Hacker Posts Details of 3 Million Iranian Bank Accounts

Jeremiah Cornelius writes "Khosrow Zarefarid warned of a security flaw in Iran's banking system providing affected institutions the details, including 1,000 captured bank accounts. When the affected banks, including the largest state institutions didn't respond, Khosrow hacked 3 million accounts across at least 22 banks. He then dropped these details — including card numbers and PINs — on his blog. Three Iranian banks Saderat, Eghtesad Novin, and Saman have already warned customers to change their debit card PINs. 'Zarefarid is reportedly no longer in Iran, though it is unclear when he left.'"

Comments

"Zarefarid is reportedly no longer in Iran, though

[kefkahax]

... it is unclear when he left." Yeah...

"though it is unclear when he left"

[Black Parrot]

But not unclear *why* he left.

Re:"though it is unclear when he left"

[Anonymous Coward]

Yeah, he's going to be made out to be the villain in this case. And that same thing would happen in most countries.

Re:"though it is unclear when he left"

[Auroch]

But not unclear *why* he left.

Yes, he "left".

I'm sure the Iranian government is outraged as his defection, and not secretly holding him in an north korean off-shore detainment centre.

Re:"though it is unclear when he left"

[Alex Belits]

Right, because all enemies of US are related.

Iran is a rich Muslim theocracy with some attibutes of a Republic. North Korea is a poverty-stricken pseudo-monarchy with attributes of Stalinism. They are about as likely to be on the speaking terms with each other as Henry Kissinger with Alexander Chikatilo.

Re:"though it is unclear when he left"

[jamesbrx]

Exactly this. Iran and North Korea don't even do that much business together. They might do when necessary, but the two countries are otherwise completely different. It blows my mind how little US people know about rest of the world. Iran does more business and shares thinking more with Russia and CIS countries. North Korea does business and shares thinking with China and Myanmar.

Re:"though it is unclear when he left"

[Anonymous Coward]

And yet, doesn't the USA have some sort of leasing agreement with cuba? It blows my mind at how little americans know about ... well ... everything they havn't heard on the telly.

Re:"though it is unclear when he left"

[Auroch]

Right, because all enemies of US are related.

Iran is a rich Muslim theocracy with some attibutes of a Republic. North Korea is a poverty-stricken pseudo-monarchy with attributes of Stalinism. They are about as likely to be on the speaking terms with each other as Henry Kissinger with Alexander Chikatilo.

Ah, so about the same speaking terms as the president of cuba and the president of the usa?

Re:"though it is unclear when he left"

[Black Parrot]

It blows my mind at how little americans know about ... well ... everything they havn't heard on the telly.

And how much less we know about things we *have* heard on the telly...

Re:"though it is unclear when he left"

[Sir_Sri]

Not really true. Iran and North Korea are very much in the 'enemy of my enemy' stage of life, and they are both quite friendly with russia and to a lesser extent both with china.

They may not be ideologically aligned to each other, but given their mutual enemy and mutual ally, they're willing to talk to each other. Who do you think is still buying all this iranian oil that is being extracted now that the previous markets can't and won't buy it? China and North korea. Who does North Korea sell missiles and technology to? (The Taepodong series specifically, as well as some shorter range surface to surface missiles), Yemen, Syria, Iran and a few others. The north koreans need currency, the iranians have currency, the north koreans need oil, the iranians have oil, the iranians need missiles to strike Saudi, Iraq and Israel, the north koreans have missiles.

They are as far apart ideologically as Stalin and Hitler, and yet for years those two managed to get along oddly well, exchanging training and agreeing to carve up poland together. Iran and North Korea may not be all that ideologically compatible, but they have nothing to particularly drive a wedge between them (unlike stalin and hitler). They each have things the other wants, no directly overlapping or conflicting interests and a shared enemy in the united states, who, helpfully, binned them together in an 'axis of evil', and if they weren't playing nice before, that gave them a good kick in the ass to start playing nice with each other.

They very much are on strong speaking terms and technological exchange, through russia, through china and at sea. They are both under heavy sanctions meaning their selection of possible trade partners is rather limited, and that means they take what they can get. If you think they at least up until recently weren't on very good terms you should pull your head out of the sand. The new North Korea, under Kim Jong Un, and the current state of affairs in Iran, along with the situations in Burma and Pakistan throw into question any future agreements. A Burma out of chinas sphere of influence, and a pakistan not interested in technological exchanges significantly limit their access to resources and cash, and might significantly shake up their desired alliances.

That said, you're right, in that they have no real long term collaborative goals. At the first opportunity I'm sure both of them would love to do business with someone else. But until a better opportunity comes along you go with the friends your enemies have given you.

Re:"though it is unclear when he left"

[Okian Warrior]

With Iran's penchant for brutal legal sentences ending in death and/or dismemberment, I have to wonder: Is he still alive?

Perhaps he left in easy-to-assemble "kit" form?

Is this what one would call "career suicide"?

Re:"though it is unclear when he left"

[arglebargle_xiv]

But not unclear *why* he left.

"Behram, make a hole in the desert".

Re:"though it is unclear when he left"

[Anonymous Coward]

That's right, he left.

Zarefarid now renamed to Zehr Afraid?

Seriously, if this was in another country, he may have a heap of trouble coming his way... with Iran - torture and death, if he's lucky.

Re:"though it is unclear when he left"

[Anonymous Coward]

I've read that North Korea and Iran have a long history of working together on long range missile and nuclear technology.

Re:"though it is unclear when he left"

[sg_oneill]

Reminder that there are still Americans who believe Iran and/or sadam-era Iraq are/where in bed with Al quaida.

I mean, forget that Sadam was a secular authoritarian who used the fight against islamism as the pretext for his purges (Baath are arabic socialist, and like most socialists dont have a lot of time for theocracy) and Iran are Shiia, whom Al Quaida consider to be heretical.

Of course the US administration suffer this same sort of blindness as well. The fact that Iraq will fall into the hands of Iran, almost innevitably should have been obvious to anyone who understood the implications of shifting the power balance from the Suni to the Shiia in Iraq.

Of course when your in the business of *creating* enemies, sometimes you do get to dictate terms. Once you piss off enough people, chances are they might put aside their differences and hang together in mutual defence.

Honestly if the US gets involved in many more wars I can honestly see a day when a lot of these powers put their heads together to create an Anti-NATO that should scare the hell out of anyone in the west.

Its best if we just backed the fuck out of there and let nature take its course. When was the last time someone wanted to invade Switzerland?

Re:"though it is unclear when he left"

[Anonymous Coward]

How is Bradley Manning doing nowadays anyway, people still pushing for the death penalty for him and Assange?

Re:"though it is unclear when he left"

[Tastecicles]

Because one of the most important conditions for ANY person, corporation or Government to be doing business with any bank which has either primary or regional headquarters in Switzerland (read: most of them) is that they lay the fuck off of Switzerland? Plus the fact that it the Swiss have a higher number of firearms in private hands than in police or government hands - 3.4 million versus less than 360,000. Are you going to invade a country where half the population are trained in, and have immediate access to, automatic weapons?

Re:"though it is unclear when he left"

[Anonymous Coward]

What sort of natural resources does Switzerland have?

All of these wars are about one thing: resources. Thats it. It has nothing to do with democracy, religion, west vs. whoever, etc. Those are all guises for the boob tube crowd. It is all about, as are all wars, resources.

Not making this realization is the fundamental flaw in all analyses of these issues. You run off on a tangent about how the stated goals make no sense and we need to this and that, its not working, blah blah blah. However, if you understand the true motivations, it works like a charm. Not only are we destabilizing the region, we are enriching powerful people/corporations by funneling American tax dollars through a war torn state, right back into the pockets of the wealthy. Its a great money laundering scheme for stealing from the people, and it creates a destabilized region where military might is the only "solution" to peace. Which in turn gives access to the resources and keeps them available for the nations with the most powerful military.

Re:"though it is unclear when he left"

[Shoten]

And yet, both got the technology to produce weapons-grade uranium from the same Pakistani, A.Q. Khan. Don't assume that differing political systems and ideologies is an absolute block against cooperation. I think it's ridiculous that they'd have this guy in North Korea; Iran isn't exactly a country with a need to offshore their state security apparatus, nor do they have some fanatical devotion to not saying anything that is technically untrue.

Re:"though it is unclear when he left"

[228e2]

Sure.

Wars arent fought with ground troops anymore. Whats a machine gun going to do to a Hellfile missile sent from a predator? Miss horribly while it and its wielder melt.

Re:"though it is unclear when he left"

[kamapuaa]

Iran and North Korea have a history of working together on missile development and nuclear programs. They're in similar diplomatic positions with the rest of the world.

You seem to be arguing that the countries are fundamentally different, which really is an entirely different question. Surprise! Countries often can have a working relation despite their differences.

Re:"though it is unclear when he left"

[Alex Belits]

^^^

Replies to my comment that insist on "cooperation" between Iran and North Korea:

THIS IS WHAT AMERICAN PUBLIC REALLY BELIEVES

Re:"though it is unclear when he left"

[Midnight Thunder]

Yeah, he's going to be made out to be the villain in this case. And that same thing would happen in most countries.

The way he went about making his point was wrong. There were probably other ways that wouldn't have caused him so much trouble.

Re:"though it is unclear when he left"

[Anonymous Coward]

He is the fucking villain in this piece. He alerts banks to a security flaw and gets no response, so his only option... is to dump details of THREE FUCKING MILLION bank accounts on his public blog? Sorry, the banks are negligent and should be hauled over coals for this, but that makes him the fucking villain of it.

If you can't see that then you're as big an idiot as the losers who were supporting LulzSec last year and go all rah-rah for "Anonymous" attacks on random companies that dump private users' data.

Re:"though it is unclear when he left"

[Anonymous Coward]

If Anonymous/LulzSec, etc. does it against an American company, then they're heroes here on /. This guy does it against Iranian businesses and he's a villain.
I agree with you on this, Evil is as Evil does regardless of where it does it.

Re:"though it is unclear when he left"

[Anonymous Coward]

Wars aren't fought with ground troops anymore? Really? You mean Armor, Artillery, and Infantry are all obsolete because of UAVs? Wow, it's amazing what keen military insights I can learn here.
Let me guess, you've never served in the military in any branch. Seriously, do yourself a favor and read up on "combined arms" before you make any military related post.

Re:"though it is unclear when he left"

[Anonymous Coward]

You forgot to mention that North Korea needs food. Iran doesn't have any food for North Korea.

Re:"though it is unclear when he left"

[SuricouRaven]

Depends on the objective. If the objective is to capture and control ground, then you need troops. If the objective is to simply obliterate an enemy, then you don't. You need bombers, missiles, and artillery. While the last one is ground-based, it also gets kept far away from the front line and so is at no risk of ground-based attack. If you're desperate, there are nukes. The old war of obliteration isn't politically feasable any more though - no matter how hostile the target has been, the world will react really badly to the mass-slaughter of civilians. This isn't WW2 any more, where both sides could quite happily carpet-bomb each other's cities.

Re:"though it is unclear when he left"

[Anonymous Coward]

Or use Spooky :)

Re:"though it is unclear when he left"

[Anonymous Coward]

Only the people need food, not those in power.

Re:"though it is unclear when he left"

[Anonymous Coward]

Nobody's making him out to be a hero, but tossing all the blame on him is a cop out. "Poor helpless banks were victimized by no good hacker"... that misses the entire point, which should be that security needs to be fixed.

Yeah, what he did was wrong, but the banks were so incompetent that they let him steal details of THREE FUCKING MILLION bank accounts, every after he told them how he was going to do it. That little detail needs to not get lost in the story. The people out there who are changing their pin ought to be pissed off at their bank as well as this guy.

Re:"though it is unclear when he left"

[Bigby]

You don't take over a country for their resources anymore. You take over their people and use them to accomplish your goals about the resources. That means you can't just kill everyone. But if everyone can defend themselves, then you will have to kill everyone. And to that means, it is pointless to try, as you will never take control of the people.

This is why a country without a government is so darn hard to take over. What good is governing a country without people or people who abide by the rules?

Re:"though it is unclear when he left"

[Nidi62]

Wars arent fought with ground troops anymore. Whats a machine gun going to do to a Hellfile missile sent from a predator?

They most certainly are. War for the next 50 years or so (unless things get really bad) will be primarily long term, low intensity conflict like what we've seen in Iraq, Afghanistan, Syria, and Libya (admittedly we got lucky with Libya, as it was relatively short). Conflicts such as these tend to stretch on for years. See the Sri Lankan insurgency that lasted roughly 25 years. Insurgencies are usually fought with small arms; the largest weapons usually available to insurgents are large-caliber machine guns, mortars, and RPGs. Combine this with the fact that most insurgencies cannot afford a large stand-up fight, and you get a lot of hit and run contact. Thompson, the man who pretty much led the British during the counterinsurgency in Malaya back in the 50s (and who pretty much wrote the bible on COIN doctrine; he started it all) realized that you cannot do sweep and destroy methods to defeat an insurgency; you must use sweep and control. To defeat an insurgency, you have to control ground. To control ground, you need group troops. While armed drones are good for patrolling and attacks on vehicles or fixed positions (camps, emplacements, etc), this is very expensive, and in many cases overkill. Most states cannot afford technology such this, and tactically armed troops on the ground usually make much more sense anyway, as even in predator strikes troops still have to go in afterward to look for intelligence.

Re:"though it is unclear when he left"

[Nidi62]

His trial is in progress. And yes, if it is found that he committed treason, then he can legally be executed. But as right as it would be, it would be a PR nightmare, so he'd probably just get life at Leavenworth, which not a fun place to spend the next 50-60 years.

Re:"though it is unclear when he left"

[Anonymous Coward]

Wait, what? We know they are related. George W. Bush told us so. They are the Axis of Evil. You can't be an Axis without being somewhat related. Are you trying to say George W. Bush was wrong about something?

Re:"though it is unclear when he left"

[Overzeetop]

Like...

Re:"though it is unclear when he left"

[Jawnn]

Please do not generalize quite so freely. While there is clearly a large block of drooling ditto-heads here, who shape their world view from watching Fox News and listening to Rush Limbaugh, some of us actually have a much broader scope when it comes to our sources for such information.

Re:"though it is unclear when he left"

[luis_a_espinal]

If Anonymous/LulzSec, etc. does it against an American company, then they're heroes here on /. This guy does it against Iranian businesses and he's a villain. I agree with you on this, Evil is as Evil does regardless of where it does it.

Slashdot posters are typically full of it, but I have never seen a situation where Anon/LulzSec get generally praised in /. for dumping millions of American bank user accounts info to the plain web for all to see. Citations plz?

Re:"though it is unclear when he left"

[Anonymous Coward]

You don't take over a country for their resources anymore. You take over their people and use them to accomplish your goals about the resources.

Yeah. Look at Canada. Won the war of 1812. But now government bends over backwards faster than you can say "I'm a foreign corporation."

Re:"though it is unclear when he left"

[Sir_Sri]

I'm not sure the north korean government cares about a bunch of starving mostly illiterate peasants (who are illiterate, starving, and peasants because of government policy). If they wanted food China and Russia I'm sure could spare the small fraction of a percentage it would take to feed the couple of million starving people in the DPRK anyway. Between them China and Russia feed 1.5 billion people, the 23 million in North Korea, who are in large part still fed on their own isn't exactly a huge burden.

No, I think the North Korean government has very deliberately decided it doesn't want to feed those people. That might be a bizarre attempt to guilt trip south korea (your brothers are dying here, you should feed them) so the government doesn't have to, it might be something else. It's hard to get a good policy read on why the DPRK does anything beyond 'it seemed like a good idea at the time'.

Re:"though it is unclear when he left"

[markyosti]

I personally tend not to get into this sort of conversations as all the sources I personally have - from telly to the internet, give me information that is either 3rd, 4th hand or 5th hand, or that I have troubles considering authoritative. Buzz and word of mouth in the internet era is also not very reliable, see the many hoaxes we have...

I have opinions, but I consider them speculations at best based on the input I got, but I hardly ever feel like arguing about them, as... I think the foundations are too fragile for me to think it's worth trying to change other people's mind or to think that I am right (or wrong).

This would probably change if I had friends who could recount their experiences or provide first hand information.

Re:"though it is unclear when he left"

[Anonymous Coward]

Because he is the villain. No shit.

Re:"though it is unclear when he left"

[Auroch]

Depends on the objective. If the objective is to capture and control ground, then you need troops. If the objective is to simply obliterate an enemy, then you don't.

...The old war of obliteration isn't politically feasable any more though

so ... you do need troops? Or you don't? Or ... if you could blow everything up, you wouldn't, but you can't blow everything up, so you do, so it doesn't REALLY depend, since you can't really choose your objective.

Re:"though it is unclear when he left"

[cyberchondriac]

I'm sure the Iranian government is outraged as his defection, and not secretly holding him in an north korean off-shore detainment centre.

There's a Q'urantanamo? ;)

Re:"though it is unclear when he left"

[Anonymous Coward]

Its best if we just backed the fuck out of there and let nature take its course. When was the last time someone wanted to invade Switzerland?

If only it worked like that. Despite the numbers of Christian immigrants to the EU substantially outweighing the number of Muslim immigrants, Anders Behring Breivik is currently facing trial in Norway for the murders of 77 people (largely members and associates of a political party favouring multiculturalism) in an attempt to defend against a Muslim invasion of Europe. If militant xenophobes aren't actually being attacked by people who aren't like them, they will feign an offence to instigate it.

My point is an anti-NATO army of highly-trained brown people coming to steal your women and burn your churches doesn't have to exist for people to think it does and expect a counter-attack.

Re:"though it is unclear when he left"

[sudonymous]

The world needs a villian now and then. It keeps people on their toes.

Re:"though it is unclear when he left"

[tjbp]

Its best if we just backed the fuck out of there and let nature take its course. When was the last time someone wanted to invade Switzerland?

If only it worked like that. Despite the numbers of Christian immigrants to the EU substantially outweighing the number of Muslim immigrants, Anders Behring Breivik is currently facing trial in Norway for the murders of 77 people (largely members and associates of a political party favouring multiculturalism) in an attempt to defend against a Muslim invasion of Europe. If militant xenophobes aren't actually being attacked by people who aren't like them, they will feign an offence to instigate it.

My point is an anti-NATO army of highly-trained brown people coming to steal your women and burn your churches doesn't have to exist for people to think it's attacking them.

Re:"though it is unclear when he left"

[sudonymous]

This IS Iran that we're talking about. If they did, in fact, have the guy, why would they keep that a secret? They probably wouldn't hesitate to hold a public trial and execution.

Re:"though it is unclear when he left"

[OhSoLaMeow]

I might trust a /.-er's opinion on what's a good IDE, but a good representative in Congress or a stance on public policy? I'll rely on comedians for that.

Re:"though it is unclear when he left"

[Anonymous Coward]

Iran is a rich Muslim theocracy with some attibutes of a Republic. North Korea is a poverty-stricken pseudo-monarchy with attributes of Stalinism. They are about as likely to be on the speaking terms with each other as Henry Kissinger with Alexander Chikatilo.

How did that stop from Bush making a connection between Iraq and al-Qaeda?

http://en.wikipedia.org/wiki/Iraq_and_Al_Qaeda

But hey, if Nazis won the war it would probably be that Poles invaded Germany and it was Germany that was defending itself.

http://en.wikipedia.org/wiki/Operation_Himmler

Re:"though it is unclear when he left"

[SuricouRaven]

Depends who'se doing the attacking. If it's a country that cares about maintaining good international relations, like the US or any country in Europe, then you need troops. If, however, you couldn't care less about how the world sees you, then you can start the indiscriminate bombing of civilian targets or even break out the nuclear bombs. Currently the only countries in the latter class, like North Korea, are run by people who know full well that if they started a war they would lose it.

Re:"though it is unclear when he left"

[Anonymous Coward]

Oh really?

http://www.haaretz.com/news/middle-east/iranian-nuclear-scientists-were-present-at-failed-north-korean-missile-launch-says-source-1.424585

granted, it's haaretz which is probably not the most neutral news source here - though they certainly would have some interest in finding out such a connection should it exist.

Re:"though it is unclear when he left"

[Alex Belits]

I am sure, American, Russian, Japanese, Chinese and South Korean scientists were looking at that launch, too.

Re:"though it is unclear when he left"

[228e2]

Sorry, that is incorrect. And I currently do work supporting the war in Afghanistan which I just came back from in '11, so this is the experience I am talking from.

Take the two wars the US is currently involved in. The war on "terror" and supporting S Korea which is technically still at war with N Korea. Yes, both still involve boots-on-ground action, but everything you mentioned is in the past. Which is correct. But is the old ways of fighting wars. My statement of "anymore" means the bulk of the pushing, seek and destroy missions aren't done with boots on ground. Count up the cause from causalities of troop fighting and drone killings and you'll see the difference I am talking about.

most common PINs

[supersteve1440]

I wonder what the most common PINs were.
Related: http://amitay.us/blog/files/most_common_iphone_passcodes.php

Re:most common PINs

[methamorph]

People don't usually change PIN's so I would expect there are no "common" PIN's in the list. It's a number that comes with the card and you just use it.

Re:most common PINs

[wmbetts]

At all the banks in the US I've used they make me set the PIN when I get the card.

Re:most common PINs

[gnapster]

All the American and British banks I've used send me a PIN in the mail, mailed seperately from the card. They allow me to change the PIN if I choose. (In the UK, you can change the PIN at an ATM.)

Re:most common PINs

[wmbetts]

Interesting, this might be a new practice then? It's been about a year since I've opened an account. If it's not new maybe it's unique to the few banks I've used.

What a great guy

[l0ungeb0y]

And we wonder why the general public has a sense of distrust and suspicion regarding "hackers".
Iran should be groveling before Allah that it's not the 40's and he wasn't trying to warn them about nukes.

Re:What a great guy

[deek]

Not quite as much distrust and suspicion as they have regarding "bankers".

Re:What a great guy

[Gaygirlie]

And we wonder why the general public has a sense of distrust and suspicion regarding "hackers".

"When the affected banks, including the largest state institutions didn't respond" is the part that worries me, instead. The hacker in this case was just trying to help and pointed out a REALLY bad security flaw, but since the general public didn't know about it the institutions apparently decided to just ignore it. Publishing all the details was a bad move, that I definitely agree with, but atleast it got the institutions' attention, too bad that this will be spun in the media as the hacker's fault and not the institutions' fault, though.

Re:What a great guy

[Anonymous Coward]

> Not quite as much distrust and suspicion as they have regarding "bankers".

thank you. couldn't have said it better myself.

Re:What a great guy

[Nyder]

And we wonder why the general public has a sense of distrust and suspicion regarding "hackers".

"When the affected banks, including the largest state institutions didn't respond" is the part that worries me, instead. The hacker in this case was just trying to help and pointed out a REALLY bad security flaw, but since the general public didn't know about it the institutions apparently decided to just ignore it. Publishing all the details was a bad move, that I definitely agree with, but atleast it got the institutions' attention, too bad that this will be spun in the media as the hacker's fault and not the institutions' fault, though.

hmm, you think it's a bad move. So what you are saying is, if the public doesn't know about it, it's good security? You do realize that if the dude who warned them found it, anyone could of found it. So while the public may not know about it, criminals might. So, in my view, the hacker did good, because the people in charge weren't listening, so it made them listen.

I don't know what world you live in, but in this world, there isn't only 1 smart person, there is many. When 1 person finds a flaw, you should figure that other people have found the flaw. And someone is going to exploit the flaw to steal something, because that is how the world rolls.

Re:What a great guy

[gstrickler]

I don't know about the OP reasoning, but in my opinion, publishing full details including full card numbers and pin codes was a bad idea. Publish enough to demonstrate that you do in fact have the data, but not enough to make it trivial for someone to use the data. Partial card number, enough that the cardholder can be reasonably certain that's his card and the last 2-3 digits of the pin. It's one thing to go public and embarrass the banks, it's another to expose 3M customers to fraud and abuse by making it easy for the crooks.

Re:What a great guy

[Fluffeh]

So, in my view, the hacker did good, because the people in charge weren't listening, so it made them listen.

I think you missed the point. He didn't "make them listen". The banks haven't fixed the security problem. All they have done is asked their customers to change their PIN as well as blocking some ATMs.

So, no, this isn't a good move, because all it has done is caused three million card users to be further annoyed as their cards are still no safer than before - in fact less so, because there is a proof of concept out there now with guaranteed ROI - they can't get to their own cash as easily as they have to go around changing PINs and if there is a deluge of crookery going on, the banks are now going to say "Ha! We TOLD you to change your numbers!"

What he should have done is gone to the credit agencies like Visa and Mastercard who would likely cut off the banks accounts in very quick order, thereby forcing the banks to fix the security hole. Even though a debit visa isn't touching the bank's money, the big credit companies take these things rather seriously if it has their name on it.

Re:What a great guy

[jamesbrx]

So, in my view, the hacker did good, because the people in charge weren't listening, so it made them listen.

I think you missed the point. He didn't "make them listen". The banks haven't fixed the security problem. All they have done is asked their customers to change their PIN as well as blocking some ATMs.

How do you know this? Are you in Iran and working for the banks? Even the article notes that they might have silently fixed, or are in the process of fixing them. Most of the ATM's have stopped giving out money. I think that clearly shows they are working on it. Or do you think they will just close it all down and never start working again?

Re:What a great guy

[jamesbrx]

Oh and for

What he should have done is gone to the credit agencies like Visa and Mastercard who would likely cut off the banks accounts in very quick order, thereby forcing the banks to fix the security hole. Even though a debit visa isn't touching the bank's money, the big credit companies take these things rather seriously if it has their name on it.

These aren't Visa or Mastercard issued cards, but Iran's own. The stupidity in your post, oh my god.

Re:What a great guy

[RagingMaxx]

I know it's standard practice on /. not to RTFA, but it even says in the first sentence of the summary that this guy demonstrated the legitimacy of his findings with 1,000 captured accounts.

Yes, he exposed sensitive data. Data that was already exposed by this vulnerability. Now at least everyone knows that their data isn't safe, as opposed to before when there was an illusion of security.

Re:What a great guy

[Tastecicles]

Security through obscurity? Seriously bad idea when it comes to dealing with other peoples' money. You just don't know who is the wrong person to piss off, until their card details (and their PIN!?) are published...

Re:What a great guy

[crutchy]

not that i think the banks were innocent for a second, but the whole point of security is to prevent what this guy did, so he has gone beyond simply demonstrating a flaw. he's taken advantage of it in the same way as any criminal might. he may not personally empty the accounts, but he may as well have by publishing the means to access them.

yes the vulnerability already existed, but he merely took advantage of it like a criminal that security is intended to combat.

Now at least everyone knows that their data isn't safe, as opposed to before when there was an illusion of security

would you similarly argue that terrorists flying jet airliners into the WTC was a legitimate means to expose flaws in US intelligence?

would you light your house on fire to test your smoke alarm?

testing IT security by engaging in what it was designed to prevent is classic black hat behavior

Re:What a great guy

[Gaygirlie]

So what you are saying is, if the public doesn't know about it, it's good security?

No, I clearly said the institutions in question think so. I do not have any idea how you missed that.

You do realize that if the dude who warned them found it, anyone could of found it.

Yes, but then again, I never claimed anything in the contrary. I am merely saying that he could've published only a handful of details like e.g. the name and address of the person holding the card, the beginning and the end of the card number and 2 of the PIN digits. That would've been enough, that would've proved beyond doubt that there is a very serious security flaw that needs to be fixed, and with missing numbers the PIN+card number would have not been that useful for criminals, thereby making him seem less bad and drawing more attention towards the institutions. As it is these institutions will undoubtedly spin all the negative press towards the hacker in question and away from themselves, simply because he made himself an easy target.

Re:What a great guy

[Gaygirlie]

Do note that he only presented those account details to these institutions in question, he didn't publish them anywhere. He could have done that instead, he didn't need to publish all 3 million just to prove the flaw exists.

Re:What a great guy

[Nidi62]

Publishing all the details was a bad move, that I definitely agree with, but atleast it got the institutions' attention, too bad that this will be spun in the media as a plot by Israel and the West to destabilize Iran's economy and not the institutions' fault, though.

FTFY, at least if you get your news from Fars.

Re:What a great guy

[gstrickler]

I know it's standard practice on slashdot to misunderstand what is written, so, from RTFA:

...providing affected institutions the details, including 1,000 captured bank accounts.

Proving it to the institutions, and embarrassing them by disclosing it publicly are not the same thing. His public disclosure included too much information.

Re:What a great guy

[sudonymous]

His public disclosure would have never occurred if the banks had moved on his first warning.

He gave them a warning shot over their heads, they ignored it, and now you're getting all pissy because his next shot hit a leg. How many more warning shots should he have given them? Should he have just given up and said "ah, nobody else will ever find this vulnerability, so I guess it's not worth the trouble"?

Re:What a great guy

[gstrickler]

Comprehension fail!

I never said he shouldn't have disclosed publicly, I said he exposed too much information. There was no need to expose full account information, card number, and pin. He only needed to disclose enough to demonstrate that he did in fact possess the information, therefore, the vulnerability was real, and that the banks were ignoring it.

Full disclosure doesn't mean disclosing everyone's information thus making it easier for the crooks. You can do full disclosure in a more responsible fashion. He did not.

sigh.

[Anonymous Coward]

the fuck did he use his real name for?

Doesn't matter

[Anonymous Coward]

Since Iranian banks have been cut off from the rest of the world this is sort of pointless from an international theft point.

Re:Doesn't matter

[dbreeze]

crap. I just can't get a break.......

Re:Doesn't matter

[gnapster]

Mod parent up. This is the first thing I thought of, and is relevant.

Let a lesson be

[cosm]

Let a lesson from this be that no matter where you are on the globe managerial types will typically disregard known and reported vulnerabilities until it is too late, generally failing to assess risk properly and address reported findings.

Karma whoring, dude's blog linked here (yay for in browser translation)

Re:Let a lesson be

[Stiletto]

The message probably never had a chance to get to someone who could do something about it. Not everyone moves at Internut speed...

Re:"Zarefarid is reportedly no longer in Iran, tho

[jamesbrx]

Interestingly, more than likely this is a joint operation between the United States and Israel. They have tried to get Iran trade embargoed for a long time, and more than likely are pissed off that Iran has developed their own technology to process payments and POS transactions. It is similar to USA's actions with North Korea, just that Iran is even more developed country. Both Israel and USA have been extremely aggressive towards Iran, despite the fact that I see no such aggression coming from them. I just think it's interesting.

What a hack job of reporting!

[masouds]

Points of fact:
1) He didn't hack any banks. He was working in a payment processing company that had monopoly in Iran.
2) The card numbers and pin numbers were kept in clear text in their internal systems
3) He did complain about it repeatedly to his bosses, who blew him off
4) He posted the pin numbers and account numbers to a blog. Pin numbers have some digits before and after; They are not quite usable in person. In order to use them online a second pin is required which was not posted.
5) the Payment processing center's license has been revoked, and all people are in panic trying to change their pin numbers. The only action all ATMs allow is pin change.

Re:What a hack job of reporting!

[Anonymous Coward]

Sometimes it's hard for the rest of the world to follow american vernacular. is "his bosses, who blew him off" related in any way to the retort "blow me". If so what kind of bosses do they have in iranian banks? Are they often on their knees?

Re:What a hack job of reporting!

[Anonymous Coward]

AC, bringing you the lamest of all tryhard jokes daily.

Re:What a hack job of reporting!

[Anonymous Coward]

Not true. With so many numbers it's no problem to perform frauds using it, calculate or extract other numbers like missing PINs. Don't forget these might even be still using 56bit DES encryption for calculating security codes and PIN offsets. Before they will secure it, there will be thousands of frauds.
He thought it's safe to do so, so he will learn that it wasn't, it was massive and will cause huge losses. He wasn't that smart as he thought.

Re:What a hack job of reporting!

[Midnight Thunder]

Indeed. If your boss won't listen escalate until someone will. Also try to explain things in terms they will understand, like case history.

Re:What a hack job of reporting!

[olau]

True, he should have posted his boss's pin number only.

Re:What a hack job of reporting!

[helix2301]

This is an example of ethical hacking going to far and where white hat meets black hat. He wanted to prove a point and did he now he has to be on the run.

Re:What a hack job of reporting!

[Anonymous Coward]

4) He posted the pin numbers and account numbers to a blog. Pin numbers have some digits before and after; They are not quite usable in person. In order to use them online a second pin is required which was not posted.

Shh! Don't let the managers know, they'll say there is no problem then.

Financial security through obscurity?

[acidradio]

Just when I thought Iran was the safest place to stash my money now THIS happens? Where should I go next? Somalia?

Re:Financial security through obscurity?

[Black Parrot]

Just when I thought Iran was the safest place to stash my money now THIS happens? Where should I go next? Somalia?

I put all mine in the Bank of Atlantis.

At least I don't have to worry about someone else getting it.

Re:Financial security through obscurity?

[sempir]

Just when I thought Iran was the safest place to stash my money now THIS happens? Where should I go next? Somalia?

No!!!No, No, No!

Nigeria is the country where your money is safest. Here's what you do: Send the money to me personally and I will place it with all the other money I have for distribution on behalf of "Lotto"winners", "Deceased Estate Distribution A/C's" etc, you money is safe with me as I am a very honourable person, do this quickly before someone tries to cheat you out of all your money!
Honourably
Mr Sempir
Reliable Banking Services

Re:Financial security through obscurity?

[arglebargle_xiv]

Just when I thought Iran was the safest place to stash my money now THIS happens? Where should I go next? Somalia?

I put all mine in the Bank of Atlantis. At least I don't have to worry about someone else getting it.

I used to do that too, and then one day they told me they'd lost it all. Some nonsense about "water damage".

Re:Financial security through obscurity?

[dhaen]

Just when I thought Iran was the safest place to stash my money now THIS happens? Where should I go next? Somalia?

Nigeria seems to be able handle a lot of cash...

Proof that the term ...

[Skapare]

... "stupid bank" is redundant.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Mashiki]

...despite the fact that I see no such aggression coming from them. I just think it's interesting.

Yeah and arming hizbullah, hamas and having their fingers deep in both groups along with previously arming the PLO is 'no aggressive action' right.. Oh wait, let me guess the Jews control both groups.

Whoohoo!

[Anonymous Coward]

Weee! I gots teh Iranian bank account numbers. Gonna order so much shit on eBay wid dat. Wadat? Frozen? Gitmo??? Terrorist, WTF... NO CARRIER.

A new nominee...

[Anonymous Coward]

I think we have a nominee for "The biggest cojones of 2012" right here...

Um ... Is This Even An Accurate Story?

[DakotaSmith]

Three million accounts intrigue me, so naturally I went looking for the posted list.

I can't find it. I find endless references to the story, but no list. I can't find Zarefarid's blog. This strikes me as odd, since the list was supposedly publicly posted there. Usually by this time, there are downloaded copies on all the file-sharing services, torrents, etc. There's nothing.

Knowing as I do that the majority of stories on which the press reports are wildly sensationalized or at worst entirely fictional, the lack of a list makes me think this may fall in the latter category.

Re:Um ... Is This Even An Accurate Story?

[Cruorin]

http://ircard.blogspot.com/ Click older about ten times, he posted them in plaintext without text wrapping, once you click one of the links. The reason this isn't all over the net is because it is useless to anyone not in Iran.

Much good it'll do you.

[multicoregeneral]

Even if they are real, Iran was booted out of the swift system a couple of weeks ago. They can't transfer money anywhere.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Thanshin]

... it is unclear when he left." Yeah...

I also interpreted that as "it's unclear where they left the corpse" until I remembered he had thousands of numbers/pins.

It's not so hard to move around when you've got a huge lot of money and know how to use the internet properly.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

Oh wait, let me guess the Jews control both groups.

Clever, trying to win by portraying your adversary as a conspiracy nut even though he never blamed the "Global Jewish Conspiracy" for anything. He did mention Israel, but even some Jews are against the existence of the Zionist state (at the present) so you shouldn't assume he's blaming every single Jew (just like one shouldn't blame every single Christian for the US attacks on Iran and mostly everywhere else).

Hacker?

[Anonymous Coward]

He didn't hack into the system. He just stole some information from the company he was working at, Eniac (eniac-psp.net) and put it on the Internet, because he couldn't make money out of it. He blackmailed the bankers to get 1$ for every of the 3 million accounts, and they refused to pay the money.
Now, he's claiming to be a hacker!

Re:"Zarefarid is reportedly no longer in Iran, tho

[gl4ss]

http://www.nytimes.com/2011/10/12/us/us-accuses-iranians-of-plotting-to-kill-saudi-envoy.html?_r=1&pagewanted=all

iran plays the game too, although not too well(and they're amateurs - remember the regime doesn't have that long history and when they came to power they pretty much got rid of everyone working with international relations and operations who had any experience - making their plots like bad b-movies like trying to hire zetas or selling guns to some african rebel). mostly iran is pre-occupied with dealing with their domestic dissidents, throwing people to jail for porno and trying to make foreign export ends meet by any means their amateurs can think of and generally just being petty denialists. remember, as far as reports go and one outside the country can figure out most of the bomb attacks within iran have been actually carried out by iranian factions working toward overthrowing their petty government.

so, historically - what little there is of it - irans current regime has been quite aggressive both internationally and domestically, carrying out murders and attempts at them. what sets them apart from libya is that they're not so poor and they have more people and not just desert.

pissed off at a POS system? fuck, no, that's not the reason behind this hack, the reason is that it was hackable and they didn't fix it, they had time to fix it - but this guy did wise when he got out of the country because irans government has a history of outright killing guys like him.

Re:"Zarefarid is reportedly no longer in Iran, tho

[LittleImp]

He only believes Iran is a peaceful paradise that the capitalist west is trying to bring down.

Pay peanuts get monkeys

[barv]

The nerd told them they had a security problem and they did nothing.

Conclusion. So their software people were incompetent.

Inference. The theocracy are not buying the best. Probably only hiring "theologically safe" programmers.

Re:"Zarefarid is reportedly no longer in Iran, tho

[mwvdlee]

All he was trying to do was to protect the banks from somebody doing exactly what he did himself.

Re:"Zarefarid is reportedly no longer in Iran, tho

[MrNaz]

Do you have any evidence to the contrary*? There's plenty of evidence supporting that proposition.

Just sayin'.

* Deliberately mistranslated speech outtakes and vague references to financial support to terrorist groups doesn't count as "evidence" unless you're a moron.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

UN needs to take control over Israel/Palestine. The geographical area is too important to too many groups of Humans to give it to one group. This way if anyone messes with the area, including Israelis and Palestinians, they can be dealt with by the international community. As it is now, their personal disputes are constantly falling on the rest of the world. How could a Jewish homeland in Arabia be a good idea? Three major religions call that area important. Not to mention archaeologists who might want free roam.

There can't be unchecked sympathy for Israel. While it would be nice for everyone on Earth to have a nation, you can kind of understand how things are unraveling in the middle east. If the United States was taken over by Russia/China, and the US was given to North Korea, I'd haunt them until the day I died. Nothing to do with being friendly or not, but everything to do with me being greatly wronged and needing to make things correct, at any cost. Not only was someone else's land given to Israel, but Israel discriminates against those people! Very poor choice in behavior.

Re:"Zarefarid is reportedly no longer in Iran, tho

[schwit1]

Let the UN control? The same organization that put Cuba, Egypt, Russia, Saudi Arabia, China and Sudan on its human rights panel?

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

You do realize that the list of terrorists groups supported by the US makes your comment ridiculous, right? And Hamas is primarily supported by Saudi Arabia.... you know, US 'allies'.

Yup, terrorism is acceptable when it's done by your team. Fucking hypocrite.

White Hat Meets Black Hat

[lipanitech]

This guy wanted to prove a point & he sure did now he is on the run. Example of White Hat hacker taking it to far.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

And the US !!

I know ... go figure !!

can i haz the logix?

[luis_a_espinal]

Nobody's making him out to be a hero, but tossing all the blame on him is a cop out. "Poor helpless banks were victimized by no good hacker"... that misses the entire point, which should be that security needs to be fixed.

I'm not sure how you logically derived that line above that you wrote from what the other AC posted (and which you were replying to):

Sorry, the banks are negligent and should be hauled over coals for this, but that makes him the fucking villain of it.

Re:"Zarefarid is reportedly no longer in Iran, tho

[dave420]

I take it you don't know what the human rights panel is there for, and why those countries were on it? That's the only possible reason for your mistaken thinking they're there to advise on how best to provide human rights, not on how best to fix the fucked-up shit happening in their countries. Get a grip - I know it's fun to have a go at the UN, but at least make the attempt to understand it before having a go. That way you can bring up legitimate issues with the UN, instead of childishly laughing at what you perceive to be incredible irony, which is actually anything but.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

The geographical area is too important...

I call your backside to be too important to be controlled by you. Please cede the control of your backside to the international community NOW!

Re:"Zarefarid is reportedly no longer in Iran, tho

[V for Vendetta]

Let the UN control? The same organization that put Cuba, Egypt, Russia, Saudi Arabia, China and Sudan on its human rights panel?

You forgot to name the members of that organisation, which has put those countries there. Those are (in no particular order) France, Vietnam, Germany, India, U.S.A., South Africa ... etc. etc.

You know, it's called United Nations for a reason.

So, what was your complaint again?

Re:"Zarefarid is reportedly no longer in Iran, tho

[NonUniqueNickname]

Fantastic idea! Let the UN solve it! Wait, what? They already did? 65 years ago? http://en.wikipedia.org/wiki/United_Nations_Partition_Plan_for_Palestine
Well, damn those Israelis for pissing on the UN and rejecting the Partition Plan and waging war on innoc... Wait, what? The Israelis agreed to the Partition Plan? It was actually the Arabs who rejected it and started the war?
Well, of course the Arabs rejected the Partition Plan! It was an unfair plan that deprives the Palestinian People of their rightful lands and... Wait, what? The Partition Plan would have created a Palastinian State that's larger than the current Palastinian claims for statehood? Palestinian president Mahmoud Abbas said having rejected the Partition Plan was a mistake he plans to fix?

Re:"Zarefarid is reportedly no longer in Iran, tho

[Ihmhi]

Yeah and arming hizbullah, hamas and having their fingers deep in both groups along with previously arming the PLO is 'no aggressive action' right.. Oh wait, let me guess the Jews control both groups.

Right, it's not like we ever did shit like give the Mujahedin weapons like stinger missiles. We never gave fucking crates full of guns to South American dictators and/or revolutionaries. We never trained people to invade Cuba. We never started something on the order of half a dozen illegal wars in the last 60 years.

Stop fucking talking like America is a shining beacon of justice and freedom, because we are just as shitty as nearly every other goddamned country in the fucking world. We just have better marketing.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Ihmhi]

Well, we do have an excellent track record when it comes to human rights.

Re:"Zarefarid is reportedly no longer in Iran, tho

[painandgreed]

I take it you don't know what the human rights panel is there for, and why those countries were on it?

You do know why the UN is there for and why all countries are supposed to be a part of it? It's set up to be a soap box forum for countries to talk, not as a world government used to control things. I think that is what the parent was getting at. The UN is there so countries and get together, talk about Palestine and perhaps come up with a plan between themselves that originates in the UN, not as an organization to hand stuff over to.

Re:"Zarefarid is reportedly no longer in Iran, tho

[shutdown -p now]

Do you have any evidence to the contrary*? There's plenty of evidence supporting that proposition.

Which proposition - that Iran is a "peaceful paradise"?

That doesn't stand to even a cursory examination of the Iranian political system - it's not like they hide the fact that it's based on the (inherently undemocratic) principle of velayat e-faqih - essentially, a theocracy. Or how about death penalty prescribed for homosexuality, or stoning to death for adultery?

I'm gonna go with...

[DarthVain]

BEFORE he "dropped these details — including card numbers and PINs — on his blog".

Re:"Zarefarid is reportedly no longer in Iran, tho

[Mashiki]

Hamas is primarily funded by...
TURKEY!

Hizbullah by Venezuela.

Not Saudi Arabia, google. Use it, I know ignorance is a great excuse but don't be an idiot. As for 'my team' I'm not american.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Mashiki]

Well that's an american problem, then again you only need to understand the context of those situations too. But I'm sure you don't think that hamas or hizbullah who both agree that slaughtering all civilians and driving the jews are just lies and propaganda despite that their leadership and in some cases their charters have this spelled right out. The only person that thinks America is a shining beacon are the ones that like to gloss the truth. Then again, the majority of people don't realize that the world is a mighty dark and evil place at times too. Then again, some people have no problems supporting groups like hamas and hizbullah who target civilians because they are civilians.

Ignorance is not an excuse. I'm sure you'll claim I'm american next, but don't worry I'm not.

Re:"Zarefarid is reportedly no longer in Iran, tho

[MrNaz]

I don't see how simply being a theocracy automatically makes it "better", and death penalty for adultery and stoning may seem grotesque to a Western mind, but to a society that accepts and considers that to be just, well, that's their choice. Having spoken to Iranians, they don't have a problem with either punishment, as they consider those "crimes" to be undermining of the social fabric.

Don't even attempt to claim the moral high ground when it comes to justice as delivered from the state. Modern legal systems are no better (arguably worse) than the systems that went before them. Theyshoot people with no cause, blatantly imprison people for no valid reason and deliberately frames its own people for military ends. Not to mention such famous institutions as Guantanamo and those black op torture programs carried out by the CIA.

But wait, we have democracy I hear you say? If you call the circus that is the two party system "democracy", then I'm a flee on a baboon's arse. There's no meaningful difference between the parties, and on those occasions where they promise to fix the mistakes of the previous administration ("I'll close Guantanamo" said Barak), if the people actually give them the chance to carry out the promise, they simply renege when the time comes.

I think it's time the so-called "Free World" got off its moral high horse and recognised that it is no better than the barbaric hordes it's fighting against. Indeed, when viewed from the Other Side, we're the barbaric hordes.

Re:"Zarefarid is reportedly no longer in Iran, tho

[shutdown -p now]

I'm not particularly fond of moral relativism. Yes, I do believe that Western countries being democratic and secular and having due process of law and all these things - even if they don't always work 100%, and the implementation is imperfect - makes them better than Iran. Sure, it's my subjective assessment, but I'll stand by it - and so do most other Westerners. I claim moral high ground by my measures and the measures of my society, because there's no higher authority.

Re:"Zarefarid is reportedly no longer in Iran, tho

[MrNaz]

Then you are bound to acknowledge that THEY claim the high ground by THEIR measures and THEIR society.

Given this difference, it remains to be asked who the agressor is in waging war to impose external standards upon whom.

Re:"Zarefarid is reportedly no longer in Iran, tho

[shutdown -p now]

Then you are bound to acknowledge that THEY claim the high ground by THEIR measures and THEIR society.

I do acknowledge that; but, obviously, as far as I'm concerned, their high ground is not as high as mine - which is what matters when it comes to guiding my actions.

Re:"Zarefarid is reportedly no longer in Iran, tho

[chrb]

Well, of course the Arabs rejected the Partition Plan! It was an unfair plan that deprives the Palestinian People of their rightful lands and...

"Arabs have always reiterated that it was rejected because it was unfair: it gave the majority of the land (56 percent) to the Jews, who at that stage legally owned only 7 percent of it,[41] and remained a minority of the population."

From the very Wikipedia article you link to. Would you agree to a plan that gives 56% of your country's land to an ethnic minority that currently owns only 7%? Why?

Wait, what? The Partition Plan would have created a Palastinian State that's larger than the current Palastinian claims for statehood?

You are criticising Palestinians in 2012 for accepting that they already lost the majority of the land, and negotiating based on what they have left now?

Re:"Zarefarid is reportedly no longer in Iran, tho

[chrb]

then again you only need to understand the context of those situations too.

It's odd that we need to understand the context when it comes to Western support for "terrorists", but when it comes to non-Western governments supporting "terrorism", then the context isn't important...

Re:"Zarefarid is reportedly no longer in Iran, tho

[NemoinSpace]

Having spoken to Iranians, they don't have a problem with either punishment,

I'm assuming you haven't spoken to the dead or stoned ones...
I'll stay out of the rest of the argument.

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

did you speak to the people throwing or, er, catching the rocks?

Re:"Zarefarid is reportedly no longer in Iran, tho

[Anonymous Coward]

Ordinarily, I'd support your statement. In this instance I can't, for fear of being taken out of context.

Re:"Zarefarid is reportedly no longer in Iran, tho

[MrNaz]

Ok, so then what are your actions? Youre saying that you can use your judgement to justify foreign aggression? If so, then you can't begrudge them the right to fight back. If not, then you're bound to admit the injustice of your own nation's policy.
Your line of reasoning highlights the problem with public perceptions and why they can so easily be manipulated.

Re:"Zarefarid is reportedly no longer in Iran, tho

[shutdown -p now]

I don't believe that direct military aggression against Iran is warranted at this point. There are plenty worse countries in the world, after all, even in that same region. I just don't see the point in extolling them as some kind of paradise because they're so anti-Western and all. Most things about the modern Western world are good, not bad. Some that are bad, are even worse in Iran (and China etc).

Re:"Zarefarid is reportedly no longer in Iran, tho

[NonUniqueNickname]

Yes, I would have accepted the plan. I'm also going to go out on a limb and say that had Palestinian leadership at the time had been free to act in the best interests of the Palestinians, they would have accepted too. But, they were not free to act. They were subject to a lot of pressure from Arab nations, and by many accounts weren't even seriously considering statehood but just looking to be absorbed by neighboring states.
When you say 56% land for 7% of the population it sure sounds bad. However, a huge chuck (almost half?) of the land designated for Jews is south of Beer-Sheba: Desertic, uninhabitable at the time and in fact very sparsely populated even to this day. As to population, Palestinians were not expecting any significant immigration, most of them were already established there. Whereas many more Jews were expected to arrive shortly. So 56% and 7% are meaningless numbers, even though technically correct. The only fairness to be contended here is the principle, is it fair for Palestinians to have to share the lands on which they are living with the people who were forcibly removed from those lands some 2000 years ago.
To clarify, I'm not criticizing Palestinians then or now. Just saying a solution (specifically a UN solution, as suggested by GP) can't be forced upon unwilling sides. Back then the Arabs were unwilling. Since '67 there's been plenty of unwillingness on the Israeli side. The road to peace is direct negotiations.

Re:"Zarefarid is reportedly no longer in Iran, tho

[DrStoooopid]

The United Nations is a farce and not a real form of world government. It's just a "country" club that sit around and say "good job" to some, and say "Don't do that, or we'll say don't do that, again".

No, I would never support things being controlled by the UN.