Russian security start-up kits up 30,000 state bank ATMs, terminals Cash machine crime has created a new market for start-up Russian security firm SafenSoft. The firm has persuaded fberbank, the former Soviet-era state bank, to roll out SafenSoft's TPSecure ATM software to 30,000 cash machines and point of sales terminals across Russia. The technology is designed to preserve system integrity …
> Russian security firm SafenSoft .. technology is designed to preserve system integrity on unattended devices through a mixture of white-listing, behavioural analysis and privilege control techniques ..
None of these techniques will work against unknown risks. How about running the software from a read-only device and obfuscating the code so each device is unique.
As long as you're confident that your base build is secure and hasn't been compromised then you don't really care about "unknown risks" because newly introduced rogue software won't be on the whitelist, and someone modifying existing code results in the hash changing and therefore no longer being on the whitelist.
The whitelisting approach works well for things such as ATMs, epos devices, kiosks, etc... because they are generally very static environments that don't require many changes to them once they're built.
It doesn't work so well for "fluid" environments, such as workstations, because they're changing too often so it makes management of the whitelist time consuming and resource intensive. When you try to use whitelisting applications on workstations you end up having to reduce your level of security to make the environments usable, e.g. by using "trusted vendors" whereby anything signed by a particular vendor is allowed and automatically added to the whitelist.
By the way, none of this is particularly new... companies such as McAfee (since they acquired SolidCore), Bit9, Lumension, etc... all offer the exact same thing.
This is a bit of a canard: Banks go to great lengths in blaming the customer for mishaps by insisting their systems are "secure", though proof for that claim usually doesn't even exist. Not the other way around. They care about (not having to restitute) money, not about their systems. That's just the cost of business, you know. Don't you go and claim otherwise -- as you did in the article.
Also note the doublespeak: Instead of private networks they've put ATMs on the public internet, and tout putting windows on such publicly connected things as a great leap forward. I don't want to know what they were running before, then. (Actually, also windows, and a sprinkling of OS2. That would've been likely more secure, even if through obscurity so not much. Such installations are heavily locked down --as well as you can lock down windows, anyway-- but often also (possibly contractually) locked out of patching and upgrading, like anything embedded and scada tends to be.) It's good news for add-on security vendors provided they can work with the original vendors to get their stuff certified, but as add-on security isn't something that actually can work very well and therefore predictably doesn't, it's also great for malfeasants. It isn't so great for "the customer", but they'll be given the runaround anyway and don't have much choice left in any case.
Anybody willing to invest in creating ATMs that run a unix, say openbsd? I'd propose openvms or something still different if I thought it was viable; if you know of anything better, do let me know.
"Connecting ATMs to the internet allows banks to offer more services and other opportunities, "
Yeah opportunities for hackers, I can't believe banks would connect ATM to the Internet so they can be accessible remotely. Perhaps the machines setup the connections for the time that they want to transmit data to the bank then drop off line afterwards, hopefully by disabling the interface.
Having an ATM with a publicly accessible IP address that is always on is taking a very risky strategy. It like saying our security is stronger than your hacking skills, it's would be an open invitation for hackers.
... this may very well actually mean that they've moved from, I don't know, frame relay or X.25 circuits or what-have-you, to "Internet technology", ie TCP/IP and hopefully still private networks, possibly using rfc1819 space, but equally possibly using a publicly allocated block that isn't connected to anything else. Ha ha. Everything is connected to everything else these days. Even things that say DO NOT CONNECT TO ANYTHING ELSE, EVER, right there in the manual. Nevermind me.
-Without constant attention they become less transparent with lots of crap getting in the way
-It's very easy for someone to unintentionally leave them open
-it isn't difficult to break them, and the mess resulting is hell to deal with
-it requires extra products (available seperately, usually from separate vendors) to make them (vaguely) secure
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
