Slashdot Mirror
Citi Hackers Got Away With $2.7 Million
angry tapir writes "Citigroup suffered about US$2.7 million in losses after hackers found a way to steal credit card numbers from its website and post fraudulent charges. Citi acknowledged the breach earlier this month, saying hackers had accessed more than 360,000 Citi credit card accounts of U.S. customers. The hackers didn't get into Citi's main credit card processing system, but were reportedly able to obtain the numbers, along with the customers' names and contact information, by logging into the Citi Account Online website and guessing account numbers."
Let's not forget that the account numbers were passed with no security in the URL. I think I'll be canceling my Citi card (when I pay it off...).
Citigroup suffered about US$2.7 million in losses
- dollars?
Nothing of value was lost.
I find this funny and sad at the same time. Their PCI certification needs to be revoked. Besides it has been done before to Citi. http://redmondmag.com/articles/2008/07/02/citibank-hack-shines-light-on-pci-compliance.aspx . if a bank can't be compliant then the PCI needs to be abolished because it appears to mean nothing to large financial institutions.
Harrison's Postulate - "For every action there is an equal and opposite criticism"
I got a slice of it after receiving an offer in my email yesterday.
CSO: Sir, we had a security breach! Credit card data was stolen and we lost money. We should up our security budget and improve our security standards! ... is bad, right? But ... no, I'll just tell finance to add the damage to our next bailout request. How much is it?
CEO: This
CSO: 2.7 millions.
CEO (enraged): 2.7 millions? You waste my time for that? Get the hell out of my office and come back when something serious happens!
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If only there was a way to have credit card owners approve each charge through the entering of some kind of a pin.
If only credit card numbers weren't special since what really mattered was signed transactions.
If only every consumer had a personal device capable of signing transactions in his pocket at almost all times.
Call me a dreamer, but someday in the next hundred years, I think that all those "huge" technological problems could be solved and we could end this problem of having our credit card and social security numbers being exposed.
Why are you letting these clowns ruin our country?
Several things went wrong here:
- "Developers" without a clue about web-application kept critical state client-side. An absolute Noob-mistake. They must not have had any clue what they were doing.
- The security evaluation was either done by people without basic knowledge of web application security as well, or not done at all. This is one of the first things anybody with at least a bit of knowledge (as in understanding web-mechanisms and having researched on the web for, say, 1/2 day about web application security).
- Incompetent and greedy management selected / signed off on the development team and the evaluation team (or did without evaluation), without any regard for their actual skills.
The developers and evaluators should be forbidden to work in IT for the rest of their lives or until they demonstrate strong skills. The managers responsible, however should go to prison, pay for the damage out of their own pockets and should be banned for life from working in management or any other place where they have the power to make decisions for an organization.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
-2006: Citigroup and M$ Develop a New Digital Identity Solution
-2008: Citi's Market Montage Solution Supports 200,000 Updates per Second with SQL Server 2005
- june 2011: Citigroup hacker attack affected more customers than first thought
-a week later, in the neighborhood of Redmont (about the PSN outage): "As a company, you can look back 8, 9 years ago, when Bill Gates wrote his Trustworthy Computing Memo that basically said, 'We need to change the way we architect our products and it has to be designed into the way we architect our products and services.' So it’s in our DNA, across the company. This is not just an IEB thing. So this has really been a multi-year effort for us as a company and it’ll continue to be one because this future, which we think is very much about services and very much cloud based - whether it be entertainment consumption or productivity - in order to do that, you have to have a secure environment. So we’re going to continue to do that and we don’t want to see any of our competitors hurt along the way. We think that’s bad for consumers."
... while it means that they don't have the goal of maximizing shareholder's equity, doesn't meant that they don't exhibit profit-seeking behavior. It just means that the profit isn't paid out in the form of dividends. It could, as one example, be paid out in the form of executive compensation.
Moreover, many credit unions are for-profit concerns. But the dividends go to account holders rather than third-party investors that don't deposit money into the credit union. And the money that is deposited is used by members rather than non-members. Rather than your deposits going towards providing the backing for third-parties to get loans, etc., they go towards loans, etc., for members of the credit union. This distinction starts to break down, however, when the credit union decides to invest the money in instruments to increase dividends to the members.
For 10 years when you lost a # to fraud the next card was different by only the last 4 numbers.
They seem to have stolen less than the bankers themselves.
Does this