Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Security Privacy Social Networks

Iran Banks Burned, Then Customer Accounts Were Exposed Online (nytimes.com) 47

The details of millions of Iranian bank cards were published online after antigovernment protests last month. Experts suspect a state-sponsored cyberattack. From a report: After demonstrators in Iran set fire to hundreds of bank branches last month in antigovernment protests, the authorities dealt with another less visible banking threat that is only now coming to fuller light: a security breach that exposed the information of millions of Iranian customer accounts. As of Tuesday, details of 15 million bank debit cards in Iran had been published on social media in the aftermath of the protests, unnerving customers and forcing the government to acknowledge a problem. The exposure represented the most serious banking security breach in Iran, according to Iranian media and a law firm representing some of the victims.

The breach, which targeted customers of Iran's three largest banks, was likely to further rattle an economy already reeling from the effects of American sanctions and came as Iran's leadership was grappling with deep-seated anger over its deadly crackdown on the protests. The number of affected accounts represents close to a fifth of the country's population. "This is the largest financial scam in Iran's history," reported Aftab News, a conservative media outlet. "Millions of Iranians are worried to find their names among the list of hacked accounts."

This discussion has been archived. No new comments can be posted.

Iran Banks Burned, Then Customer Accounts Were Exposed Online

Comments Filter:
  • by guruevi ( 827432 ) on Thursday December 12, 2019 @10:57AM (#59512290)

    Anyone can hack poor security and there are plenty of motivated individuals, both state-sponsored or other for banks, elections, government information etc. How they come to the conclusion that it is state-sponsored is more political message than statements of fact, they don't know for sure who hacked them, pointing the finger at another state (which I must assume will be Israel or the USA given it's coming from Iran) is an easy pretext for more government crackdowns on dissidents.

    • by 110010001000 ( 697113 ) on Thursday December 12, 2019 @11:06AM (#59512326) Homepage Journal

      Iran is saying it isn't state-sponsored. It is the outside "experts" that are claiming it is.

      • by 110010001000 ( 697113 ) on Thursday December 12, 2019 @11:26AM (#59512398) Homepage Journal

        I'm not sure why I am being modded down. It literally says that in the article:
         
        "Iran’s information and telecommunications minister, Mohammad Javad Azari Jahromi, described the breach as data theft by a disgruntled contractor who had access to the accounts and had exposed them as part of an extortion attempt. He denied the banking system’s computers had been hacked.

        But outside cyberexperts disputed that claim. They also said a breach of such magnitude was likely the work of a state entity aiming to stoke instability, not criminals whose objective is blackmail for financial gain."

        • by Nidi62 ( 1525137 )

          I'm not sure why I am being modded down. It literally says that in the article:

          "Iran’s information and telecommunications minister, Mohammad Javad Azari Jahromi, described the breach as data theft by a disgruntled contractor who had access to the accounts and had exposed them as part of an extortion attempt. He denied the banking system’s computers had been hacked.

          But outside cyberexperts disputed that claim. They also said a breach of such magnitude was likely the work of a state entity aiming to stoke instability, not criminals whose objective is blackmail for financial gain."

          To be fair, a disgruntled contractor is exactly the type of person a foreign intelligence agency would try to develop as an asset within a targeted institution. So he could both be telling the truth about who did it, just not the why.

          • Thats nice, but that doesn't contradict anything I am talking about.

            • Mystery down mods: sometimes a conspiracy and sometimes someones wounded ego lashing out, welcome to earth watch your back. I do wonder though why user id no's on slashdot grew so quickly in the last few years, many trolls joining?
              • Because it's one of least moderated places outside of pure shitholes like disqus, yahoo answers, and youtube comments.
                If someone was paying you to post bullshit on the internet. Can you think of a better target than slashdot?

                Which up until recently had loginless anonymous posting, a moderation system that was designed , deliberately antagonistic staff, a collection of ancient trolling tools and tricks from the penisbird days of the internet... that all still work.

        • by Archtech ( 159117 ) on Thursday December 12, 2019 @11:39AM (#59512428)

          I'm not sure why I am being modded down. It literally says that in the article.

          It's the new way. If you say anything that someone doesn't like, you will be punished. Truth is not a defence. E.g.

          https://russia-insider.com/en/... [russia-insider.com]

          Examples could be multiplied endlessly.

        • and sold it piece meal. A data dump like this is pretty obviously meant to cause trouble.
        • by CODiNE ( 27417 )

          Your use of "experts" may be the cause of the downvotes. You're discounting a whole profession there.

    • How they come to the conclusion that it is state-sponsored is more political message than statements of fact, they don't know for sure who hacked them

      Experience is the best teacher. The last major hack against Iran (the Stuxnet virus [mcafee.com]), was created and deployed by the United States government, so any reasonably intelligent person would also put them at the top of the suspect list for this cyber attack. By the way, Stuxnet spread way beyond it's intended target, costing millions globally. I wonder if this

      • by Nidi62 ( 1525137 )

        How they come to the conclusion that it is state-sponsored is more political message than statements of fact, they don't know for sure who hacked them

        Experience is the best teacher. The last major hack against Iran (the Stuxnet virus [mcafee.com]), was created and deployed by the United States government, so any reasonably intelligent person would also put them at the top of the suspect list for this cyber attack.

        By the way, Stuxnet spread way beyond it's intended target, costing millions globally. I wonder if this banking hack will be similar?

        My first thoughts were more towards Israel or Saudi Arabia than the US. Stuxnet was about disrupting Iran's nuclear production and was more targeted. This seems to me aimed more at simply causing more problems for the Iranian government.

        • Stuxnet was about disrupting Iran's nuclear production and was more targeted. This seems to me aimed more at simply causing more problems for the Iranian government.

          Considering who was in the oval office during Stuxnet and who is there now, does this surprise anyone?

      • This wasn't a virus. Someone just copied some data from a database and put it on Telegram. The real question is why are banks still putting PINs in plaintext?

    • by E-Rock ( 84950 )

      It's the three different banks at once raises the suspicion level. The disgruntled IT employee/contractor story is plausible for one bank, but three at once?

      That this currently appears to just be done to scare people also makes it less likely that criminal orgs were to blame. Although it's possible that this is a distraction to keep eyes off the real crime.

    • Because they've taken all the various categories of hackers and they've modeled their motives and capabilities.
      Sure a great basement hacker might personally have millions of dollars of zero day, they may compile profiles of target people and systems and wait years for related exploits and data dumps and collect OSINT. When you can tell that the software is developed by a team and has had proper QA testing, the code has been signed with a stolen key, the targets were patiently surveilled and profiled for e

  • by guruevi ( 827432 ) on Thursday December 12, 2019 @10:58AM (#59512294)

    Get your information from reliable and verifiable sources, NYT is neither.

  • Think about what would have happened if this list included bank balances. Especially the balances of the leadership...

    • by Nidi62 ( 1525137 )

      Think about what would have happened if this list included bank balances. Especially the balances of the leadership...

      That would just be spending money. The real accounts would all be in offshore banks.

  • Imagine that ... Actual chances at toppling the government due to people having a spine and some balls in their pants. ... People raiding and setting on fire Gold Man-Sacks and Bandit Of America during the bailouts.

    I'd be proud of my country of responsible citizens.

    Surey sadly, the current assholes would only be replaced by the next assholes because the country is too far above Dunbar's number, but better than this pathetic state of herded livestock blindly mooing away.

    • If you believe that, why don't you go out and do it?

    • by jythie ( 914043 )
      Eh, but keep in mind that 'popular revoltes' generally are not. Some interested party, internal or external, is funding/coordinating/spinning/etc, and has the next group of leaders lined up. As a general rule, the people do not replace leadership, the 'court' uses the people as a cover to replace the tier above them. It is less about having balls or spine, and more about being a tool.
  • Didn't I see something like that on Mr. Robot

  • by schwit1 ( 797399 ) on Thursday December 12, 2019 @11:55AM (#59512484)

    https://www.washingtonexaminer... [washingtonexaminer.com]

    Speaking on Monday, retired Gen. Morteza Qorbani told an Iranian news outlet that Iran did not need to use ballistic missiles in Iran to effectively attack Israel. Instead, Qorbani said, if “the Zionist regime makes the smallest mistake toward Iran, we will reduce Tel Aviv to ashes from Lebanon.”

    That sparked quick pushback in Lebanon, even from Iran’s allies there. On Wednesday, a top Revolutionary Guard spokesperson blamed the media for misrepresenting the adviser’s clear words. Qorbani, the spokesman added, “meant to speak of response to Israel by possible various means and capacities.” In addition, in an amusing attempt to distance themselves from Qorbani, the Revolutionary Guard claimed that he “is not an adviser to the IRGC commander at present.”

    If that’s not rowing back, I don’t know what is.

    • Re: (Score:2, Insightful)

      by Anonymous Coward

      I didn't even think this is a secret, it's common knowledge that Hezbollah is funded and backed by Syria and Iran as an anti-Israeli proxy and to counter Lebanon's underlying Western orientation born from the fact it was owned by the French and enjoyed the fruits of Western civilisation due to that and it's proximity to Europe as a result.

      Iran is the only thing stopping Lebanon being a stable modern secular nation, and preventing peace between Israel and Lebanon in the same way Israel is now firmly at peace

  • The US should take credit for it, fuck it. Our name is pretty tarnished anyway, how worse can it be? We should be the international badasses, much more exciting than the world's police.

  • Iran hacks own banks, or else it was one of North Korea, China or the Kremlin :]

"Protozoa are small, and bacteria are small, but viruses are smaller than the both put together."

Working...