Cybercrooks use Raspberry Pi to steal ATM cash
https://www.theregister.com/2025/08/01/cybercrooks_bribed_lackeys_in_physical/Open linkView original on lemmy.worldSyndicated from the fediverse. Read and engage on the original instance.
View original on lemmy.worldhttps://www.theregister.com/2025/08/01/cybercrooks_bribed_lackeys_in_physical/Open linkView original on lemmy.world
21 replies
They hooked a raspberry pi up to the network switch. At this point i think they fucked up security pretty bad
They're kind of skipping over an important detail here.
Sure the technical details are interesting, but it's a bit like discussing the alloys of the tumblers of the safe deposit box after the team has unexplainably bypassed the main safe door...
Yeah that implies physical access.
Like it takes a ceritain security level to even get into rooms that have those switches.
It was probably some IT worker.
Hope they never get caught lol
Still, you shouldn't be able to get money from having network access. Secure connections are a solved problem.
I fuckin love these dumbass names they give to hackers.
I love how the name "hacker" was successfully vilified by associating it with criminals, something we already had a word for.
https://www.urbandictionary.com/define.php?term=Hacker
"The media's definition of the real term malicious cracker. A hacker used to be a well respected individual who loved to tinker with gadgets.", plus a few other definitions.
They needed a lot of physical interactions to pull off this cybercaper.
The backdoor was the display manager. Well goddamn.
I saw cybercrooks and had to take the opportunity
Holy crap. They discovered, and successfully implemented a novel technique. That's impressive af
I'm surprised the article went into so much detail as to how they pulled it off.
It's the Register, it is targeted to people familiar with technology.
Nice
honestly, pretty poor security here. I can't say much cause I don't have inter-device restrictions either... but I'm also not a bank that handles money.
There's no reason a random device should have been able to interface with any of the other devices tbh, I'm guessing the switch wasn't smart so didn't support Mac filtering or port disabling cause that should have not been a valid attack vector.
I just work a pretty standard engineering job at a large company (basically regular office work, not a critical industry like power or pharma), and any MAC that isn't approved by IT is simply not a allowed to interface with anything whatsoever. It's insane that a bank has this loose IT security.
, Agreed. Like, I'm not surprised that it was allowed to interface with the ATM because at that layer, I think the jump would have been from the switch to the ATM(although the ATM should habe not accepted the connection imo). So it would have never gone through any security. But it blows my mind that it was allowed to access a mail server as part of the routing, And even more so that it was allowed to go from that mail server to the outside world to establish a second route into the establishment. Like, how did it never hit any type of security or blocker anywhere in that process?
Even at that layer it should require site specific knowledge to gain access to the network, knowledge like specific IP ranges, netmask and VLAN, that they really shouldn't have. This bank managed to mess up literally every single step of the IT security chain, it's almost impressive.
Were they going to the Galleria to play Missile Command?
"Easy money..."
Watch them try to ban raspberry pi now ... like they did with the flipper
Lol another reason why adafruit sucks