Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Security

How Citigroup Hackers Easily Gained Access 371

Endoflow2010 writes "Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique. It has been called 'one of the most brazen bank hacking attacks' in recent years. And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories. They simply logged on to the part of the group's site reserved for credit card customers and substituted their account numbers — which appeared in the browser's address bar — with other numbers. It allowed them to leapfrog into the accounts of other customers, with an automatic computer program letting them repeat the trick tens of thousands of times."
This discussion has been archived. No new comments can be posted.

How Citigroup Hackers Easily Gained Access

Comments Filter:
  • by jandrese ( 485 ) <kensama@vt.edu> on Tuesday June 14, 2011 @04:58PM (#36442680) Homepage Journal
    There is no facepalm big enough to express my feeling at that hack. I'm sure they paid good money to "security professionals" to set that up too.
    • by MozeeToby ( 1163751 ) on Tuesday June 14, 2011 @05:00PM (#36442738)

      Makes Sony's security setup look like Fort Knox. And that's saying something.

    • Think of the great employment opportunities now that you know that anyone can be a "security professional!"
      • Yup. Every bit as valuable as being an "HTML programmer" in 2000. And, obviously, about the same skill levels.
      • by UncleTogie ( 1004853 ) on Tuesday June 14, 2011 @05:23PM (#36443156) Homepage Journal

        Think of the great employment opportunities now that you know that anyone can be a "security professional!"

        Well, I did stay at a Holiday Inn last night....

      • Comment removed (Score:4, Informative)

        by account_deleted ( 4530225 ) on Tuesday June 14, 2011 @11:01PM (#36445898)
        Comment removed based on user account deletion
    • by danlip ( 737336 )

      I wonder if the management actually understands how big a screw up this is. I'm sure they understand that "stolen data = bad" but not what a ridiculously easy exploit this was. If they did understand it probably wouldn't have happened.

      • In a radio broadcast in Germany not long ago, the online security of banks was described to be the equivalent of putting the money in a carton box on the street (if you understand German: Here's a transcript [web.ard.de] as PDF).

        After reading this story, I think the carton box would actually provide more safety.

        • In a radio broadcast in Germany not long ago, the online security of banks was described to be the equivalent of putting the money in a carton box on the street (if you understand German: Here's a transcript [web.ard.de] as PDF).

          After reading this story, I think the carton box would actually provide more safety.

          It would. If you allow plastic bags, then the box could contain coffee grounds. This would be especially true if one has a few trial runs to convince the crooks that the box is worthless.

        • Comment removed based on user account deletion
          • Not quite, in that with the UK system, those details only allow people to set up a Direct Debit, which can only be used for certain types of Consumer to Business payments, and are automatically refundable on the consumer end, but still makes it worth keeping your account number and sort code private.

            • and are automatically refundable on the consumer end

              Good luck trying to actually get that refund. The one time I did, I just got a run-around between the bank and the merchant (it was an ISP who had stopped providing service, but not stopped billing me and presumably other users). I only lost about 100 quid, so I didn't try too hard, but still, I lost most of my faith in direct debit from that incident.

          • Similar Donald Knuth [wikipedia.org] stopped issuing his reward checks [wikipedia.org] for finding errors in his books because people were so proud of receiving them that they posted pictures of the checks online. The information visible on the front of the check in some of the pictures was enough to enable someone to steal money from his bank account. The moral of the story? The entire banking system is mostly insecure.

            I'm not sure that much has improved since the events depicted in the movie Catch Me If You Can [imdb.com] happened. It seems li

      • by jd ( 1658 )

        I'm guessing they used the same security guys that wrote a similar front-door for Hotmail. (One of their earliest security holes was where you could swap your user ID for anyone else's. Including the system admin's.)

    • by HeckRuler ( 1369601 ) on Tuesday June 14, 2011 @05:13PM (#36442990)
      Agreed. And this:

      'broke in through the front door'

      It was an unlatched SCREEN DOOR with a missing hinge!
      I wouldn't consider it hacking even by the media's definition. It's akin to asking the teller for someone else's information, and coming back 200,000 times to do it again.

      Whiskey
      Tango
      Foxtrot

      • by EdIII ( 1114411 ) on Tuesday June 14, 2011 @07:31PM (#36444508)

        Yeah...... this was not hacking. That word has been expanded entirely way too much in much the same way Schizophrenia was used a dump bucket for psychological disorders we just did not understand yet.

        Hacking, even in this context, implies there was security to begin with.

        This was not a SQL injection attack. If they were posting stuff in the URL bar then that means that Citigroup's website was programmed to take the $_GET (or whatever non-PHP equivalent) and just return the data.

        No validation, or even a comparison against the user profile held in the session data? Seriously?

        Everything we do is AJAX with JQuery. We authenticate a user and from that point on their user profile information is stored in the session. Every API call from that point forward passes their unique ID along with the action request (even just informational requests) that get validated by our own security processes at the API level, especially before a database call is made in the first place to return data from the appropriate database for that customer/process/application. We validate who you are, what you are accessing, and what rights have been assigned to you, before you get an XML/JSON response document back from us.

        Anything else, is just unwise and unprofessional. By no means, am I or the people I work with superstars. This is just the basics of anybody that approaches a project with security first, application second mentality.

        According to this article, Citigroup was just wide wide WIDE the $*$%(# open. It's not hacking when asking the "question" of the web server does not initiate authentication. Citigroup literally allowed anonymous requests for information by design .

        I would not even prosecute the group. Seriously.... for what? Walking into a bakery where a mentally challenged person was just freely giving away cherry pies? Was it unethical to take advantage of the poor idiot and take the cherry pie when you know that normally it cost $5? Probably. Was it stealing? I don't think so.

        If anything, there should be class action suit against Citigroup by all of the members for gross negligence. How ironic is it that huge groups like this, with tons of money (some of it stolen through mortgage fraud) pay hundreds of thousands or millions of dollars and get less value than a small time development group that charges 15k-20k for a small site ?

        It's deliciously stupid that the biggest groups are programmed by morons, and that the smaller websites are actually programmed to be more secure.

        I'd like to say I can't believe it, but I know too many stories where half million dollar websites are running on $50k worth of hardware, with IT budgets that allow judicious use of hookers and blow, and yet they can't program themselves out of a wet cardboard box, let alone prevent SQL injection attacks.

        The wonderful stupidity....

    • You need the Mega Facepalm! [motivationalz.com]

    • by Anonymous Coward on Tuesday June 14, 2011 @05:19PM (#36443084)

      And yet FTFA:

              One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

              He said: 'It would have been hard to prepare for this type of vulnerability.'

      Wow. Yes, I can see how making accounts accessible via an unhashed URL is really something no one would have guessed would be a problem. Especially when the same technique is referenced explicitly in a recent blockbuster (The Social Network).

      • by Yvan256 ( 722131 )

        That so-called expert should be fired immediately for these two incredibly starter-level errors:
        1. that was not a "vulnerability in the browser" at all.
        2. any idiot worth his lines of code would have seen this type of vulnerability coming from a lightyear away.

      • by demonbug ( 309515 ) on Tuesday June 14, 2011 @05:32PM (#36443284) Journal

        And yet FTFA:

                One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

                He said: 'It would have been hard to prepare for this type of vulnerability.'

        Wow. Yes, I can see how making accounts accessible via an unhashed URL is really something no one would have guessed would be a problem. Especially when the same technique is referenced explicitly in a recent blockbuster (The Social Network).

        See, this is the real reason Firefox wants to get rid of the URL bar. Only hackers would directly enter a URL. Legitimate consumers will just follow the link to their account from their Facebook page.

      • They call idiot an expert!? Holy shit.

        Also Zuckerberg's high-speed-technobabble in The Social Network was meant only to show most viewers that he's supposed to be a computer genius. They have little or no idea what he's talking about. Someone with as little knowledge as this "expert" wouldn't have understood it.

      • by CharlyFoxtrot ( 1607527 ) on Tuesday June 14, 2011 @05:48PM (#36443484)

        There's a reason that "expert" is anonymous: it's a PR flunky that has to feed ass-covering statements to the press. Something for the masses who don't know any better to swallow.

      • by blair1q ( 305137 ) on Tuesday June 14, 2011 @06:31PM (#36443958) Journal

        Account numbers don't need to be secret. In fact, you hand them out when you write checks.

        It's the access using the account number that has to be protected by more than "is the rest of the URI formatted correctly and does the browser have a cookie we issued to it?"

        Hashing the account number (and other info) into an identifier in that cookie, then using that as the session ID, and only allowing access to that one account from that port until another session was authenticated on it, would be more proper.

        It's not just the URI that is screwy, it's the whole lifecycle design of the session, and a failure to partition the data in any meaningful way.

    • Whoever made this should be forbidden from working with computers ever again. Is there any legal process that can do this?

    • Correct me if I'm wrong UK based folks, but isn't the Daily Mail famous for BS... or am I thinking of a different British mag? Anyone else have any other sources which corroborate this story? On a quick search, I cannot find any.

      This is literally unbelievable to me.
    • by icebike ( 68054 )

      There is no facepalm big enough to express my feeling at that hack. I'm sure they paid good money to "security professionals" to set that up too.

      The hack isn't as simple as you might think at first glance.

      Sending the account number out in a URL is not that big of a deal in an SSL environment. (Not defending it, people looking over the users shoulder and all. It should have been an encrypted session string, or an encrypted cookie so that the user couldn't see how to alter it.).

      But the ultimate problem here was accepting the altered URL without going thru re-validation, without asking for passwords again, etc.

      It wasn't so much a hack as a simple (bu

      • by gweihir ( 88907 )

        It is a hack as incorrectly keeping state client-side is one of the trivial first things to look at when assessing web-application security. Absolute beginners mistake, but found surprisingly often in the wild. My guess is that the people creating these applications can barely program at all and have no clue where their session state is. But any halfway competent external pentest or security assessment would have found this very fast.

    • by cultiv8 ( 1660093 ) on Tuesday June 14, 2011 @06:00PM (#36443638) Homepage

      One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'

      Are you *really* trying to label this as a browser vulnerability issue?

      You're either *really* incompetent or paid very well to say shit like that.

  • Seriously... (Score:4, Insightful)

    by Frosty Piss ( 770223 ) * on Tuesday June 14, 2011 @04:58PM (#36442692)

    Heads need to roll for this one... Amazing. Words escape me.

    • by sarysa ( 1089739 )
      I tend to agree. I'm not a fan of the ten degrees of litigation that have somewhat wrecked U.S. society, but whoever coded that site needs to not be protected from said litigation. Webmasters of sites hosting animated GIFs of dancing deities and lolcats know better than that, and said idiot(s) is(are) responsible for safeguarding the finances of millions worldwide?!
  • by aardwolf64 ( 160070 ) on Tuesday June 14, 2011 @04:59PM (#36442718) Homepage

    I did that at a bank I was working with. It was actually a hidden form variable with the institutions username/password, but grabbing that page before it auto-submitted allowed me to pull anyone's statement. I showed it to my manager, and eventually got a promotion out of it. :-)

  • by locallyunscene ( 1000523 ) on Tuesday June 14, 2011 @05:01PM (#36442768)
    When writing our rest services the first thing we considered was how to prevent users from accessing other users data. I don't understand how this could happen to a bank with credit card data. It's ridiculous.
    • by Dunbal ( 464142 ) *

      I don't understand how this could happen to a bank with credit card data.

      Didn't you read the summary? It's Citigroup. The guys who keep calling me to offer me a credit card despite me having repeatedly told them not to call me anymore and to remove me from their call list. Somehow they think calling me again will make me change my mind and give them business. I guess it's easy to do what you want when the federal government is willing to bail you out.

      • When the FDIC illegal seized WAMU, they ended up with my information. I cancelled my card immediately, but I have a feeling that they've probably retained my information, given that they weren't willing to take no for an answer.

  • by Anonymous Coward

    Dealing with credit card information I know for a fact that security implementation is 100% illegal if the allegations are true. Citibank will be fined hundreds of millions of dollars if they follow the law ($100,000 per incident). I mean base level security for this would be only allow that user access to that specific account. If they were able to simply change URL numbers to see other account holders info... wow... just wow.

    • That's my understanding. In order to be allowed to handle credit card transactions, you enter into an agreement with Visa/Mastercard/etc promising that you won't do things like send account numbers via URLs. Every infraction is a specific, and very large fine. Multiple infractions results in loosing your license with that credit entity. At least, that's on the Point Of Sale level. I can't imagine how it works on the bank level.
    • Citibank will be fined hundreds of millions of dollars if they follow the law ($100,000 per incident).

      ... for which they'll immediately pass the cost to their customers. Do you REALLY think it costs them two bucks to let you use other institutions' ATM? Do you really think it costs them fifty bucks to stop payment on a check? Until we're talking about serious jail time in the pound-me-in-the-ass prison for officers of the corporation, nothing will change. But knowing how congress critters in Washington are

  • Mind numbingly so.

    Really makes me wonder wtf is up with some banks and their incompetence. I registered for online banking with my bank some time ago, and they only allow [a-z][A-z][0-9] for passwords. no ~!@#$%^&*(. In the 21st century. Shame.

    • by Dunbal ( 464142 ) *

      Really makes me wonder wtf is up with some banks and their incompetence.

      Too. Big. To Fail. There simply are no consequences anymore. Fines? OK we'll jack the fees. Losing money? Borrow it at 0% interest from the fed. Going bankrupt? Doesn't matter, the shareholders get wiped out and Uncle Sam will bail us out. Yeah we'll get fired, but we already have our multi-million dollar bonuses. We'll just work for another bank...

    • One thing puzzles me...

      Password security is rated on difficulty, sure. But once you eliminate the dictionary search, you're down to brute force testing each key in turn.

      [a-z][A-Z][0-9] = 62 values
      [a-z][A-Z][0-9][~!#$%^&*(] = 71 values

      So which of these increase the keyspace better...

      pow(62, n) to pow(71, n)
      or pow(62, n) to pow(62, n+1)

      I suspect the answer is "n to n+1". To which the only limit is password size.

      If you're arguing about "these keys are not common in passwords" as security, aren't you argu

  • by chaboud ( 231590 ) on Tuesday June 14, 2011 @05:07PM (#36442860) Homepage Journal

    If you don't understand how a secure negotiation protocol (and the protocol for the session after the fact) works, admit it and either ask someone or read several books until you recognize that you should still go ask someone. I've read more than my fair share of crypto books and papers, but, being an application developer who does only trivial personal server-side development, you can be damned sure that I'd ask for help when working on a username/password system. This goes double if it involves banking.

    That any session allows them to go digging around willy nilly is so unbelievably stupid, I can't even find the words.

  • WTF (Score:5, Insightful)

    by itchythebear ( 2198688 ) on Tuesday June 14, 2011 @05:08PM (#36442894)

    From TFA:

    One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.'

    /epic facepalm

    First, this is NOT a hard vulnerability to prepare for. If the only method of user authentication you are doing is based off a string of characters received from the URL your not even qualified to build an ecommerce site for some mom-and-pop 2-sales-a-week company, let alone a bank.

    Second, why is this a surprise to this security "expert"? Anyone who has done development for a website with dynamic content would be familiar with passing information through the url. This is like web design 101. If I logged into my credit card account and saw my CC number in the URL bar the FIRST thing I would think of would be: "what would happen if I typed in another number in there." Security expert my ass, no wonder why some companies have this happen to them, look at the people they hire to test and investigate their systems!

    /rant

    • by Lifyre ( 960576 )

      It isn't like this a new type of attack either. Just look at people sharing pictures. If they post a bunch of pictures with default names you can very often just change the numbers to find more pictures, frequently ones they didn't intend to share for various often entertaining reasons.

      Hell the first year of college I was able to do something like this. The class registration method was primitive and putting the wrong numbers in when registering would often register someone else for that class. They fix

      • It isn't like this a new type of attack either. Just look at people sharing pictures. If they post a bunch of pictures with default names you can very often just change the numbers to find more pictures, frequently ones they didn't intend to share for various often entertaining reasons.

        I assume this is on Facebook?

    • by DeadCatX2 ( 950953 ) on Tuesday June 14, 2011 @05:50PM (#36443514) Journal

      If I saw my CC or Account number in the URL bar...the first thing I would do is cancel my account and look for another service.

  • by Lorens ( 597774 )
    <NICE>
    This is what you get when important functions are written by people who do not have the slightest inkling of what network security is about. You can put loads of $$$ into planning and design into specifying authentication, and it all falls down because the grunt who actually does the work doesn't have a clue.
    </NICE>
    <REALISTIC>
    Probably the grunt without a clue is the smartest guy over there.
  • by Slutticus ( 1237534 ) on Tuesday June 14, 2011 @05:10PM (#36442920)
    I know, redundant. But fuck. you've got to be kidding me! I think you are kidding. Nice lulz. This is a joke. Right?
  • It's a good thing our foresightful federal government nobly resisted the public in '08-'09 and wisely chose to bail out and backstop this vital financial instution, on whom we are so ever reliant for their irreplaceable expertise!

    *jerk off gesture*

  • Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique.

    And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories

    They simply logged on to the part of the group's site reserved for credit card customers - and substituted their account numbers which appeared in the browser's address bar w

    • It was a very simple attack.

      sophisticated cyber criminals

      I assume they mean the cyber criminals were wearing top hats and monocles, and using big words.

  • Is it really that much trouble to add a secure hash of the id to the URL or check against the session if the user has access to that record? Come on, that is BASIC security.
  • This is a failure in programming (I'll stop short of calling the coders idiots, since I don't know what pressures and time constraints they were under) and testing (this should be caught within 10 minutes with a half-hearted Selenium script). The mistake they made: if user is authenticated, they belong, and everything gets happily processed. Pretty typical, especially for beginning programmers. They failed to check individual resources against what was being param'ed in.

    • by sirwired ( 27582 ) on Tuesday June 14, 2011 @05:53PM (#36443560)

      It doesn't matter WHAT time or money constraints they were under. This is simply not something that would be acceptable out of somebody that codes for money. To call this a "beginners mistake" is an insult to Web Development 101 students everywhere. If you have to be TOLD that maintaining authentication to a secure website based on the contents of the URL bar is a bad idea, then you do not deserve to be coding for anybody. I haven't EVER coded a website (I haven't written anything longer than a ten-line shell script in 13 years) and I could have told you this was a mind-bogglingly stupid mistake. This is not 20/20 hindsight at work here... it really is that stupid.

      Heads should roll, including the programmer(s) responsible for this travesty, and two levels of management above him/her. And the remaining employees in the department should all have to apply for their jobs again (by the new management team), as their suitability as programmers could not have been properly evaluated before if the original moron managed to keep his job longer than a week.

      I'm actually willing to cut the testers some mild slack... maybe they chose not to test for the developer having the IQ of a turnip. (Just a little slack... a tester should NEVER assume the developer has the least clue what they are doing when figuring out what needs testing.)

  • by unil_1005 ( 1790334 ) on Tuesday June 14, 2011 @05:21PM (#36443124)
    It's the security solution for Citigroup!
  • What? I mean, WHAT? Teenie-bopper web developers, tired of having their Star Wars fansites hacked, stopped putting account info in GET strings back in the nineties! What kind of crap programmers... the mind boggles... What BANK would pay for such crap code, and what enterprise-class design team would make such a horrible mistake? This is not a cute little hack, it's a fundamental coding... no, design... no, sorry, CONCEPTUAL flaw.

    Everyone involved with this project; design, management, QA, and most es

  • The "Expert" (Score:5, Insightful)

    by overunderunderdone ( 521462 ) on Tuesday June 14, 2011 @05:26PM (#36443206)

    One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

    He said: 'It would have been hard to prepare for this type of vulnerability.

    IF the article is correct about the nature of the vulnerability this quote is the single stupidest and most frightening things I have ever read on the internet.

    • One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser. He said: 'It would have been hard to prepare for this type of vulnerability.

      IF the article is correct about the nature of the vulnerability this quote is the single stupidest and most frightening things I have ever read on the internet.

      Give some benefit of the doubt. Keep in mind this is a New York Times article -- it is written in way that they feel should be understandable to any 8th grader in the country. Add onto that, that the reporter is almost certainly not understanding anything this guy has to say. Add onto that, this guy is actively working on the investigation, and he might not be willing or able to divulge any actual information. Add onto that that the New York Times readers (staff included) are generally outraged at the b

  • because this is epic fail.
  • Yes, the car is locked, but all the cars use the same key. It would have been hard to prepare for this type of vulnerability.

    • by xero314 ( 722674 )

      Yes, the car is locked, but all the cars use the same key. It would have been hard to prepare for this type of vulnerability.

      I think you mean, the cars are all locked but unlocking one car, regardless of key, gives you access to all other cars.

      Every user account has it's own credentials, it just happens that once you are authorized you are free to access every account, not just your own.

  • "One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.

    He said: 'It would have been hard to prepare for this type of vulnerability.'"

    Really? They were passing a credit card account number in the clear through a GET parameter, without validating it against which session the page load was authenticated on, and
  • This kind of negligence should be criminal.

  • Should CERT issue an advisory on outsourcing as a hot new attack vector?

  • OMFG (Score:5, Insightful)

    by Checkered Daemon ( 20214 ) on Tuesday June 14, 2011 @06:06PM (#36443712)

    "In conclusion, the main thing we did wrong when designing ATM security systems in the early to mid-1980s was to worry about criminals being clever; we should rather have worried about our customers - the banks' system designers, implementers, and testers - being stupid."
                    Ross Anderson, "Security Engineering"

  • by Doc Ruby ( 173196 ) on Tuesday June 14, 2011 @07:01PM (#36444238) Homepage Journal

    It's cheaper for Citigroup to spin its way out of this mess than for it to pay for real security. Because real security requires people with some sense throughout the chain with access to the organization. And that kind of person is a threat to the entire way of doing business that banks like Citigroup do it.

    Remember that Citigroup is exactly the bank for which Senator Phil Gramm (R-TX) wrote the 1998 bank deregulation bill that left the global economy exposed to exactly the kind of collapse the 1934 regulations had protected us from since the last time the banks gave unregulated credit until they collapsed. They have learned from the 2008 Crash that they will be given only more money when they fail, so they don't work hard to avoid the risk. The kind of "moral hazard [wikipedia.org]" that banks use to excuse paying their insurance obligations, but which define their own businesses now.

  • by inject_hotmail.com ( 843637 ) on Tuesday June 14, 2011 @07:07PM (#36444296)
    Anyone remember? You could gain access to anyone else's mailbox by replacing your own address with theirs in the URL bar...10 years later, a bank still can't figure that out? These are the jackasses we "trust" with all of our money and assets, too.
  • by sootman ( 158191 ) on Tuesday June 14, 2011 @09:30PM (#36445388) Homepage Journal

    All this time I've just been using that trick to get free porn.

Never test for an error condition you don't know how to handle. -- Steinbach

Working...