Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror
×
The Almighty Buck Operating Systems Software Windows Technology

Wells Fargo Web-Enables ATMs 576

smooth wombat writes "Wells Fargo has completed a five-year project to Web-enable its 6,200 ATMs in 23 states. Now the ATMS will be Windows based rather than OS/2 based. Avivah Litan, an analyst at Gartner Inc., in Stamford, Conn., said the move to Windows-based systems is "not great news for the security of the system. I'm sure there's a lot of holes that will be created because of this.""
This discussion has been archived. No new comments can be posted.

Wells Fargo Web-Enables ATMs

Comments Filter:
  • by Frogmum ( 778954 ) on Saturday March 05, 2005 @08:50PM (#11855944) Journal
    What was wrong with OS/2 atms?
    • by Anonymous Coward on Saturday March 05, 2005 @08:53PM (#11855957)
      The marketing people at Microsoft convinced them that .NET made everything secure!
    • by ceejayoz ( 567949 ) <cj@ceejayoz.com> on Saturday March 05, 2005 @08:55PM (#11855971) Homepage Journal
      No one sells 'em anymore, at least not in the quantities Wells-Fargo needs.
      • Your source for this bit of info?

        In addition, they couldn't go to another OS because?

        I've been contemplating changing banks for some time now (from Wells Fargo), but haven't for several reasons. This could be the straw that breaks this camel's back.

        (FYI, a few years ago I walked up to a WF ATM, started to put my card in, and noticed a M$ Dev. Studio GPF dialog asking if I wanted to debug the application or cancel!!)

        PGA
    • by Anonymous Coward
      Navigating around popup windows: 2 minutes of user frustration

      Pressing "cancel" 10+ times to stop spyware installs: 2 minutes of user frustration

      Entering pin number after someone else already pressed "ok" on spyware install: priceless
    • by QMO ( 836285 ) on Saturday March 05, 2005 @09:16PM (#11856099) Homepage Journal
      The BOFH hates OS/2, and you DON'T want to make him mad.
      • by The_Dougster ( 308194 ) on Saturday March 05, 2005 @11:48PM (#11856867) Homepage
        The BOFH hates OS/2, and you DON'T want to make him mad.

        If the BOFH had done this job, he would have had Wells-Fargo purchase a super-deluxe QNX licensing contract, then he would have installed BSD on the machines and pocketed the change.

        Ahh, OS/2, I miss it. The last time I whipped out my OS/2 Warp disks and tried to install it, it didn't seem to like my 10 years newer hardware and couldn't find a HDD driver. Bummer. I can only imagine how fast it would have run on my 2GHz box.

        I think that Wells-Fargo should have used QNX, and now whoever made the decision is probably going to pay. Windows on an ATM connected to the internet is pretty damn frightening. Time to withdraw all my zorkmids out of the bank and stuff it under the mattress.

    • by ackthpt ( 218170 ) on Saturday March 05, 2005 @09:19PM (#11856120) Homepage Journal
      What was wrong with OS/2 atms?

      They weren't helpful enough, Well Fargo ATM customers can now look forward to the ATM Assistant(TM)!

      "Hi, I'm Clippy, would you like help:

      Depositing Funds?

      Withdrawing Funds?

      Transfer your entire balance to r00m4n14n d00d?

      Selecting the proper brick to smash my keyboard with?

    • by Deviate_X ( 578495 ) on Saturday March 05, 2005 @10:10PM (#11856406)
      IBM recommends OS/2 users migrate off OS/2 to either Linux or Windows 2000 [msdn.com]. Thats whats wrong with it, probably nothing technically (yes OS/2 developers are relics), more comercial.

      Given than Wells Fargo, is a substatial entity, it would be interesting and credible to know how/why they decided to go the windows route since it is possible to maintain a large number networked Linux nodes for remote updates/admin as is cited in the article about windows.

      Are windows embedded ATMs really the only game in town?

      • Given the amount of legacy OS/2 stuff out there and IBM's push on Linux, it is a wonder that they haven't released an OS/2 emulation layer for Linux. I can understand that it might not be possible to open source everything, but to not release nothing at all and advise to use someone elses product?

        Something akin to WINE but for OS/2 with IBM's endorsement would be a useful thing. They could open source headers, specifications, internal docs and other unencumbered things to set things off.

    • by Anonymous Coward on Saturday March 05, 2005 @10:12PM (#11856417)
      http://en.wikipedia.org/wiki/OS/2 [wikipedia.org]

      The collaboration between IBM and Microsoft unravelled in 1990, between the releases of Windows 3.0 and OS/2 1.3. The increasing popularity of Windows prompted Microsoft to shift its development focus from OS/2, and IBM grew concerned about delays in development of OS/2 2.0. Initially, the companies agreed that IBM would take over maintenance of OS/2 1.0 and development of OS/2 2.0, while Microsoft would continue development of OS/2 3.0, then known as "NT OS/2". However, Microsoft decided to recast NT OS/2 as Windows NT, leaving all future OS/2 development to IBM. Windows NT's OS/2 heritage can be seen in its initial support for the HPFS filesystem (although write support was dropped in Windows NT 4.0 and read support was dropped in Windows 2000) and text mode OS/2 1.x applications (support dropped in Windows XP).

      So they basically upgraded to a newer version of OS/2 in a weird twisted Microsoft sort of way.
    • by Anonymous Coward on Saturday March 05, 2005 @10:18PM (#11856440)
      I work for a financial services provider that has about 100 ATMs in the field. They're from Diebold, and up until very recently, they ran OS/2. Why'd we switch? Well, first of all, Diebold does not provide NEW machines that run anything other than Windows, so if you are doing a major deployment, and you buy from Diebold, you're getting Windows. Second of all, the industry is moving to 3DES at gunpoint (that gun wielded by our friends at Visa and MasterCard) and Diebold only supports 3DES on Windows-based ATMs.
      Now, it's true that you don't have to TCP/IP-connect a Windows-based ATM, you can operate it solely over SNA or SDLC or whatever you have -- but if you do you don't get all the features of the ATM, and not just the annoying things like HTML-based UI -- you don't get the handy stuff like remote management which means that you spend $$ sending humans out to the site rather than just doing task 'x' from your network.
      • by Anonymous Coward on Saturday March 05, 2005 @11:33PM (#11856784)

        They're from Diebold, and up until very recently, they ran OS/2. Why'd we switch?

        They're from Diebold. Enough reason to switch right there.

      • handy stuff like remote management

        I think that's the problem that everyone is worried about... that all of the sudden all the machines will be "remote managed" by someone and they'll start spitting out free money. Or logging card numbers/PINs.
    • by mpaque ( 655244 ) on Saturday March 05, 2005 @11:26PM (#11856736)
      Simply put, the OS/2 based ATMs didn't run the mission critical software that the Wells Fargo IT department felt was necessary on public access terminals, which is fundamentally what ATMs are. They require applications like Disk Defragmenter, Scandisk, Norton AV, Windows Update and Ad-Aware - none of which are available for the OS/2 platform.

      In today's climate of non-stop worms, trojans and viruses, deploying an ATM with no virus removal software would be irresponsible on the part of Wells Fargo.

      (With apologies to divisiontwo.com. :-)
  • by AtariAmarok ( 451306 ) on Saturday March 05, 2005 @08:50PM (#11855946)
    ...having to kill a couple dozen pop-up windows when I want to take $20 out of the ATM.

    However, come to think of it, a lot of those things would look better with that Aquarium Screensaver. I think I'll click on the ok download button next time.

  • Yes, but... (Score:3, Informative)

    by xeon4life ( 668430 ) <devin@devintMOSCOWorres.com minus city> on Saturday March 05, 2005 @08:51PM (#11855948) Homepage Journal
    They're going to use Windows Embedded, not Windows XP. Two completely different code bases.

    Just because one has security issues does not mean the other will too.
    • by HarryCaul ( 25943 ) on Saturday March 05, 2005 @08:53PM (#11855954)
      Are you implying that a Gartner analyst may not know what they're talking about?

      That would certainly be a first.
    • Re:Yes, but... (Score:5, Interesting)

      by Gilesx ( 525831 ) * on Saturday March 05, 2005 @08:53PM (#11855961)
      Maybe I'm wrong, but aren't they essentially the same kernel, with Embedded being a stripped down version?

      Either way, I wouldn't be the house on the kernel and networking components of XP being free from holes and possible exploits, Embedded or otherwise...
    • Re:Yes, but... (Score:5, Insightful)

      by marvin2k ( 685952 ) on Saturday March 05, 2005 @08:59PM (#11856001)
      So you are saying that Microsoft has no problems making the embedded version secure and they introduce the holes in XP just for fun? I fail to see how Microsofts track record should make me go "Ohhh, it the *embedded* version. In that case I trust your security completely!"
    • Re:Yes, but... (Score:5, Informative)

      by afidel ( 530433 ) on Saturday March 05, 2005 @09:14PM (#11856089)
      Uh, no Windows XP Embedded is EXACTLY the same code base as Windows XP. It's basically a componentized version of Windows PE, much along the lines of what the community did with Bart's PE. Now if they were using Windows CE.net THEN it would be a different code base, but many DCOM components for CE.net share source code with their windows counterparts so running on x86 hardware means that many of the same exploits may exist. Now if Wells Fargo knows what they are doing there won't be any unnecessary services installed, but the way the component selection engine for XP Embedded works means that things like the IE engine get dragged into almost any usefull selection, meaning that all sorts of vulnarabilies exist.
    • Re:Yes, but... (Score:3, Insightful)

      by Anonymous Coward
      They're going to use Windows Embedded, not Windows XP. Two completely different code bases.

      Hell, at this point I don't care whether or not it runs windows, its the "web enabled" part that scares me.
    • by mcc ( 14761 ) <amcclure@purdue.edu> on Saturday March 05, 2005 @09:41PM (#11856256) Homepage
      Existing Windows XP embedded based ATMs, made by Diebold, have already been effected by Windows XP-targetting worms. [bink.nu] This should be sufficient to demonstrate that the code bases at least share whatever code caused vulnerability to the Nachi worm. The obvious question then becomes, if and when further holes in Windows XP are discovered, what happens if they too are in the code shared with Windows XP Embedded?

      I mean, it's just an awfully funny coincidence that the sudden emergence of the term "cyber-crime" in connection with ATMs [securityfocus.com] just happens, after all these years of computer ATMs, to coincide with the introduction of Windows based ATMs.

      And I somehow suspect that in five years, when WinXPEmbedded ATMs are everywhere, if anyone observes it as odd that how ATMs suddenly have a security track record now, we'll have people saying "oh that's just part of the technology, there's nothing you can do about it, it would be the same with any other vendor"...
      • The implication here are grave, and important, Additionally it should be questioned is:

        For how many years have ATM terminals been exposed to the entire internet? The 2003 nachi worm exposed the fact that important financial networks have been susceptible to exploitation for a long time.

        It's the more embarrassing to realize that none of the so called Analysts, Gartner Analysts (a $9 billion advice giving outfit), or so called security experts, who now have the gall to pontificate (http://www.securityfocu [securityfocus.com]

        • by mcc ( 14761 ) <amcclure@purdue.edu> on Saturday March 05, 2005 @11:04PM (#11856655) Homepage
          For how many years have ATM terminals been exposed to the entire internet?

          Well, they weren't exposed to the entire internet. They were on a VPN. Such ATMs are always put on a VPN. But that's the fun part, because the VPN apparently had holes in it.

          In other words-- at least this was the theory discussed at the time-- the ATMs had been put on a VPN so that they were inaccessible to the outside world. But other bank computers were apparently allowed in the same VPN. And somehow the Nachi worm got inside the VPN, at which point it was free to infect the ATMs...
    • Re:Yes, but... (Score:3, Insightful)

      by drsmithy ( 35869 )
      Since the vast bulk of security "problems" in XP come from end users downloading and installing spyware, I'm not sure why XP would be a problem in itself...
  • by Anonymous Coward on Saturday March 05, 2005 @08:52PM (#11855949)
    What could possibly go wrong?
  • Why! (Score:4, Interesting)

    by bstadil ( 7110 ) on Saturday March 05, 2005 @08:52PM (#11855950) Homepage
    I RTFA and have no idea why they did this. OS/2 is not EOL'ed yet. Methinks someone did a snow job on thiese guys.
    • Re:Why! (Score:3, Insightful)

      IBM has been discouraging people from using OS/2 for a while, and will certainly EOL it as soon as people stop paying the legacy support contracts. I can't imagine why someone would want to build a new product on it.
    • If they could get by with all their existing ATM's, it wouldn't be a problem. The problem is that they need to install new ones, both in new locations and to replace aging equipment that's failing.

      Diebold (the #1 maker of ATM's) doesn't sell an OS/2 based ATM anymore, which means if you want new ones, you're stuck with Windows.
  • by tbuckner ( 861471 ) on Saturday March 05, 2005 @08:52PM (#11855951)
    Gretings, I am Govermet Minster of Nigeria, and if you send me your PIN you wil share 20% of 1.3 milion American US dolars that I must retrive. THis wil only take a moment since you are already at your ATM.
  • choice quote (Score:5, Insightful)

    by Neophytus ( 642863 ) on Saturday March 05, 2005 @08:52PM (#11855953)
    "We want to make sure our ATMs are integrated with every other channel so when I do a deposit in a [branch] I want to be able to go to [an] ATM immediately and see that deposit"

    I do that regularly anyway. An ATM doesn't have to be on "the net" to do that. It has to communicate to the central handling server regardless of it's OS.
  • Does anybody know why the ATMs would be any more useful because they have been web-enabled? Perhaps people wish to do online banking at the kiosk?

    Then again, it could just be for ads.
    • Seriously, I don't know what the situation is like in the US, but I end up frequently lining up to use my home bank's ATMs. The last thing I need is some idiot stood there for 10 minutes logging on to check that his electricity bill was paid this month.
  • Comment removed based on user account deletion
  • by DARKFORCE123 ( 525408 ) on Saturday March 05, 2005 @08:56PM (#11855984)
    This is not a great move. Try and search for 0S/2 exploits even with Google. You're not going to find tons. I sure don't want to use an ATM running Windows and IE where someone that use the security expoit(s) of the month on it.

    Search on Windows security exploits and display the results and oh ... darn I hope this gets submitted because my browser crashed when all the results came back.

    • by man_of_mr_e ( 217855 ) on Saturday March 05, 2005 @09:03PM (#11856034)
      While it's unlikely that these machines are actually on the internet, but if they are it's probably not a big deal anyways. They'd likely be using some kind of hardware VPN, and even if they weren't they are most likely shutting off all external ports other than their own software, making it no more vulnerable than any other OS they might choose. No open ports, no way to exploit it.
      • by Svartalf ( 2997 )
        Invariably, the ATMs have to talk to the Bank's internal network at some point. Even over a VPN, you can have a propagation of a worm... That's how the last little inconvienence against Windows based ATMs happened. The worm got a machine on the inside of the Bank's LAN and propagated to the ATMs that were Windows based- right over the VPN.

        It's a big deal. If it's going to be web-based on it's controls, etc., it will have exposed ports.

        Simply put, Windows really, really isn't suitable to task for th
  • by nilbog ( 732352 ) on Saturday March 05, 2005 @09:01PM (#11856014) Homepage Journal
    Wells Fargo is moving to windows so they can run video on the ATM screens. They want to run traileras and MSNBC tickers. OS/2 doesn't have that capability.


    It's good too, because I needed a place to see MSNBC tickers and movie trailers and also get money at the same time.


    Now that this has rolled out on all Wells Fargo ATM's, they will allow you to watch full movies on them and will be opening concession stands. If you pull up to an ATM, and the car in front of you has the windows all fogged up ... it might be a while.

  • The local AMC 24 multiplex movie theatre self serve movie ticket terminals run Windows 98. There was one stuck at its boot screen at one point. Also I have seen the familair blue several times. These machines handle Debit transactions with a PIN number and credit card transactions without a PIN.

    Security does not seem to be a big issue on closed networks. At least I hope it is a closed network.
  • by pb ( 1020 ) on Saturday March 05, 2005 @09:03PM (#11856033)
    Does anyone else remember the end of Sneakers? Because that's what this reminds me of. I'm just thinking about the potential news headlines...

    "Wells-Fargo reportedly went bankrupt yesterday. Company spokesman: 'The money... it just disappeared...'
    In other news, the EFF is reporting record donations!"
  • Netscape (Score:5, Interesting)

    by danimrich ( 584138 ) on Saturday March 05, 2005 @09:04PM (#11856035) Homepage Journal
    A couple of weeks ago I saw an ATM that had crashed. It was running Netscape on some version of Windows.
    Surely enough, it was made by the same manufacturer who f***ed up US voting machines. I do have some pictures if anyone is interested.
    • Re:Netscape (Score:4, Funny)

      by hairykrishna ( 740240 ) on Saturday March 05, 2005 @09:50PM (#11856299)
      That's nothing. Check out this one displaying windows media player:

      http://midnightspaghetti.com/newsDiebold.php [midnightspaghetti.com]

    • Re:Netscape (Score:3, Informative)

      by generic-man ( 33649 )
      Diebold has been making ATMs long before they acquired a company that makes voting machines.

      Of course, their old ATMs were relatively reliable although they couldn't run Windows Media Player.
    • Re:Netscape (Score:3, Insightful)

      by jd ( 1658 )
      I've seen ATMs with BSOD on them. This demonstrates several things. First, there's no attempt at building a fault-tolerent system. If it crashes, it crashes and there's nothing to it but to wait until an engineer reboots it.

      Second, it proves that there's no kind of high-availability, hardware watchdog, or other automagic restart system. These are minimal boxes, not solidly-built ones.

      Third, it proves that the interest is in producing the most ATMs at the lowest initial cost, not in producing the best AT

  • s-l-o-w ATM keypad (Score:5, Interesting)

    by anadem ( 143644 ) <anadem@nOSpaM.gmail.com> on Saturday March 05, 2005 @09:05PM (#11856047)
    am I the only one who finds the new Wells Fargo ATM key response time to be laggardly?

    After I enter my pin, the beep sound and the asterisk that's displayed take so long that I think i've miskeyed, so press again getting a double entry which i have to cancel and slowly and carefully retry.

    Is it because of being Windowized, or just bad programming? The old OS/2 ATMs responded instantly.

    • Dunno about Wells Fargo, but all the banks in the UK have been going to these "richer client experience" terminals.

      Like you I have noticed that the time required to log-in to the ATM has increased. It sucks, but I don't think it's something we can get changed.
    • am I the only one who finds the new Wells Fargo ATM key response time to be laggardly?

      I dunno the make of the new ATMs around here, but you are not alone.

      It is incredibly annoying to have the "beep" of a pressed key come as I'm one or two keypresses further along. I have to stop and wait for all the beeps to catch up, look closely at the screen, make sure it's all ok. Very, very annoying. I'm thinking of changing banks just to save me the frustration.
    • by Jerf ( 17166 ) on Sunday March 06, 2005 @12:07AM (#11856948) Journal
      Oh god, not another one.

      In 2005, you should not have a perceptible delay between keypress and a simple ack. response like putting up an asterisk.

      The problem, of course, is not technology. It's this god-damned "save every fraction of a penny at all costs, and fuck the customer/user!" mentality. A couple of cents more per terminal is probably all it would take to eliminate the delay, but, well, like I said, fuck the user.

      I can't use Comcast digital cable boxes because of the multi-second delay before button presses react. (That one boggles the mind, I think they had to work to make it suck that bad.) It pisses me off that in the time it takes to navigate to one On Demand movie, the value of my time for the time it took to do the navigation would have been sufficient to make a snappy, responsive system. You could quite literally rack up hours spent just waiting for their interface to update in a year if you actually tried to use it (from what I gather from the way they keep dropping the price on On-Demand things, nobody does), and that says they care so little about my time that they'd rather save 5 cents.

      Normally, I don't much care about "bloat" in desktop computers, I think most people bitching about it don't really understand what that "bloat" is buying them. But in the embedded space, fire away with your "bloat" accusations. The work it takes to make a machine in 2005 react more slowly than a machine from 1970, no exaggeration, boggles the mind.

      Fuckers.
  • by Renraku ( 518261 ) on Saturday March 05, 2005 @09:06PM (#11856051) Homepage
    Stolen from Fark.

    "Wells Fargo Web-Enables ATMs. Hilarity ensues."
  • by Anonymous Coward on Saturday March 05, 2005 @09:09PM (#11856065)
    I went to the hole in the wall (ATM) and it was displaying a windows taskbar, a dos window with some process running with a dos full stop sequence progress meter and another McAfee window - I asked in the bank and they said it had been on and off all morning and an "engineer" was trying to fix it.

    I remember a /. article on UK banks going ove to windoze but I never thought i'd see the day.

    Was I ever laughing.

    I wonder if my atm card has a virus by now. ;-)

    PS It was Bank of Scotland

    Well I guess an OS and their money are easyily restarted.
    • My friend had an atm crash on him while he was withdrawring money (this wasn't one near a bank, it was infront of the cinema). He called the company that ran the atm and was informed that they no longer handled maintenance. One phone call later he was told that a person might be there the next day to fix it. He never got his card back. I guess he learnt his lesson of not typing 1337 into ATM's.
  • by mhesseltine ( 541806 ) on Saturday March 05, 2005 @09:10PM (#11856071) Homepage Journal

    Great. As if waiting for some jerk to

    • Check his balance
    • transfer funds
    • buy stamps
    wasn't bad enough, now I have to wait for him to
    • Check his email
    • view stock quotes
    • Play a game of Bejeweled
    • Install BonziBuddy
    • view some pr0n
  • by fsck! ( 98098 ) <.moc.liamg. .ta. .redle.bocaj.> on Saturday March 05, 2005 @09:11PM (#11856075) Homepage
    I nominate "The Windows-based infrastructure enables remote upgrades" as the loaded statement of the year. Anybody care to take a guess as to who will be writing "upgrades" for these things?
  • os/2 everywhere (Score:5, Interesting)

    by Lys0l ( 865235 ) on Saturday March 05, 2005 @09:11PM (#11856076)
    I used to work for IBM in OS/2 TCP/IP support. People would be amazed at how much OS/2 is still out there. Banking, industry, CIA, NSA, Vatican Bank, etc. Heart/Lung machines, ATM machines and the machines that make fritos. When OS/2 went down at friot-lay, no more fritos...not good times. I'm sad to see it go, it was great for apps such as these.
    • Re:os/2 everywhere (Score:5, Informative)

      by WillerZ ( 814133 ) on Saturday March 05, 2005 @09:25PM (#11856155) Homepage
      The reason OS/2 hasn't been EOL'd yet is that you need an OS/2 box if you want to start a mainframe (you can IPL it from the terminal, but to get from powered-off to powered-on you need OS/2). At least up to 2003 if you bought a zSeries box you got 2 OS/2 thinkpads inside it on shelves (I haven't poked around in any of our newer zSeries kit).

      For the curious, they're needed to tell each zSeries processor what it is. This isn't as dumb as it sounds, because each of the 16 processors can do one of 4 tasks depending on the microcode you load into it.

      You need a fairly dependable OS for this job, and when I last asked them they didn't trust Windows or Linux to do it right.
      • If it ain't broken, don't fix it. If an OS/2 based laptop is getting the job done, and there is no value add or return on your investment in running a windows/linux on these laptops... is it really worth it? Plus remember, when a new version of Z/OS comes out, it must support ALL the features of previous versions... the ultimate in backwards compatibility.

        These laptops run Communications Manager which in some of its abilities can emulate a 3270 terminal.. (yeah tn3270 does the same thing...)
  • New services (Score:3, Interesting)

    by cgenman ( 325138 ) on Saturday March 05, 2005 @09:12PM (#11856081) Homepage
    The Windows-based infrastructure is designed to allow Wells Fargo to update and add services such as new languages and envelope-free deposits to its entire network remotely.

    Umm... Wouldn't envelope-free deposits require an on-site hardware shift anyway? That is, unless Windows Embedded now runs rapid prototype machinery.

    Sounds like they're running WtFXML.

  • ..with home PCs.

    We put Windows on them and gave them all high speed net access... it wasn't the most successful experiment, and they weren't stuffed full of cash.
  • BSOD (Score:5, Funny)

    by FunWithHeadlines ( 644929 ) on Saturday March 05, 2005 @09:20PM (#11856129) Homepage
    Blue Screen Of Debt
  • Accounting (Score:5, Funny)

    by mollymoo ( 202721 ) on Saturday March 05, 2005 @09:38PM (#11856239) Journal
    The San Francisco-based bank said it also installed more than 3,000 online stations in nearly all of its 6,046 branch locations.

    That can't mean they have more than 3000 in total, as that's only around half of 6046. Even in marketing-land where the margins are bigger, you'd need at least 5000 out of 6000 to claim "nearly all". Logically, this means they must have more than 3000 online stations in each of their 6046 branches. That's over 18 million Windows licenses. Some sales guy at MS just got a new yacht.

  • by rimu guy ( 665008 ) on Saturday March 05, 2005 @09:47PM (#11856278) Homepage

    And in a not unrelated story: Hacker takes 3 minutes to get your cash [stuff.co.nz]

    A New Zealand computer hacker has accessed the private bank accounts of dozens of unsuspecting Kiwis, showing how easy it is to break into our internet banking system.

    The hacker installed software in a Wellington internet cafe that allowed him to gather the user names and passwords of people banking online at the cafe.

    Police e-crime national manager Maarten Kleintjes says he has been urging banks "for years" to introduce systems that ensure internet banking is safe, but most have been slow to respond.

    Kleintjes says the problem is that internet banking access relies on a simple password "which can easily be stolen". Other countries use "two-factor identification" where, in addition to a password, the customer is given a new security password for each internet banking session.

    Only two local banks, ASB and BankDirect, have a two-part identification system, where the customer is sent a text with a security password to use before transferring money.

    Online bankers can follow the advice on bank websites about using anti-virus software to detect and avoid key-logging programmes on home computers, but the software provides no guarantees. Kleintjes says it is "unreasonable and unrealistic" to expect all customers to know how to do this. He said the banks should introduce safe systems that have been available overseas for years.

    --
    Linux VPS Hosting you can Bank On [rimuhosting.com]

  • well.. (Score:3, Interesting)

    by bigattichouse ( 527527 ) on Saturday March 05, 2005 @09:52PM (#11856306) Homepage
    now they'll finally test the old adage "No one ever got fired for choosing Microsoft".. when someone gets really fired for choosing Microsoft. Wonder if they'll hold MS responsible for security breaches?
  • by the eric conspiracy ( 20178 ) on Saturday March 05, 2005 @09:59PM (#11856348)
    All your money belong to us!

  • by MSDos-486 ( 779223 ) on Saturday March 05, 2005 @11:03PM (#11856651)
    "I see you have used this ATM before. Would you like me to remember your PIN so you won't have to enter it again?"
  • by moanads ( 613115 ) on Sunday March 06, 2005 @12:43AM (#11857093)
    The Windoze enabled ATMs do not dispense more than $640. When asked about it, Bill Gates said, "$640 should be enough for anyone."
  • by plazman30 ( 531348 ) on Sunday March 06, 2005 @12:55AM (#11857143) Homepage
    I work for a mid size bank and we are doing the same thing. We are getting rid of our OS/2 based ATMs and replacing them with ones that run Windows XP. The ATM software is gonna run in IE in kiosk mode. I don't believe that it is our choice to run this configuration. Our ATM vendor is passing this along to us as the new solution to our ATM needs.

    The patch management of these things is really becoming a nightmare, and we haven't even rolled them out yet!
  • by jeffroe ( 316456 ) * on Sunday March 06, 2005 @01:58AM (#11857346) Homepage
    What a timely post! Today I got back from a week long contract job and went to deposit some checks at the bank. Well, the local Wells Fargo closes at 4pm and I just missed it by about 10 minutes, so I went to deposit in the ATM. I inserted my card as instructed and voila, a nice windows fatal error message requiring me to click OK, but of course no mouse to click the button with and the Green enter button does nothing. In fact, none of the buttons did anything. Eventually, the ATM rebooted itself and came up with a nice "This ATM is out of service." message, and of course kept my card. So, I called Wells Fargo customer service to find out how long it would take to replace my business ATM card and it's 7-10 business days!!! Ouch! Why exactly am I paying for a business account when I get the same service as for my personal checking account? I don't know. *sigh*
  • by barfy ( 256323 ) on Sunday March 06, 2005 @03:30AM (#11857557)
    Presumably the ATM/Windows XP part of the box is *not* connected directly to the network. That there is a VPN box/pair between the ATM and the home networks...

    ATM -- VPN -- Internet -- VPN -- Wells Fargo

    So the real question is how secure are THOSE boxes...
  • by dbIII ( 701233 ) on Sunday March 06, 2005 @07:32AM (#11857958)
    They make ATMS don't they? And no-one else would be stupid enough to put them on a public network when it is so easy to put them on a private network like we have now. How many dollars per machine do you need to save before it offsets the PR loss when the media reports instances of your machines getting owned? I suspect they won't be saving much at all per machine by putting them on the public network. If this sort of stupidity continues those bad movies about hackers getting into systems that should never be on a public network may become reality.
  • by CastrTroy ( 595695 ) on Sunday March 06, 2005 @10:16AM (#11858225)
    The ATM makers are making themselves obsolete. By providing low security publicly accessible terminals running windows, they've made them less secure than your home computer doing internet banking. Because, at least when it's in your house, you can do some due diligence in ensuring that your computer is secure. The only reason for ATMs is for getting money. Which is of minimal importance when just about everyone accepts bank cards for payment. You could even visit the bank once a week and take out cash for those smaller transactions where you can't use the bank card.
  • by Anita Coney ( 648748 ) on Sunday March 06, 2005 @10:47AM (#11858306) Homepage
    US banks are going to start using ziplock bags instead of safety deposit boxes and "very strong wooden boxes" locked with Master brand locks instead of vaults. And instead of expensive security vans to transport money, they'll be using bike curriers. More news as it develops.

Love may laugh at locksmiths, but he has a profound respect for money bags. -- Sidney Paternoster, "The Folly of the Wise"

Working...