 hits on my account I would
 DD> notice. YMMV

there's that reading comprehension problem again... where did i say $100 in the
above paragraph?

 DD>>>>> BTW - My role at work doesn't involve financial transactions, just
 DD>>>>> personal data.

 ml>>>> i said security... it doesn't matter if it is financial or personal
 ml>>>> or corporate data... isn't that data on those RFID card personal
 ml>>>> data?

 DD>>> I am of the opinion it is just a few numbers. Nothing about me
 DD>>> personally at all.

 ml>> it isn't about you at all... it is all about getting $$$ from you and
 ml>> moving on fast enough that they aren't caught...

 DD> Or noticed?

by the time you notice, they're already long gone...

 ml>>>> are you sure that your network is not being used to shuttle stolen
 ml>>>> data out onto the internet highway on to its next destination?

 DD>>> That network has no direct contact with the outside world.

 DD>>> All data must go through authenticating proxies.

 ml>> they're no trouble to tunnel data out of with the necessary
 ml>> credentials... many networks have found that out the hard way... once
 ml>> authenticated, traffic is allowed to flow... one can easily encrypt a
 ml>> VPN through an https tunnel and there goes your safeguards...

 DD> I "might" be able - our users are not. This is NOT a public network.

never put anything past your users... they are smarter than you think ;)

)\/(ark

"So let me ask you a question about this brave new world of yours. When you've
killed all the bad guys, and when it's all perfect, and just and fair, and when
you have finally got it exactly the way you want it, what are you going to do
with the people like you? The trouble makers. How are you going to protect your
glorious revolution from the next one?" - The twelfth Doctor

... Didn't I meet you in some other hallucination??
---
 * Origin:  (1:3634/12.73)