Re: [Full-disclosure] Bank of the West security contact?

[Stefan Weimar <stefan () meinhop3 de>]

Hi,

Am 02. April schrieb Sholes, Joshua:
> And how fast would those ATM manufacturers switch to a Linux or other
> offering if, say, Bank of America said "We won't buy an ATM with an easily
> skimmable reader or with an insecure OS on it?"

I agree. But it's not _one_ bank that has to say, it's more of them.
Because they would have to pay more for the "secure" ATM (development,
testing anyone?) and they have to wait a bit. That's completely doable. 

But: In the end it's the bank's customer who has to pay for it. And if
BoA charges him higher interest rates on his loan, what's he gonna do?

He just wants a simple device (like in: card in -> money out) and he
simply doesn't care about the OS. 

> Diebold, for example, has a market cap of less than $3B.  BoA is sitting
> around $182B.  With that much leverage, the big banks have NO excuse to
> just accept whatever crap the vendors shovel out the door.

Again, I fully agree. But as long as the customer doesn't care (he gets
his money back in case of fraud, right?) the banks won't care, too.

We won't see banks turn until the financial damages grow beyond the
costs for security. Like anywhere else in IT-security.

Yours sincerely
Stefan
-- 
make -it ./work

GnuPG-Key: 742ADF27 <stefan () meinhop3 de>
Fingerprint: 037F 17FC CF4B C1E0 598D  97B1 C2CE 7963 742A DF27

Attachment: signature.asc
Description: Digital signature

_______________________________________________
Sent through the Full Disclosure mailing list
http://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/