Shouldn't this be the kind of key/info/data where it is divided into N pieces, and all of the pieces are stored separately?
Postbank to replace 12M bank cards after employees steal 'master key'
11–20 of 194 posts
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#12My accounting professor used to say the mirrors and security cameras in stores were to monitor the employees more than the customers.
That only would make sense if they don’t have cameras in the stock room and loading docks, etc.
I've worked at more than one location where the Cameras in customer areas were conspicuous but the cameras in the employee area were hidden.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#13There's a non-paywall article on the subject at:
https://hotforsecurity.bitdefender.com/blog/south-africas-po...
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#14>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?
Probably a backup. It makes sense to have an offline backup in cleartext (for DR), as long as you have the appropriate storage and security controls in place to protect it.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#15Shouldn't this be the kind of key/info/data where it is divided into N pieces, and all of the pieces are stored separately?
Shamir Secret Splitting divides a secret into M pieces requiring N parts to reconstitute. This does not absolutely prevent this attack, but requires collusion between attackers who are presumably trusted insiders, but trusted insiders can be compromised by blackmail, coersion, greed, or other angles.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#16That proves my point again that there are not enough regulations on electronic security standards that applies to private companies.
All you have are white hat security consultant experts that only have their dollars and reputation to work with. The public is highly vulnerable on those things yet I don't see politicians really caring.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#17>The breach resulted from the printing of the bank's encrypted master key in plain, unencrypted digital language at the Postbank's old data centre in the Pretoria city centre I can't read anymore. Is there anymore technical explanation? Was it actually 'printed' ... on paper? Was it even an actual encryption key or just a password or something?
People seem to forget why credit cards came into existence.
It was not for security. Ever.
Credit Cards were introduced as a less-secure-but-more-convenient-check.
The store then would have a stock of "blank checks" with absolutely no security features where they would imprint with carbon paper and a pressure roll the credit card information and pretty much "mint" the client a check on the spot.
Over time the raised letters for the crude minting press morphed into a magnetic strip, but the process was still 100% the same. Outside of the US in the last decade (2yrs in the US) some little security was added with encryption keys and PINs. Which is nothing more than a digital signature the bank may or may not check (like it did with the actual signature on the previous mentioned blank checks minted by the store). This is the step that was compromised with the stolen keys. In other words, the few places where you have to insert your card chip into a reader and type a pin had their security degraded to the same level as places where you simply use your magnetic strip or type your numbers on an online store.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#18This is quite surprising to me. Some of the banking technology and practices in Germany are extremely tight and their infrastructure seems problematic. Living there for a while as a non-native and being with PostBank, it was insanely difficult to login and understand. Germany is also heavily marred with bank cash groups, meaning you get charged elsewhere.
It was great to see N26 come along and change that, and thank god for their native translations.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#19It seems ridiculously cheap, relative to payout, to attack financial institutions by joining them as employees. Couple this with the fact that "white collar" crimes are punished with relatively lenient sentences.
Re: Postbank to replace 12M bank cards after employees steal 'master key'
#20Earlier quoted context omitted.
That only would make sense if they don’t have cameras in the stock room and loading docks, etc.
I've worked at more than one location where the Cameras in customer areas were conspicuous but the cameras in the employee area were hidden.
Sure but stock room knows the security people and if the manager is causing shrinkage then the staff might also follow “the lead”.