• Not surprised by the Wells Fargo ATM outage based on what I see

    17 Feb 2011

    Here’s an interesting story about the widespread Wells Fargo ATM outage that occurred last week. There’s speculation around the cause of the outage. Was it a hack? Was the system inadvertently taken down during system upgrades? Who knows…

    What I can say is that virtually every ATM I’ve come across in my work performing internal security assessments in/around the financial industry has been riddled with security holes. I’ve seen weak OS passwords, missing patches dating back 8+ years (many of which are easily exploitable via Metasploit to boot) open network shares and so on. Not long ago, I came across an ATM controller system (the big system typically running UNIX that controls all the ATMs across the bank) that had a blank password for the root account. How’s that for accountability?

    Seeing what’s going on with ATMs it’s no surprise to me that this Wells Fargo outage occurred. I’m not saying a vulnerability was exploited in this situation, but you never know. I am surprised these types of outages don’t occur more often. When these types of security holes are present in ATMs, all it takes is a rogue insider with a little bit of technical sense to take everything offline, and more.

    Remember if it’s got an IP address, anything’s fair game.

Resources

view all

Client Testimonials

“A business associate referred our company to Principle Logic when we were seeking a resource to perform vulnerability /penetration testing for our external and internal networks. We found Kevin Beaver to be professional, well informed, and easy to work with. His testing did not disrupt our networks, and his progress updates were timely.

His final report was very thorough and included security recommendations for our network environment. The executive leadership was so impressed with Kevin’s security expertise, they have extended their agreement to continue to perform periodic testing. We highly recommend Kevin Beaver and Principle Logic as a resource for network security testing.”

(IT managed services firm)
Read More

 

I’ve written/co-written 12 books on information security including:

 

Tags

application security appsec basics books careers censorship CISO CISSP cities compliance coronavirus covid-19 cybersecurity data breaches hacking Hacking For Dummies heads in sand health incident response information risk keynote speaker leadership macOS networked cameras passwords patching racing resilience Russian hacking SDLC security culture security leadership security program management security speaker selling security social engineering speaking engagements spec miata sql injection tiktok time management training vulnerability and penetration testing web security

© Copyright 2001-present, Principle Logic, LLC - All Rights Reserved.

For your convenience I accept