Slashdot Mirror
Contractors Lose Jobs After Hacking CIA's In-House Vending Machines (techrepublic.com)
An anonymous reader quotes a report from TechRepublic: Today's vending machines are likely to be bolted to the floor or each other and are much more sophisticated -- possibly containing machine intelligence, and belonging to the Internet of Things (IoT). Hacking this kind of vending machine obviously requires a more refined approach. The type security professionals working for the U.S. Central Intelligence Agency (CIA) might conjure up, according to journalists Jason Leopold and David Mack, who first broke the story A Bunch Of CIA Contractors Got Fired For Stealing Snacks From Vending Machines. In their BuzzFeed post, the two writers state, "Several CIA contractors were kicked out of the Agency for stealing more than $3,000 in snacks from vending machines according to official documents... ." This October 2013 declassified Office of Inspector General (OIG) report is one of the documents referred to by Leopold and Mack. The reporters write that getting the records required initiating a Freedom Of Information Act lawsuit two years ago, adding that the redacted files were only recently released. The OIG report states Agency employees use an electronic payment system, developed by FreedomPay, to purchase food, beverages, and goods from the vending machines. The payment system relies on the Agency Internet Network to communicate between vending machines and the FreedomPay controlling server. The OIG report adds the party hacking the electronic payment system discovered that severing communications to the FreedomPay server by disconnecting the vending machine's network cable allows purchases to be made using unfunded FreedomPay cards.
1. They weren't fired for hacking, they were fired for STEALING.
2. Unplugging the network cable doesn't count as hacking.
2. Unplugging the network cable doesn't count as hacking.
Possibly they disconnected it with a hachet, making it literally hacking.
How did they not get a promotion?
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
And, you know from previous reports, that the real reason gag orders and such are necessary is because the hacked (MTA in this case) are UNABLE to fix the problem in a timely manner.
Sad, but too many organizations employ technology solutions they are unable to maintain.
deleting the extra space after periods so i can stay relevant, yeah.
If these were federal employees they wouldn't have been fired. They would have been reassigned. Or asked to take early retirement. Of course this would have happened after being suspended with pay.
"A plan fiendishly clever in its intricacies"- Homer Simpson
Contractors did not realize the "free" in FreedomPay means free speech not free beer.
Throughout my working life I have amazed that people with good jobs would be willing to jeopardize them for nickels and dimes -- stealing stationery, fudging expense vouchers, and now, apparently, cheating a company vending machine. Don't these people realize that they are putting their livelihoods at risk by stealing from their employer?
A supermarket left open but unstaffed all day with no security would suffer amazing amounts of loss. But whose fault would this be?
[emphasis mine]
The people who stole the stuff. It's ALWAYS the fault of the person who stole the stuff. 100% of the time. If I don't lock my door and people clean out my house that makes me an idiot, but the person that cleaned it out is still the guilty party. (The insurance company may exercise their "idiot clause" and not reimburse me for my stuff because of my negligence. But that's not relevant to the conversation, the thief is still a thief, and should get the appropriate punishment if caught.)
So why reward the incompetent by expecting an unrequired level of honesty from users?
I agree, this is terrible programming. There are definitely ways around spotty connectivity, and FreedomPay has most definitely let their customer down by not adequately protecting their interest. I'm sure you wouldn't have to hunt around too long for a civil lawyer that would be willing to sue FreedomPay for their negligence, but that doesn't excuse the workers who exploited that negligence.
It is inexcusable not to have the card broadcast its current credit to a disconnected machine. What possible circumstances would excuse this? And even if you have cards that can start a credit account, yhe machine would remember the card's number and transaction so the data could be updated when the machine was reconnected.
Regardless of how bad the system was designed, the truly inexcusable activity here was not reporting it.
The end result was abusing the shit out of the vulnerability to the tune of $3000+ worth of stolen goods.
The line between a consultant and a criminal is often defined by ethics.
-A supermarket left open but unstaffed all day with no security would suffer amazing amounts of loss. Sure, if you live in a shitty country. Here in Switzerland there are vegetable stands on the roadside by farms where you take your groceries and drop your money into a box, often just a wooden box.
It's ALWAYS the fault of the person who stole the stuff. 100% of the time.
But maybe not 100% of the fault. More than one person can be at fault.
In college I took an accounting class, and the teacher's favorite subject was "Internal Controls", systems and rules set up to make sure that people can't just steal money. He gave an example:
Suppose a small company has an accounting department with poor internal controls, and the head accountant knows that if he/she just edited one spreadsheet, he could steal a whole bunch of money and the company wouldn't realize. This person shows up for work every day for 20 years and never steals anything, and then one day suddenly snaps and steals the money. Who's to blame?
Clearly the person who stole the money is to blame for stealing the money, but my accounting teacher maintained that the company is also partially to blame for putting him in that position. It's a kind of stress, to have to resist temptation all the time, and it's unfair to put people in the position of resisting it.
Similarly, I put the blame in this case on the guys who stole the vending machine food, but the vending machine should not have been so easy to cheat.
P.S. Presumably they were paid well enough that they could afford to pay for vending machine food, so I'm not very sympathetic. And people who could entrap themselves by serially stealing petty things from a vending machine would seem to be high risks for being suborned by outside parties, so it's probably for the best if they aren't working in the CIA anymore.
lf(1): it's like ls(1) but sorts filenames by extension, tersely