How the Citibank hack worked

[thewayne]

Basically, Citibank is a bunch of morons. Apparently your credit card number appears in your browser's address bar, so they would type in another number and that account's information would come up.

So it sounds like they validated the account number once, then when the hackers changed the account number, it was never revalidated and Citi's system assumed all future page accesses were valid. VERY bad form when dealing with money.

It is not difficult to pass information back and forth through secure sessions. In fact, it's pretty darn fundamental. I don't understand why a megacorp like Citi couldn't properly implement something like that.

http://www.dailymail.co.uk/news/article-2003393/How-Citigroup-hackers-broke-door-using-banks-website.html

http://it.slashdot.org/story/11/06/14/2046216/How-Citigroup-Hackers-Easily-Gained-Access

Comments

[silveradept]

...I thought it was a tenet of security now that, wherever possible, you don't use important data in your URIs, or at the very least, you don't let your sessions wander around...

[thewayne.livejournal.com]

It is. It is a definite tenet. Obviously it doesn't apply to such an important megacorp as Citi.

[silveradept]

Clearly not. I have this sinking feeling that when people demand that Citigroup invest the capital that everyone has and is waiting for the "uncertainty" to go away, they'll shrug and say "Sorry. Hacked. Stolen." while their executives light up another cigar with a 100-dollar bill.