Schneier on Security

Clive Robinson • October 2, 2017 2:04 PM

I guess it needs to be said,

It is alledged that the bank robber Willy Sutton was asked why he robbed banks by a reporter, after a pause he said “I rob banks because that’s where the money is”. And that gave rise to “Sutton’s Law” [1].

Even if not said by Sutton there is a certain logic to the quote. Thus people attack ATMs because that is where the money is probably easiest got at.

After all if ramming a tow truck into an ATM then slinging a chain around it and towing it away like a “bulldogged” stear at a rodeo, then there could be a less dramatic way to get the cash out… Perhaps not filling it full of “gas-n-air” to blow the ATM appart at the seems or one of several other methods.

The lack of subtlety is one of the reasons ATMs are not exactly well built is that the banks have externalised the cost via insurance etc. Further they have realised there is a trade off if they make ATMs more secure then not only will they cost more to make, the damage involved with the ATM geting stolen/opened will be higher, which brings other considerations into play. Like the cost of the loss of life etc if they get sued in court.

Which means you have what is in effect a soft target. From the robbers point of view ATM’s are easier than safes, and a lot safer than an old fashioned “stick up”.

So like it or not those “vulnerable” ATMs may well be saving lives.

[1] Although the naming of “Sutton’s Law” was inspired by the supposed “well-known” quote Willie Sutton disclaimed credit for the saying. He said in a book “The irony of using a bank robber’s maxim as an instrument for teaching medicine is compounded, I will now confess, by the fact that I never said it”.

Clive Robinson • October 2, 2017 6:20 PM

@ Ninja,

… in an endless cat and mouse game

Yes although the military expression would be “ECM / ECCM”

The thing is “ratcheting up” usually get into a “law of diminishing returns” where each step is but a fraction of the one before.

What is making this different is one side has not invested in playing at the level of those they are defending against. As almost always happens with banks they only raise the security bar by small increments with the result the attackers can stay in the game. We saw this behaviour with online banking fraud in the late 90’s and into this century. To a certain extent it’s not stopped because although the banks have stepped up and have closed the gap with the likes of 2FA attackers have become so well funded that they are still getting sufficient advantage. Further the advent of smart phones has brought a third party into the game kicking of a different technology path to use for attacks.

Without appearing pessimistic the banks are not only slow to step up, they don’t appear to think how new technology changes the dynamic and thus they appear stuck well behind the technology curve whilst the attackers appear to be ridding well ahead of them. Interestingly though the attackers do not appear to be at the leading edge, in most cases they are still picking the “low hanging fruit”. Thus the speed the attackers respond to change suggests in a few respects either they are very agile or that some are keeping attacks in reserve or even stock piled. The limiting factor appears as is often the case the “laundering” aspects of the gains they make.