Slashdot Mirror

← Back to Stories (view on slashdot.org)

How Citigroup Hackers Easily Gained Access

Posted by CmdrTaco on from the all-kinds-of-fail dept.

Endoflow2010 writes "Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique. It has been called 'one of the most brazen bank hacking attacks' in recent years. And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories. They simply logged on to the part of the group's site reserved for credit card customers and substituted their account numbers — which appeared in the browser's address bar — with other numbers. It allowed them to leapfrog into the accounts of other customers, with an automatic computer program letting them repeat the trick tens of thousands of times."

12 of 371 comments (clear)

  1. Seriously, what the fuck! by jandrese · · Score: 5, Insightful

    There is no facepalm big enough to express my feeling at that hack. I'm sure they paid good money to "security professionals" to set that up too.

    --

    I read the internet for the articles.
    1. Re:Seriously, what the fuck! by HeckRuler · · Score: 4, Insightful
      Agreed. And this:

      'broke in through the front door'

      It was an unlatched SCREEN DOOR with a missing hinge!
      I wouldn't consider it hacking even by the media's definition. It's akin to asking the teller for someone else's information, and coming back 200,000 times to do it again.

      Whiskey
      Tango
      Foxtrot

    2. Re:Seriously, what the fuck! by Anonymous Coward · · Score: 5, Insightful

      And yet FTFA:

              One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

              He said: 'It would have been hard to prepare for this type of vulnerability.'

      Wow. Yes, I can see how making accounts accessible via an unhashed URL is really something no one would have guessed would be a problem. Especially when the same technique is referenced explicitly in a recent blockbuster (The Social Network).

    3. Re:Seriously, what the fuck! by CharlyFoxtrot · · Score: 4, Insightful

      There's a reason that "expert" is anonymous: it's a PR flunky that has to feed ass-covering statements to the press. Something for the masses who don't know any better to swallow.

      --
      If all else fails, immortality can always be assured by spectacular error.
    4. Re:Seriously, what the fuck! by blair1q · · Score: 4, Insightful

      Account numbers don't need to be secret. In fact, you hand them out when you write checks.

      It's the access using the account number that has to be protected by more than "is the rest of the URI formatted correctly and does the browser have a cookie we issued to it?"

      Hashing the account number (and other info) into an identifier in that cookie, then using that as the session ID, and only allowing access to that one account from that port until another session was authenticated on it, would be more proper.

      It's not just the URI that is screwy, it's the whole lifecycle design of the session, and a failure to partition the data in any meaningful way.

  2. Seriously... by Frosty+Piss · · Score: 4, Insightful

    Heads need to roll for this one... Amazing. Words escape me.

    --
    If you want news from today, you have to come back tomorrow.
  3. Re:I did something similar by Volante3192 · · Score: 4, Insightful

    Be thankful your manager wasn't a complete idiot; playing the odds, that would normally get you fired, arrested and pilloried...

  4. WTF by itchythebear · · Score: 5, Insightful

    From TFA:

    One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'

    /epic facepalm

    First, this is NOT a hard vulnerability to prepare for. If the only method of user authentication you are doing is based off a string of characters received from the URL your not even qualified to build an ecommerce site for some mom-and-pop 2-sales-a-week company, let alone a bank.

    Second, why is this a surprise to this security "expert"? Anyone who has done development for a website with dynamic content would be familiar with passing information through the url. This is like web design 101. If I logged into my credit card account and saw my CC number in the URL bar the FIRST thing I would think of would be: "what would happen if I typed in another number in there." Security expert my ass, no wonder why some companies have this happen to them, look at the people they hire to test and investigate their systems!

    /rant

    --
    If what I just said sounded like a troll, it was probably just a failed attempt at humor.
  5. The "Expert" by overunderunderdone · · Score: 4, Insightful

    One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

    He said: 'It would have been hard to prepare for this type of vulnerability.

    IF the article is correct about the nature of the vulnerability this quote is the single stupidest and most frightening things I have ever read on the internet.

  6. Seriously, who are these "security experts"? by cultiv8 · · Score: 5, Insightful

    One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'

    Are you *really* trying to label this as a browser vulnerability issue?

    You're either *really* incompetent or paid very well to say shit like that.

    --
    sysadmins and parents of newborns get the same amount of sleep.
  7. OMFG by Checkered+Daemon · · Score: 4, Insightful

    "In conclusion, the main thing we did wrong when designing ATM security systems in the early to mid-1980s was to worry about criminals being clever; we should rather have worried about our customers - the banks' system designers, implementers, and testers - being stupid."
                    Ross Anderson, "Security Engineering"

  8. Re:you have got to be kidding me by sortadan · · Score: 4, Insightful

    This is super basic stuff in the web world. What they did in this debacle is let you into the bank (citigroup.com), talk to you one-on-one at the teller station (SSL), have you swipe your card and enter your pin (login/password), then let you fill out a withdrawal form for anyone's account and give you the money!!

    "Uh... yeah, I'd like to get the money from my account number +1... oh, that one's closed, how about my account number +2, nope, well then +3? Ah, yes, that one please... all the money, yes."

    I don't bank with citigroup, and I certainly never will knowing how little effort they put into their security practices.