Slashdot Mirror
How Citigroup Hackers Easily Gained Access
Endoflow2010 writes "Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique. It has been called 'one of the most brazen bank hacking attacks' in recent years. And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories. They simply logged on to the part of the group's site reserved for credit card customers and substituted their account numbers — which appeared in the browser's address bar — with other numbers. It allowed them to leapfrog into the accounts of other customers, with an automatic computer program letting them repeat the trick tens of thousands of times."
There is no facepalm big enough to express my feeling at that hack. I'm sure they paid good money to "security professionals" to set that up too.
I read the internet for the articles.
Heads need to roll for this one... Amazing. Words escape me.
If you want news from today, you have to come back tomorrow.
I did that at a bank I was working with. It was actually a hidden form variable with the institutions username/password, but grabbing that page before it auto-submitted allowed me to pull anyone's statement. I showed it to my manager, and eventually got a promotion out of it. :-)
When writing our rest services the first thing we considered was how to prevent users from accessing other users data. I don't understand how this could happen to a bank with credit card data. It's ridiculous.
Dealing with credit card information I know for a fact that security implementation is 100% illegal if the allegations are true. Citibank will be fined hundreds of millions of dollars if they follow the law ($100,000 per incident). I mean base level security for this would be only allow that user access to that specific account. If they were able to simply change URL numbers to see other account holders info... wow... just wow.
If you don't understand how a secure negotiation protocol (and the protocol for the session after the fact) works, admit it and either ask someone or read several books until you recognize that you should still go ask someone. I've read more than my fair share of crypto books and papers, but, being an application developer who does only trivial personal server-side development, you can be damned sure that I'd ask for help when working on a username/password system. This goes double if it involves banking.
That any session allows them to go digging around willy nilly is so unbelievably stupid, I can't even find the words.
From TFA:
One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'
/epic facepalm
First, this is NOT a hard vulnerability to prepare for. If the only method of user authentication you are doing is based off a string of characters received from the URL your not even qualified to build an ecommerce site for some mom-and-pop 2-sales-a-week company, let alone a bank.
Second, why is this a surprise to this security "expert"? Anyone who has done development for a website with dynamic content would be familiar with passing information through the url. This is like web design 101. If I logged into my credit card account and saw my CC number in the URL bar the FIRST thing I would think of would be: "what would happen if I typed in another number in there." Security expert my ass, no wonder why some companies have this happen to them, look at the people they hire to test and investigate their systems!
/rant
If what I just said sounded like a troll, it was probably just a failed attempt at humor.
I know, redundant. But fuck. you've got to be kidding me! I think you are kidding. Nice lulz. This is a joke. Right?
It's the security solution for Citigroup!
IF the article is correct about the nature of the vulnerability this quote is the single stupidest and most frightening things I have ever read on the internet.
because this is epic fail.
Never let a lack of data get in the way of a good rant.
"One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.
He said: 'It would have been hard to prepare for this type of vulnerability.'"
Really? They were passing a credit card account number in the clear through a GET parameter, without validating it against which session the page load was authenticated on, and that was "hard to prepare for"? Really?
I could have done it better than that. So I guess that makes me an expert, right? (Hint: No. It makes the "expert" a flaming idiot.)
Sending the account number out in a URL over SSL should not be that big of a hole.
(Ok, not smart, but the risk lies mostly in the person looking over the user's sholder).
The problem was allowing the change in the URL without going thru re-validation of credentials.
Apparently they set a session flag indicating that validation had been passed, and never bothered
to match that with the change in the account number.
Sig Battery depleted. Reverting to safe mode.
It was a very simple attack.
sophisticated cyber criminals
I assume they mean the cyber criminals were wearing top hats and monocles, and using big words.
"When information is power, privacy is freedom" - Jah-Wren Ryel
It doesn't matter WHAT time or money constraints they were under. This is simply not something that would be acceptable out of somebody that codes for money. To call this a "beginners mistake" is an insult to Web Development 101 students everywhere. If you have to be TOLD that maintaining authentication to a secure website based on the contents of the URL bar is a bad idea, then you do not deserve to be coding for anybody. I haven't EVER coded a website (I haven't written anything longer than a ten-line shell script in 13 years) and I could have told you this was a mind-bogglingly stupid mistake. This is not 20/20 hindsight at work here... it really is that stupid.
Heads should roll, including the programmer(s) responsible for this travesty, and two levels of management above him/her. And the remaining employees in the department should all have to apply for their jobs again (by the new management team), as their suitability as programmers could not have been properly evaluated before if the original moron managed to keep his job longer than a week.
I'm actually willing to cut the testers some mild slack... maybe they chose not to test for the developer having the IQ of a turnip. (Just a little slack... a tester should NEVER assume the developer has the least clue what they are doing when figuring out what needs testing.)
One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'
Are you *really* trying to label this as a browser vulnerability issue?
You're either *really* incompetent or paid very well to say shit like that.
sysadmins and parents of newborns get the same amount of sleep.
Should CERT issue an advisory on outsourcing as a hot new attack vector?
Sending the account number out in a URL over SSL should not be that big of a hole
Exposing an internal ID in such fashion is not only foolish, but very much a beginner error. I would expect this from some half-assed forum software - not a bank. That said, I've worked for the government before, and seen the same stupid mistake repeated time and time again. A salted hash would have been a lot less idiotic. The fact that there was no authorization performed makes compounds the issue, however, and one wonder who these people hired to write their infrastructure.
"In conclusion, the main thing we did wrong when designing ATM security systems in the early to mid-1980s was to worry about criminals being clever; we should rather have worried about our customers - the banks' system designers, implementers, and testers - being stupid."
Ross Anderson, "Security Engineering"
This is super basic stuff in the web world. What they did in this debacle is let you into the bank (citigroup.com), talk to you one-on-one at the teller station (SSL), have you swipe your card and enter your pin (login/password), then let you fill out a withdrawal form for anyone's account and give you the money!!
"Uh... yeah, I'd like to get the money from my account number +1... oh, that one's closed, how about my account number +2, nope, well then +3? Ah, yes, that one please... all the money, yes."
I don't bank with citigroup, and I certainly never will knowing how little effort they put into their security practices.
Yes, the car is locked, but all the cars use the same key. It would have been hard to prepare for this type of vulnerability.
I think you mean, the cars are all locked but unlocking one car, regardless of key, gives you access to all other cars.
Every user account has it's own credentials, it just happens that once you are authorized you are free to access every account, not just your own.
The lowest bidder.
Even better, valet parking - Valet gives you a ticket, and you discover it's possible to pencil in another number, and get a different car. Then you discover they let you make 20,000 photocopies, and present 20,000 different tickets, and valet *never gets suspicious*.
It's cheaper for Citigroup to spin its way out of this mess than for it to pay for real security. Because real security requires people with some sense throughout the chain with access to the organization. And that kind of person is a threat to the entire way of doing business that banks like Citigroup do it.
Remember that Citigroup is exactly the bank for which Senator Phil Gramm (R-TX) wrote the 1998 bank deregulation bill that left the global economy exposed to exactly the kind of collapse the 1934 regulations had protected us from since the last time the banks gave unregulated credit until they collapsed. They have learned from the 2008 Crash that they will be given only more money when they fail, so they don't work hard to avoid the risk. The kind of "moral hazard" that banks use to excuse paying their insurance obligations, but which define their own businesses now.
--
make install -not war
Anyone remember? You could gain access to anyone else's mailbox by replacing your own address with theirs in the URL bar...10 years later, a bank still can't figure that out? These are the jackasses we "trust" with all of our money and assets, too.
it is entirely and completely bad and serves no good purpose.
whatever step you are using to "verify" the id passed by the URL is what should be tracking this in the first place, by passing an ID in the url you only open things up for some other coder working on a different section of the system to use that ID without realizing it is not authenticated. unique short lived tokens already make this a solved problem, especially if every page loaded gets a new token as well and is only valid for actions connected to that page
Snowden and Manning are heroes.
All this time I've just been using that trick to get free porn.
Dear Slashdot: next time you want to mess with the site, add a rich-text editor for comments.
Comment removed based on user account deletion
But "the lowest bidder" is the spirit of corporate America!
Obvisouly it is not that Citibank were criminal morons with absolut disregard about their customers, but that the attackers were sophisticate terrorists (and paedophyles, now that we are talking about it).