Silas Cutler ☜ `p1nk`

I used to work for one of the major banks; VNC is a commonly used tool for support to update/manage ATMs, which run on Windows

so, prob legit. that screen shouldn't have shown up, but it's prob not a cause for concern (unless that bank doesn't use VNC)

sure, could be a legit install. I really don't like seeing the anonymous user ( especially because real VNC supports ldap )

I'd also wager it's an unnecessary tool at this point. Microsoft's suite is more then capable of proper mgmt.

VNC seems like an easy way to cause these systems to end up with wildly different settings, patch levels, configurations, etc.

sure, other software could be used, but business is slow to pivot and doesn't want to waste paid-for licenses.

and any company worth its weight would have proper update management, although it's not foolproof

I've done tech for a kiosk company, and while we used VNC, we had no way of accessing users cards or PINs.

do you mean data want not accessible /because/ of a security control or was there no tool for viewing data.

This ATM vendor could optimise their configuration to avoid the “anonymous” reference or use our SDK for better integration

Really hoping this is Photoshop

Nada.

That's horrifying. Where was this?

you cannot intercept pin entry, can you?

depends. I'd the keypad is a HID device it's simple keyboard hooking