: Criminals used undocumented techniques and well-placed insiders to remotely withdraw money
    • FauxLiving@lemmy.worldEnglish
      221·
      28 days ago

      The criminals, or the people they paid to carry out the physical attack, connected a Raspberry Pi to a bank’s network switch, the same one hooked up to the ATM that was subsequently raided.

      They’re kind of skipping over an important detail here.

      Sure the technical details are interesting, but it’s a bit like discussing the alloys of the tumblers of the safe deposit box after the team has unexplainably bypassed the main safe door…

      • SoftestSapphic@lemmy.worldEnglish
        14·
        28 days ago

        Yeah that implies physical access.

        Like it takes a ceritain security level to even get into rooms that have those switches.

        It was probably some IT worker.

        Hope they never get caught lol

  • Optional@lemmy.worldEnglish
    271·
    28 days ago

    The backdoor, for example, appeared to be the LightDM display manager often used by Linux systems, demonstrating the group’s skillset, which the researchers said spanned Linux, Unix, and Oracle Solaris environments.

    The backdoor was the display manager. Well goddamn.

  • 𝕸𝖔𝖘𝖘@infosec.pubEnglish
    261·
    28 days ago

    UNC2891 also used Linux bind mounts to hide its backdoor processes, which, at the time, had not been documented in public threat reports, Group-IB said.

    The technique is now recognized by MITRE’s ATT&CK framework as T1564.013.

    Holy crap. They discovered, and successfully implemented a novel technique. That’s impressive af

  • Pika@sh.itjust.worksEnglish
    9·
    28 days ago

    honestly, pretty poor security here. I can’t say much cause I don’t have inter-device restrictions either… but I’m also not a bank that handles money.

    There’s no reason a random device should have been able to interface with any of the other devices tbh, I’m guessing the switch wasn’t smart so didn’t support Mac filtering or port disabling cause that should have not been a valid attack vector.