lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 2 Apr 2014 23:28:46 +0200
From: raccoon <raccoon+fd@...post.org>
To: fulldisclosure@...lists.org
Subject: Re: [FD] Bank of the West security contact?

On Wed, Apr 02, 2014 at 08:30:25PM +0000, Sholes, Joshua wrote:
>> On 4/2/14, 4:01 PM, "Stefan Weimar" <stefan@...nhop3.de> wrote:
>> >Hi,
>> >
>> >Am 02. April schrieb raccoon:
>> >
>> >> This goes for all banks and is probably one of the reasons most ATMs
>> >> still run windows and are skimmable time after time by the simplest
>> >> exploits. 
>> >
>> >When you -- as a bank -- buy an ATM you get a preinstalled device with
>> >an underlying OS (Windows mostly) and a software stack consisting of
>> >drivers for the card reader, dispenser, keyboard an so on. On top of
>> >that you install your own application so the ATM will work with the
>> >software running in your datacenter.
>
> And how fast would those ATM manufacturers switch to a Linux or other
> offering if, say, Bank of America said "We won't buy an ATM with an easily
> skimmable reader or with an insecure OS on it?"
> 
> Diebold, for example, has a market cap of less than $3B.  BoA is sitting
> around $182B.  With that much leverage, the big banks have NO excuse to
> just accept whatever crap the vendors shovel out the door.

Exactly. 

>> [snip]
>> >That's not quite right. The manufacturer of the ATM chooses the OS.

Stefan, you're actually suggesting the ATM market dictate banking
security policy (and the budget for it)?

The banks are the ones ordering the machines they see fit for their
chosen model of security, and are coincidentally the same bunch of
critters actually defining those models. Which, in regards to for
example PCI-DSS is something the ATM manufacturers has to comply with,
as far as i know. 

Correct me if I'm wrong about that ecosystem.

-- r

mail    raccoon at fripost.org
xmpp            && jabber.ccc.de
gpg             && 0x9AEE89FD

Download attachment "signature.asc" of type "application/pgp-signature" (231 bytes)


_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

Powered by blists - more mailing lists