Slashdot Mirror
Citi Hackers Got Away With $2.7 Million
angry tapir writes "Citigroup suffered about US$2.7 million in losses after hackers found a way to steal credit card numbers from its website and post fraudulent charges. Citi acknowledged the breach earlier this month, saying hackers had accessed more than 360,000 Citi credit card accounts of U.S. customers. The hackers didn't get into Citi's main credit card processing system, but were reportedly able to obtain the numbers, along with the customers' names and contact information, by logging into the Citi Account Online website and guessing account numbers."
Let's not forget that the account numbers were passed with no security in the URL. I think I'll be canceling my Citi card (when I pay it off...).
Citigroup suffered about US$2.7 million in losses
- dollars?
Nothing of value was lost.
Call me when there's news of the billions in cash that mysteriously was lost in Iraq.
I find this funny and sad at the same time. Their PCI certification needs to be revoked. Besides it has been done before to Citi. http://redmondmag.com/articles/2008/07/02/citibank-hack-shines-light-on-pci-compliance.aspx . if a bank can't be compliant then the PCI needs to be abolished because it appears to mean nothing to large financial institutions.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
CSO: Sir, we had a security breach! Credit card data was stolen and we lost money. We should up our security budget and improve our security standards! ... is bad, right? But ... no, I'll just tell finance to add the damage to our next bailout request. How much is it?
CEO: This
CSO: 2.7 millions.
CEO (enraged): 2.7 millions? You waste my time for that? Get the hell out of my office and come back when something serious happens!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
:)
If only there was a way to have credit card owners approve each charge through the entering of some kind of a pin.
If only credit card numbers weren't special since what really mattered was signed transactions.
If only every consumer had a personal device capable of signing transactions in his pocket at almost all times.
Call me a dreamer, but someday in the next hundred years, I think that all those "huge" technological problems could be solved and we could end this problem of having our credit card and social security numbers being exposed.
Why are you letting these clowns ruin our country?
Banks across the US are weak in a lot of online security, but I know for a fact that most of them are actively engaged in making it better and are spending a lot of money to do so. Even this problem with Citi would have been easily caught and mitigated if they had Silver Tail Systems installed, for example. Most of the large banks in the US are moving in this direction of behavioral analytics instead of purely transactional.
I do my hacking with a machete. Hack into a bank and cause problems for 360k people, you had better fear my hack.
Several things went wrong here:
- "Developers" without a clue about web-application kept critical state client-side. An absolute Noob-mistake. They must not have had any clue what they were doing.
- The security evaluation was either done by people without basic knowledge of web application security as well, or not done at all. This is one of the first things anybody with at least a bit of knowledge (as in understanding web-mechanisms and having researched on the web for, say, 1/2 day about web application security).
- Incompetent and greedy management selected / signed off on the development team and the evaluation team (or did without evaluation), without any regard for their actual skills.
The developers and evaluators should be forbidden to work in IT for the rest of their lives or until they demonstrate strong skills. The managers responsible, however should go to prison, pay for the damage out of their own pockets and should be banned for life from working in management or any other place where they have the power to make decisions for an organization.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
-2006: Citigroup and M$ Develop a New Digital Identity Solution
-2008: Citi's Market Montage Solution Supports 200,000 Updates per Second with SQL Server 2005
- june 2011: Citigroup hacker attack affected more customers than first thought
-a week later, in the neighborhood of Redmont (about the PSN outage): "As a company, you can look back 8, 9 years ago, when Bill Gates wrote his Trustworthy Computing Memo that basically said, 'We need to change the way we architect our products and it has to be designed into the way we architect our products and services.' So it’s in our DNA, across the company. This is not just an IEB thing. So this has really been a multi-year effort for us as a company and it’ll continue to be one because this future, which we think is very much about services and very much cloud based - whether it be entertainment consumption or productivity - in order to do that, you have to have a secure environment. So we’re going to continue to do that and we don’t want to see any of our competitors hurt along the way. We think that’s bad for consumers."
.. and yes, my money is safe under the pillow than in a electrified, triple encrypted, titanium vault.
As in running a perl script that generated a randomly changing URL string and WGETing on it - such sophistication - must be the Chinese again .. :)
"Citigroup suffered about US$2.7 million in losses after hackers found a way to steal credit card numbers from its website and post fraudulent charges. Citi acknowledged the breach earlier this month, saying hackers had accessed more than 360,000 Citi credit card accounts of U.S. customers. The hackers didn't get into Citi's main credit card processing system, but were reportedly able to obtain the numbers, along with the customers' names and contact information, by logging into the Citi Account Online website and guessing account numbers."
All PCI compliance means is the finance house filling in a bunch of forms and posting them back to some authority with a big cheque :)
Visa and MasterCard, which allow middle-man entities to process charges without requiring tertiary security information
If only 2.7 million was lost, something seriously fucked up is going on. They should be spending more than that just for a 3rd party to audit their security.
Maybe we could use the same technique and recover all of the pension funds looted by Wall Street for the State of Wisconsin?
-Hack
Got Geometrodynamics? Awe, too hard to figure out? Too bad.
... while it means that they don't have the goal of maximizing shareholder's equity, doesn't meant that they don't exhibit profit-seeking behavior. It just means that the profit isn't paid out in the form of dividends. It could, as one example, be paid out in the form of executive compensation.
Moreover, many credit unions are for-profit concerns. But the dividends go to account holders rather than third-party investors that don't deposit money into the credit union. And the money that is deposited is used by members rather than non-members. Rather than your deposits going towards providing the backing for third-parties to get loans, etc., they go towards loans, etc., for members of the credit union. This distinction starts to break down, however, when the credit union decides to invest the money in instruments to increase dividends to the members.
You're focussing on the incredibly weak security of their web site. Even if it was a lot, lot better, there would still no doubt be exploitable vulnerabilities. Parent is making the point that if the information stored in the web site did not need to be secret in the first place - because you can't do anything with it - then who cares about the security of the web application.
I've just been employed to design products which encrypt cardholder data at rest and in transit... and none of this would be necessary if the U.S. just started using EMV like everyone else in the world. No mag stripe, chips on the cards which can sign transactions, etc. The cardholder number should not need to be secret in the first place.
My finances are a mess. Entirely my own fault. But there's only one financial organization I've ever regretted getting involved with. Given the option, I'd pay them back in nickels, after I'd rubbed every one of those nickels on my balls.
For 10 years when you lost a # to fraud the next card was different by only the last 4 numbers.
Here in Aus they have implemented a new system whereby you do not need to enter a pin or sign if it is a "small" amount (less than $100 at MacD's and less than $35 at Coles / Kmart stores) - Paypass / paywave.
It's been in for a couple of months, and is gradually gaining acceptance. There's a few problems though; one being the marketing material which clearly states that '.. there is no risk..'.
Let's see here. If I get mugged, said mugger can use my CC to their heart's content - so long as it is less than $100 at Macd's or less than $35 at a Coles (chain of stores et al).
The information provided states that any money lost on a stolen card will be refunded *after* the card is reported stolen. So, this opens up two new avenues:
1) Get mugged, and have your credit card joy ridden for a couple of hours
2) Get mugged, and have your credit card chip cloned
or even better, let's go for option
3) Your card information is recorded, and 'mysterious' $35 amounts keep appearing on your bills.. until you cancel the card..
I have asked, repeatedly, as to how to have this functionality disabled. Yes, I am security conscious enough that I want the 'hassle' of putting my pin in Every Single Time. Yes, even for 'small' purchases. Apparently, it can't be done - short of shredding your credit card.
Mainly, I am now concerned with young thugs trying to mug me. The "Zero Liability: If your card is ever lost or stolen, youâ(TM)re protected with Zero Liability for unauthorized purchases." ( Reference: http://usa.visa.com/personal/cards/paywave/index.html ) will *not* help with a broken arm or missing teeth.
You have a sick, twisted mind. Please subscribe me to your newsletter.
They seem to have stolen less than the bankers themselves.
Does this