Web Based Turbo Tax Disclosure Vulnerability Found 110
Anonymous MPLS Coward writes "Looks like the web-based Turbo Tax was allowing some users to look at other user's tax return information. Reports state that things like bank routing information was available as well as SSNs. Turbo Tax software was unaffected; the bug is in the web-based Turbo Tax service."
Penalty for the developers (Score:5, Insightful)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Two companies that I won't buy from
Intuit - adding malware to tax software - I'd be annoyed if a game did this, but having financial software do this crosses the line.
Iome
Re: (Score:2)
Re:Penalty for the developers (Score:5, Informative)
If you want American (Score:4, Informative)
I share the caution about Indian programmers. I just dropped checking and savings accounts with Ameriprise (formerly Amex Bank), because in the several years since they shipped the programming off to India they still haven't gotten their site to work reliably in its basic operations. Even before security is considered, the incompetence is amazing. Now I'm seeing a downgrading in the usability of CitiBank's Website, where there's also been extensive recent offshoring - they can't be bothered to test for obvious JavaScript bugs that block Mozilla, for example, even though previously they'd officially and effectively supported Mozilla/Netscape for years. (Hell, I do work for financial firms in NYC that don't even allow their own people to browse with IE.)
Re: (Score:2)
But I digress.
Re: (Score:2)
I get the impression that the woman wh
Re: (Score:1)
The fact is they are penalized.. Its just not as visible as the flogging in the street you seem to be calling for. They could be sued, and are going to loose business over this.
Re: (Score:2)
Exaggerated synopsis (Score:4, Informative)
Re:Exaggerated synopsis (Score:4, Insightful)
The original software authors probably already know most of them and are happily passing that information along to their friends in political office--or to their cohorts on IRC.
Re: (Score:2)
Re:Exaggerated synopsis (Score:4, Insightful)
Re: (Score:1)
Re: (Score:3, Insightful)
Well, it was in the wild. It was on their production website, accessible to the public. Any number of less well intentioned individuals could have taken advantage of the flaw before it was actually reported to Turbo Tax.
If it was in beta or development code, and the flaw was found internally, then it would be as you say.
Re: (Score:2)
The plain and simple fact is that this should have never happened. There should be *authentication* mechanisms in place to prevent logins from seeing any more than exactly their information. Anything beyond that is absurd and screams to be insulted.
In security its never a question of where or how far advanced a public/wild an exploit is, it's if the potential exists. Anything else is damage control, and that's what you're attempting to do.
Re: (Score:2)
Come on, in the restaurant business, for every one that complains, there are 10 that don't. 3 of the 10 never come back.
This is horrible on Intuit's part.
not fixed (Score:3, Informative)
Removing a link to a web page takes the "feature" away on the server...? Idiots.
Re: (Score:2)
What's unknown is how many people stumbled across the problem and did not report it.
I really like the web version of Turbo Tax, but things like this leave me very nervous.
Wearing Jackets with Bull's Eyes (Score:5, Insightful)
Now, factor in the fact that there is a smart blackhat community and this database is about the most delicious thing an high-tech organized-crime-sponsored identity thief can imagine - and sometimes it just doesn't make sense to walk around wearing a jacket with a bull's eye painted on the back, even if you're not a coward.
As far as not E-filing, it also costs the IRS more to process, so that at least helps to keep one more negative about the income tax on the board.
Re: (Score:3, Insightful)
yep, that's a pretty juicy target...a more juicy target would be the IRS's DB, which must be at least somewhat available online (think e-filing). Even if you don't e-file, your data is going to end up in a DB at some point, so don't feel too safe.
Re: (Score:2)
Yeah, I should have clarified in my post - with the TurboTax database, as I understand it, you don't have to do your entire return at one sitting, so you can come back to it. That makes perfect sense for the user. But it also means the data has to be retrievable from the website.
With the IRS, they can, in theory, have a gate in place that makes the E-file transactions one-way. Some TLA agencies us
Re: (Score:2)
yep, that would be a great way to help protect the database, but everything in front of that is still a single point of attack.
I'd imagine that the monitoring around those systems is massive, and the security/setup is top-notch...but as always, it just takes one mistake
Re: (Score:2)
We'd also think the FBI and FAA would have decent computer systems, but they're classic IT boondoggles. Let's hope the IRS does better. Heck, they ought to let the Post Office run their systems.
Or none if they get zero-day'ed. I'll second your
How good is IT at the IRS? (Score:2)
You'd think so, but what evidence we have doesn't confirm your optimism:
http://www.treas.gov/tigta/auditreports/2007report s/200720048fr.html [treas.gov]
http://www.fcw.com/article98135-04-03-07-Web&print Layout [fcw.com]
The first article covers unsecured taxpayer information on IRS laptops, a problem the audit agency raised in 2003 which has yet to be addressed fully by the IRS. The second discusses more general security issu
Re: (Score:3, Insightful)
Huh? You do realise that in the governmental mind "costs more to process" translates to "collect more taxes to cover it", not "maybe we should abolish income tax", right?
Re: (Score:2)
Yep, I'm talking about when the argument comes, not the change in my pocket today. If the IRS has no administrative overhead it'll be harder to topple. If it's very expensive it can be shown as an inefficient mechanism (and therefore unfair) for taxation.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Yup, I filed online for the first time this year (using TurboTax Online, sadl
Re: (Score:3, Insightful)
Ah, yes, the old we-don't-like-government-waste-so-we'll-add-some-m ore-voluntarily.
The security concerns about e-filing are real (which is why I don't do it either). But is it really likely that the government will stop collecting taxes just because it's more expensive than not collecting taxes? No -- the collection cost will just continue to be passed on to
Re: (Score:2)
I can't tell if you're misunderstanding or misrepresenting, but I'll try to be more clear:
When debating various forms of taxation, efficiency is a factor in determining appropriateness, fairness, and desirability.
Re: (Score:2)
I suspect "I refuse to take already existing measures to improve efficiency just to bolster my side" doesn't win you debate points.
Re: (Score:2)
That would be a conflict of interest. Fortunately, I'm not the one debating, just doing my part to bolster the side of the debate I favor.
Re: (Score:2)
My tax software is grey and squishy. (Score:1)
No! (Score:5, Funny)
Someone please fix this before someone finds out how to deposit money into my account!
Re:No! (Score:4, Informative)
* Date/time of original request
* "Teller ID" (I called them to ask how to do this and they gave me this bit of information)
* Member name
* Member number (this is embedded in the routing number for my savings account)
* Daytime phone
* Amount
* Information on who gets the money
* Signature
The only parts of this which could be used for authentication:
* The fact that I called
* My name
* My member number
* My phone number
* My signature
Given my tax forms, one could easily find my name and phone number, and if I had chosen the option to wire to or from my checking account, my member number as well. (This is why I would have sent a check, although that doesn't help particularly since the number is still written on the check. I got a refund, however, so they'll be sending me a check instead and I don't have to worry about that particular hole.)
Calling them is easily doable by someone who isn't me. My signature, as much as I hate to admit it, is awful and pretty easily forgeable.
So, in summary: the information on a tax return is a significant fraction of what is needed to withdraw money from someone else's account. It may not be enough. But it certainly helps.
Re: (Score:2)
Perhaps we're looking at this the wrong way (Score:5, Funny)
Re: (Score:1)
Re: (Score:2)
And if there's fraudulent information submitted, 50000 people spend 2 hours in jail.
Oh, swell! (Score:4, Funny)
NO CARRIER
Re: (Score:1)
Until... (Score:2)
Re: (Score:3, Insightful)
Re: (Score:2)
Where you're absolutely right is that we want to offer incentives for not covering things up and for sharing enough information to improve security in general. The aviation industry does this right: they publish accident reports, whereas Intuit is keeping quiet about what kind of vulnerability they had.
Re: (Score:1)
I'll never go near turbo tax again. (Score:3, Insightful)
So two years ago I was filing with turbo tax. I'd been using it for a couple years with no problems. My taxes are simple; no house, no kids, no tax shelter investments. Just a handful of numbers on a W2, to the point where I could just as easily fill out the forms by hand, but I liked the convenience. Now, I overpay by ten bucks every week. 40 bucks a month * 12 months = $480 per year that I should get back (based on my tax bracket at the time) no matter what. My average refund was usually a couple hundred over that, and had been for the years prior. I've cut the feds a check exactly once since I started working 12 years ago.
So what did I get when I used turbo tax that year? They had me paying an additional 280 bucks! I went over that return with a fine tooth comb. All my numbers were right, every box was checked, every i was dotted and t was crossed on my end, and the software was up to date, but Turbo Tax said I owed the feds money. I broke out the disaster recovery computer (also known as a pen & paper), and did my taxes by hand and by the book. Result? My usual refund of around 700 bucks. On a lark I tried Taxcut. Same result, $700-ish refund.
Tax software (at my level anyway) should be no more complicated than a freaking spreadsheet. If they can't get that right for me, I shudder to think what kind of screw ups they've had for people who have real returns to file. At least I got a good lesson in double checking someone else's math.
Re:I'll never go near turbo tax again. (Score:5, Insightful)
Based on the difference in taxes ($280 owed vs. $700 refund = net $980) and presuming a 28% marginal tax rate, the difference in taxable income was $980 / 0.28 = 3,500).
The personal exemption was $3,100 for tax year 2004. All you had to do was enter the personal exemption incorrectly (as in accidentally tell it you could were being claimed as a deduction on someone else's return), and you would have gotten the results you observed.
If your taxes were that simple, just looking at the generated 1040 (or 1040A) would have revealed whatever error (yours or theirs) that was occuring. So, I'm skeptical of your claim.
Re: (Score:2)
I called an accountant instead and ended up eating the cost of TurboTax.
Re: (Score:2)
I had the same problem a few years ago when I tried to import data downloaded from my brokerage. But, I knew to check it carefully, because I download transactions into Quicken throughout the year, and knew that they are often mis-classified by the brokerage (or perhaps the service they use to provide them for download). I carefully compared them to my year-end statement and corrected any errors. I
Paper wins again. (Score:2)
This is what I get.
Re: (Score:2)
The problem is everyone treats taxes like a lottery, they think if they let a "professional" do them they'll get some big windfall. Two flaws in this thinking:
This is nothing new (Score:4, Informative)
Re: (Score:1)
Re: (Score:1)
Check out Canada's security requirements (Score:1)
http://www.efile.cra.gc.ca/eol-security-e.html#co
The article didn't mention what sort of security rules are enforced in the US.
Does the IRS have similar rules to what we have in Canada?
Re: (Score:2)
As currently i
Here's a genius idea (Score:2)
Re: (Score:2, Informative)
Re: (Score:2, Informative)
Re: (Score:2)
Because one of the mantras of a Republican controlled US government (remember, that the Republicans controlled both the White House and Congress from 2001 until this January) is that private industry always does a better job. Another mantra, which also applies, is that the free market solves all ills. That's why Uncle Sam doesn't do what you suggest.
Re: (Score:2)
Because politicians get massive campaign contributions from the industry that provides software and services for tax processing, and generally believe in not biting the hand that feeds them lavishly, and because their is no public outcry for this that would offset the allure of the campaign cash. Politicians don't, mostly, lead even if they get called "leaders", they follow, and what they mostly follow is money, though a clear enough weight of
Not the first time this year! (Score:5, Interesting)
On January 6th this year I received an email from TurboTax Online with the subject
"TurboTax User ID Enclosed: Online Products Now Available!"
Problem being that - in addition to my UserID - it also contained two other (seemingly random) UserID including a live link to their login pages. I tried to be nice and alert them of their security problem but it was not easy. After hunting through the website for a feedback/support link I could only find an online chat with one of their support people. It took me close to an hour to tell her about the problem (it somehow didn't seem to fit into her questionnaire flow chart...) and she promised that she would pass the information on to the tech department and that they would get back to me (yeah, right!). I also asked her repeatedly to delete my account including all data and she said it couldn't be done and that I wouldn't have anything to worry about as the data would be safe on their servers - apparently not.
Guess I should have been a little more aggressive and tell some news outlet about the problem than thinking that their internal procedures and security audits would be sufficient without additional pressure. I decided after that email to never again use the online TurboTax version (I never actually filed from it before as it was a little too limited) and looks like I made a smart choice.
Web-based taxes (Score:1)
I tried a bunch of different sites; of course there's no excuse for a purely web-based
service to be incompatible, but of course they mostly are! In contrast,
I have had good experiences with Turbotax for the past couple years. And so far
the contents of my bank account haven't vanished
but that was because I spent all the money...
Any recommendations for full-featured tax services that work well on
firefo
H&R Block (Score:2, Informative)
news.com.com article [com.com]
Businessweek article [businessweek.com]
Re: (Score:2)
Bank routing information is public, isn't it? (Score:2)
In Germany many people put their bank routing information on their letter head, so that people can easily transfer money to them.
Re: (Score:2)
Does that count as evil?
Re: (Score:2)
Re: (Score:1)
1) Because the bank serves commercial interests. Consumers are not allowed to protect their accounts. That would raise the cost of extracting money from the account. My bank claims it's by law, but more likely it's just their policy so the won't annoy their corporate peers.
2) Authorization is now implied by writing a check or otherwise specified in terms of service (cell phone, cable TV, etc.).
If the bank is being defrauded I
Re: (Score:2)
As for it not being your problem, the burden of proof is on you to demonstrate that it was fraud. Good luck with that.
Re: (Score:2)
Re: (Score:2)
checks are inherently insecure
That's true. Technically, if you have a check from someone, you could clean out their account through electronic transfer. Heck, that's similar to what big credit card companies do now - when you send them a check in the mail, they EFT the money from your account, then destroy the paper check, so it must be possible.
If I were to ever pay for stuff with checks in person (I usually just use plastic), I wouldn't mind giving it to the cashier, for the same reason I don't mind giving them the plastic: the pa
Simple tax software (Score:1)
As for the web based tax preparation - I've never used it. I prefer to keep that kind of data behind my firewall and backed up on my CDRs...
I owe again this year... (Score:1)
If so I'm going to recomend Turbo Tax to all my friends!
And where should I have heard this from? (Score:1)
Avoidable risk. (Score:2)
It's true that the data is still vulnerable at
My 2 cents (Score:2, Insightful)
I've been using Turbotax over the past 5 months for roughly 600 hours and there's a few things I can say about the program. First and foremost, it's very rarely wrong.
Re: (Score:1)
TurboTax and Security (Score:1)
Re: (Score:2)
So Bob, could you clarify exactly what happened with this customer in Nebraska? You said that the vulnerability does not affect the TurboTax Online application, yet the user in Nebraska says she was able to access other people's returns using your online service, and one of your em
Re: (Score:1)
This was a single, isolated case of one customer gaining access to prior year tax returns of three customers. The sequence of events and keystrokes used by the customer to gain access were unusual and in an area of our web site rarely used. Since that time, that specific site was removed. This was NOT in any way related to our TurboTax Online application nor was access gained through TurboTax Online. Additionally, our investigatio
Re: (Score:1)
You really need more than three months to consider that sending out random login names to customers is not a good idea? (I don't object to receiving my own username but I have issues with the fact that my username is being sent to other users as well!)
Sorry, but that answer is simply ridiculous and does not provide confidence in your overall security practices as well as the claims of an isolated incident!
Re: (Score:1)
> 1. This was a single, isolated incident. There have been no other reports of this type, and our ongoing investigation has not >identified any other customers affected by this issue. This issue resulted from an accidental and extremely unusual path to access
>a prior year return.
Ideally, it wouldn't be up to your customers to detect and report flaws in your software. And the fact that "an unusual path" is required shouldn't offer an
Re: (Score:1)