Thieves Found Citigroup Site An Easy Entry(nytimes.com)
nytimes.com
Thieves Found Citigroup Site An Easy Entry
http://www.nytimes.com/2011/06/14/technology/14security.html
5 comments
The article itself it just as bad.
...to breach security by focusing on the vulnerability in the browser
This sounds like the was a specific browser bug or is the address bar now a vulnerability?
“It would have been hard to prepare for this type of vulnerability,” Hard to prepare against people changing &acctno=1234567 to &acctno=1234568 ?
This sounds like the was a specific browser bug or is the address bar now a vulnerability?
“It would have been hard to prepare for this type of vulnerability,” Hard to prepare against people changing &acctno=1234567 to &acctno=1234568 ?
I write a porn site more secure than this... Not only that but the fact they blame the browser is absurd, they have some crazy incompetent web developers there.
What a stunning oversight. Relying on GET IDs to secure their customer financial data seems almost too amateur to believe. I imagine lawsuits are on the way.
If what the article says is actually true that simply changing account numbers in the URL allowed them to access other accounts, then I'm completely astounded.
Surely this is one of the first things a programmer learns. It's just basic security.
Surely this is one of the first things a programmer learns. It's just basic security.
Once logged in to [the site reserved for Citi's credit card customers], they leapfrogged between the accounts of different Citi customers by inserting vari-ous account numbers into a string of text located in the browser’s address bar.
The method is seemingly simple, but the fact that the thieves knew to focus on this particular vulnerability marks the Citigroup attack as especially ingenious, security experts said.
One security expert familiar with the investigation wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. “It would have been hard to prepare for this type of vulnerability,” he said. The security expert insisted on anonymity because the inquiry was at an early stage.