So they just plugged it directly into the same network switch the ATM is on? That sounds incredibly dumb. The only ATMs I've seen the inside of had the network switch locked inside with the vault.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

And serious company will have this as basic security. It's a fundamental function even available on your consumer grade router at home. While it's overkill for that use, it's basic security for a company.

That's why it's not surprising at all that a bank didn't bother to do that. Banks have some of the most egregious security issues.

... Which financial company do you work for?

So they just plugged it directly into the same network switch the ATM is on? That sounds incredibly dumb. The only ATMs I've seen the inside of had the network switch locked inside with the vault.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

And serious company will have this as basic security. It's a fundamental function even available on your consumer grade router at home. While it's overkill for that use, it's basic security for a company.

That's why it's not surprising at all that a bank didn't bother to do that. Banks have some of the most egregious security issues.

i’d argue that any serious company wouldn’t really bother with MAC identification… they’re so easy to spoof that it adds to operational overhead far more than the benefit it brings

more likely with these things you’d have a VLAN mapped to a physical port, and if that port were disconnected you’d instantly get a notification and send someone to check it out

That’s why it’s not surprising at all that a bank didn’t bother to do that. Banks have some of the most egregious security issues.

Remember when John Stewart only had SOME grey hair?

Hey, no judgement. 2020 had my hair looking like santa claus.

So they just plugged it directly into the same network switch the ATM is on? That sounds incredibly dumb. The only ATMs I've seen the inside of had the network switch locked inside with the vault.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

Spoofing a MAC is easy but it still requires knowing both what an existing valid address is, and ensuring that it's not already connected to the network. It's only operational overhead when a new device is onboarded, after that the impact is minimal.

A policy that requires sending a tech is fine, but if you have hundreds or thousands of individual locations then you aren't going to have a tech onsite at every one of them to quickly check and fix an issue, and you don't really want to have to trust an end user to verify and/or make physical changes on site if you can avoid it.

Also our bank had some kind of port security so if it wasn't a recognized MAC address, the port just switched off.

And serious company will have this as basic security. It's a fundamental function even available on your consumer grade router at home. While it's overkill for that use, it's basic security for a company.

That's why it's not surprising at all that a bank didn't bother to do that. Banks have some of the most egregious security issues.

You would be surprised how many companies don't even have something fundamental like a custom SSID and password, or a backup, etc.

Spoofing a MAC is easy but it still requires knowing both what an existing valid address is, and ensuring that it's not already connected to the network. It's only operational overhead when a new device is onboarded, after that the impact is minimal.

A policy that requires sending a tech is fine, but if you have hundreds or thousands of individual locations then you aren't going to have a tech onsite at every one of them to quickly check and fix an issue, and you don't really want to have to trust an end user to verify and/or make physical changes on site if you can avoid it.

Don't stress mate. We've all aged in the 20 years between 2019 and 2025.

i’d have said that’s less important than TLS or something on your ATM, a VLAN for ATMs that can only access specific services, and all ports not on a VLAN just disabled

really you just want to stop traffic from being sniffed (stolen credentials) and spoofed (“correct - dispense $10000”), and then to make sure it and nothing adjacent to it can access less robust services… beyond that, you just have to assume nothing. the services that an ATM connects to should be robust enough that they do all the validation - the ATM is pretty dumb (kinda in the same way as your browser on your computer: it gets no decision making to access your bank; just is input and output)

MAC addresses are easy to spoof, and physical security is pretty difficult on something like an ATM that’s publicly accessible… plugging into a switch should honestly be a nothing burger… having it publicly accessible - even on the same VLAN as an ATM - shouldn’t be a problem other than defence in depth