5 ms·

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they c

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online systems. Perhaps the attackers found a way to log in to accounts bypassing the usual security checks? But that still doesn't explain it all. All my online accounts have extra security when I create a payment to a new individual. Some have an extra password check, some have SMS validation, and so on. All of them send me a notification of a new payment being added. And yet there doesn't seem to be reports of Tesco customers getting any of these kind of messages. People only found about the losses when they logged into their accounts, or when Tesco broadcast a "we've been hacked" message to everyone. Does anyone know what could have happened here?

spydum 10y ago
could be entirely a software bug? Though I tend to agree that it looks worse than that.
- zigzigzag 10y ago
  Sure. All it takes is a REST endpoint without the proper XSRF checks.
- TACIXAT 10y ago
  This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$ It would actually be really interesting if they faxed in transfer forms or something.
devnull791101 10y ago
i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users
- sonthonax 10y ago
  No, Tesco Bank is wholly owned by Tesco; you're thinking of M&S Bank, which is a front end to HSBC.
  - devnull791101 10y ago
    i can say for sure the few times ive had issues transferring money overseas tesco customer services claim to be checking the status on an hsbc system
    - AlphaSite 10y ago
      Maybe their forex is via Hsbc?
      - tankenmate 10y ago
        I think you might mean SWIFT (wordlwide) or SEPA (euro area + other EU). Forex typically means buying or selling currencies, not transferring money between parties.
        thisone 10y ago
        It's a moot point, but forex's are also used to move money internationally. It is ultimately buying and selling currencies, but you get much better rates than through the bank because the forex isn't actually moving your money. It's receiving money into accounts which are in the senders country, and then, using its accounts in the receivers country, it pays the receiver. Also means the receiver doesn't get hit with fees to receive an international payment.
    - makomk 10y ago
      Some of the smaller banks and building societies seem to use larger banks like HSBC to process transfers.
- joosters 10y ago
  That still seems odd... phishing & malware attacks are going on all the time, so a targetted strike on Tesco bank users all at the same time would be a very 'restrained' attack. Phishing would take place over several days, so the attackers would be gathering account details piece by piece. Also, the first thing that banks tend to do when a large scale phishing attack has been successful is to re-issue new passwords and card numbers, yet Tesco haven't done this. So whatever avenue of attack the hackers had, Tesco must be confident that they have closed it off without needing to junk any compromised account details?
4ndr3vv 10y ago
From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.
throwawayReply 10y ago
That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach. I personally doubt this will be revealed to be a software security issue.
Quarrelsome 10y ago
Well there hasn't been an APT (Advanced Persistent Threat) attack yet on a UK bank yet (although we've seen them on banks in the developing world). Perhaps this is the first and perhaps the attackers figures that doing many smaller transactions would work for longer than big ones.
Roonerelli 10y ago
there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details
- deleted 10y ago
  [deleted]
- Tepix 10y ago
  Sounds like the bank got breached, not the customer.
jsingleton 10y ago
Disclaimer: I don't use Tesco Bank so this is just speculation and some observations. The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The danger in using 'respond' for payments is that the account and amount aren't entered into the card reader so you don't know what you are authorising. <pure-speculation> If Tesco have a flaw in how they are using 2FA, by only using 'respond', then local malware could intercept genuine payments, alter the account/amount details, and get the user to authorise this. Or Android malware could intercept SMS messages. N.B. This assumes the issue is in the faster payments system but it could be in the payment card system. It appears cash points still work but this is a separate system to debit card payments. </pure-speculation> From what I've read no one will lose money but having transactions frozen is still a big inconvenience. As mentioned elsewhere here, this is why it's a good idea to have many different bank accounts from various parent institutions (also important from a deposit guarantee position). Some banks share the same infrastructure and liability. Always have some cash available too, although that is getting harder to spend everywhere [1]. [0]: https://unop.uk/phone-numbers-for-examples-and-user-identification/ https://unop.uk/phone-numbers-for-examples-and-user-identifi... [1]: https://unop.uk/do-you-accept-cash/ https://unop.uk/do-you-accept-cash/
- emp_zealoth 10y ago
  Welp, just because you get to have Verizon give up your phone number because someone asked nicely doesn't mean it is universally a bad idea Hell, I can't even get authenticated with my provider half the time because the simcard comes with it's ID/PIN/password that is printed on your contract. You need that to do any changes on your account. I personally think cell phones can be made secure enough and are the most convenient. If somebody really wants to fuck with you, they will anyway, for most people there is not much point to it anyway
- dogma1138 10y ago
  Not all banking systems require 2FA, phone banking doesn't. If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code. And these systems can be breached.
mmaunder 10y ago
Agreed with your concerns. The fact that it was widespread and no action from Tesco that indicates any understanding of what was compromised suggests they have no clue. So they may still be vulnerable. If UK customers can find a low (or no) cost alternative place to put what remains of their money, I'd do that now. This might not be over. They may not know how the attackers gained access or if they're still inside until incident responders have done a full workup on the network.

spydum 10y ago

could be entirely a software bug? Though I tend to agree that it looks worse than that.

zigzigzag 10y ago
Sure. All it takes is a REST endpoint without the proper XSRF checks.
TACIXAT 10y ago
This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser. /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$ It would actually be really interesting if they faxed in transfer forms or something.

devnull791101 10y ago

i believe tesco is a customer services front end to hsbc, so i doubt that its a bank end/ accounting problem. since its only online payments that have been stopped it suggests a card details leak, including the security code. i imagine this would only affect cards that dont have the 2 factor (mastercard/visa) step set up. perhaps a successful phishing or malware attack which has targeted tesco users

sonthonax 10y ago
No, Tesco Bank is wholly owned by Tesco; you're thinking of M&S Bank, which is a front end to HSBC.
- devnull791101 10y ago
  i can say for sure the few times ive had issues transferring money overseas tesco customer services claim to be checking the status on an hsbc system
  - AlphaSite 10y ago
    Maybe their forex is via Hsbc?
    - tankenmate 10y ago
      I think you might mean SWIFT (wordlwide) or SEPA (euro area + other EU). Forex typically means buying or selling currencies, not transferring money between parties.
      - thisone 10y ago
        It's a moot point, but forex's are also used to move money internationally. It is ultimately buying and selling currencies, but you get much better rates than through the bank because the forex isn't actually moving your money. It's receiving money into accounts which are in the senders country, and then, using its accounts in the receivers country, it pays the receiver. Also means the receiver doesn't get hit with fees to receive an international payment.
  - makomk 10y ago
    Some of the smaller banks and building societies seem to use larger banks like HSBC to process transfers.
joosters 10y ago
That still seems odd... phishing & malware attacks are going on all the time, so a targetted strike on Tesco bank users all at the same time would be a very 'restrained' attack. Phishing would take place over several days, so the attackers would be gathering account details piece by piece. Also, the first thing that banks tend to do when a large scale phishing attack has been successful is to re-issue new passwords and card numbers, yet Tesco haven't done this. So whatever avenue of attack the hackers had, Tesco must be confident that they have closed it off without needing to junk any compromised account details?

4ndr3vv 10y ago

From the Article "I've not heard of an attack of this nature and scale on a UK bank where it appears that the bank's central system is the target" Sounds like it's a breach from within (or at least not though compromised accounts), this would explain the lack of concern from Tesco about resting security (much to the chagrin of customers, i'm sure) and the huge numbers of affected accounts.

throwawayReply 10y ago

That hasn't been released, but I think it's interesting that the original press releases frames this as a matter of fraud rather than a breach. I personally doubt this will be revealed to be a software security issue.

Quarrelsome 10y ago

Well there hasn't been an APT (Advanced Persistent Threat) attack yet on a UK bank yet (although we've seen them on banks in the developing world). Perhaps this is the first and perhaps the attackers figures that doing many smaller transactions would work for longer than big ones.

Roonerelli 10y ago

there was a victim on the radio this morning saying his account had been breached. But he said the account is one he just uses for savings. He received the card in the post years ago and it has sat in his safe ever since. It's never left his house. So couldn't understand how someone could have ever got his details

deleted 10y ago
[deleted]
Tepix 10y ago
Sounds like the bank got breached, not the customer.

jsingleton 10y ago

Disclaimer: I don't use Tesco Bank so this is just speculation and some observations. The types of 2FA vary dramatically between banks. Some use an SMS OTP but as we know phone numbers aren't secure [0]. Most use a card reader but they often do this differently. Some use the 'identify' function to log on and the 'sign' function for payments (as designed) but others use the 'respond' function for everything. The danger in using 'respond' for payments is that the account and amount aren't entered into the card reader so you don't know what you are authorising. <pure-speculation> If Tesco have a flaw in how they are using 2FA, by only using 'respond', then local malware could intercept genuine payments, alter the account/amount details, and get the user to authorise this. Or Android malware could intercept SMS messages. N.B. This assumes the issue is in the faster payments system but it could be in the payment card system. It appears cash points still work but this is a separate system to debit card payments. </pure-speculation> From what I've read no one will lose money but having transactions frozen is still a big inconvenience. As mentioned elsewhere here, this is why it's a good idea to have many different bank accounts from various parent institutions (also important from a deposit guarantee position). Some banks share the same infrastructure and liability. Always have some cash available too, although that is getting harder to spend everywhere [1]. [0]: https://unop.uk/phone-numbers-for-examples-and-user-identification/ https://unop.uk/phone-numbers-for-examples-and-user-identifi... [1]: https://unop.uk/do-you-accept-cash/ https://unop.uk/do-you-accept-cash/

emp_zealoth 10y ago
Welp, just because you get to have Verizon give up your phone number because someone asked nicely doesn't mean it is universally a bad idea Hell, I can't even get authenticated with my provider half the time because the simcard comes with it's ID/PIN/password that is printed on your contract. You need that to do any changes on your account. I personally think cell phones can be made secure enough and are the most convenient. If somebody really wants to fuck with you, they will anyway, for most people there is not much point to it anyway
dogma1138 10y ago
Not all banking systems require 2FA, phone banking doesn't. If tested systems that allow you to transfer money between accounts, if you can bypass the initial authentication you can transfer money without needing to use 2FA or generating a TUN code. And these systems can be breached.

mmaunder 10y ago

Agreed with your concerns. The fact that it was widespread and no action from Tesco that indicates any understanding of what was compromised suggests they have no clue. So they may still be vulnerable. If UK customers can find a low (or no) cost alternative place to put what remains of their money, I'd do that now. This might not be over. They may not know how the attackers gained access or if they're still inside until incident responders have done a full workup on the network.