9 ms·

Yeah; I also have the general impression (admittedly without much data to support it) that IT security at banks and other gargantuan, long-lived institutions is

by _bxg1 8y ago

Yeah; I also have the general impression (admittedly without much data to support it) that IT security at banks and other gargantuan, long-lived institutions is pretty crappy? I would think it's easy to get in, and hard to not get caught. Anecdotally, I have a friend who briefly worked at a company which exclusively makes software for financial institutions. Their product was a web app that only worked in a version of Internet Explorer so old, it didn't support Ajax. Asynchronous requests were made by changing the src attribute of a 1px <iframe>. This was in 2015.

dsfyu404ed 8y ago
>I would think it's easy to get in, and hard to not get caught. Imagine you're an new employee at a big old company with a lot of legacy tech that's had mediocre maintenance and documentation over the years as is typical. You are going to leave footprints everywhere just learning to do your job. Imagine how many footprints you leave when you're an outsider who has to learn it all from scratch without documentation or assistance from other employees with historical knowledge. Now try getting anything done in that system without leaving tracks or triggering alerts when you hit some API that even the employees don't knows exists. The reason nobody ever gets caught is because insurance doesn't usually require a conviction before paying out and the effort required to determine who broke in is much higher than figuring out the exact sequence of events because you'd have to do the same investigation on every compromised system they used along the way.
- kolpa 8y ago
  At some point, if the attacks got too frequent or severe, insurance rates would climb to the point where attacks would be better defended or retaliated against.
chaostheory 8y ago
The door code for one of the US's top banks' offices used to be 0000. I wonder if they finally changed it? EA QAs their games better than a lot of financial institutions as well
- bpchaps 8y ago
  EA is largely hosted and managed by rackspace, who, for years, had default passwords on their iLOs - with public IPs. ;)
  - Scoundreller 8y ago
    FYI to those like me: > Integrated Lights-Out, or iLO, is a proprietary embedded server management technology by Hewlett-Packard which provides out-of-band management facilities. The physical connection is an Ethernet port that can be found on most Proliant servers and microservers[1] of the 300 and above series.
    - bpchaps 8y ago
      Yeah - it's basically a PCIe KVM over ethernet.
vpmpaul 8y ago
It is and it is (sorta). I worked in the bank industry for many years and I could have stolen money a hundred different ways without getting caught. The problem is that in the end the money has to go somewhere or be spent (why else steal it?). Also to live a legal life (house,car,boat) you have to have a source of income/spending that does not set off red flags. If you are a high paid bank employee why even bother? Many (most?) financial type crimes have no statue of limitations so to get away you literally have to get away with it for the rest of your life. The other side is even if you get away you will spend the rest of your life wondering if today is the day you get caught. To be honest I think that is why so many white collar crimes are so brazen looking. I think they would rather go to jail for a few years be done with it and live the rest of their lives with the money they have "lost". Unless you live in a country like Russia where stealing money from the US is basically legal. Then go for it.
- downandout 8y ago
  Many (most?) financial type crimes have no statue of limitations so to get away you literally have to get away with it for the rest of your life At least in the US, this is inaccurate. Most financial/fraud crimes have a statute of limitations of 3-5 years, both at the state and federal level. Some federal crimes specifically against financial institutions have a SOL of 10 years. Generally the only crimes that have no statute of limitations are punishable by life/death (such as first degree murder). See https://www.justice.gov/usam/criminal-resource-manual-650-length-limitations-period https://www.justice.gov/usam/criminal-resource-manual-650-le...
  - kolpa 8y ago
    SOL is a timer from time of crime to time of indictment, and indictment doesn't necessarily require knowing the precise identity of the defendant or capturing the defendant. In GA, fleeing stops the clock, and in WA, "John Doe" can be indicted, subject to some restrictions. https://tollefsenlaw.com/statute-limitations-tolled-against-john-doe/ https://tollefsenlaw.com/statute-limitations-tolled-against-...
  - vpmpaul 8y ago
jiveturkey 8y ago
> IT security at banks ... is pretty crappy? I would think it's easy to get in, and hard to not get caught. Yes it is not state of the art. They need a compliance regime in order to be secure, and they meet that and that only. But I think you're missing an aspect, things like passwords that change daily and require collusion, advanced social engineering, physical access, etc. Further, being easy to get caught is the definition of good security. It's super easy to physically enter a bank and take all available cash at gunpoint. Nearly impossible to get away with it. That's good security. Extend that to the digital realm.
- 3pt14159 8y ago
  Better security is not letting them get the cash at all.
  - sorokod 8y ago
    In some banks in Europe, a customer needs to be buzzed in to enter the premises.
  - jefe_ 8y ago
    Cost of dealing with a dead teller is probably higher than the amount of cash that will satisfy most traditional robbers. If that robber-satisfying amount can be recovered with a certain degree of reliability, the security model is effective in deterring attacks, minimizing attack damage, and ensuring physical safety of team members.
    - Retric 8y ago
      There are only around 5,000 bank robberies in the US each year. If they each walked away with 100,000$* which is unlikely that's only 0.5 billion which is peanuts vs the 44 billion retail loses from shoplifters and other issues. PS: 100k in 20's is ~11 pounds. Some people might leave the bank with more than that, but not that much as most branches don't much have cash and simply simply moving it becomes difficult.
    - 3pt14159 8y ago
jjeaff 8y ago
> I have a friend who briefly worked at a company which exclusively makes software for financial institutions. Sounds like Jack Henry. My bank uses them for their client web portal. Up until last year, they had an 8 character max limit on your password, and you couldn't use any special characters or spaces. But at least they make you verify your "personal photo" every time you log in. Which is more than useless since I assume they are trying to protect you from phishing and any decent phishing attempt would just skip that step and no one would notice. Or, if they wanted, they could just port your username to the real site and pass the photo along to you through the phishing site UI.
- Scoundreller 8y ago
  Pffft, a major Canadian bank (they’re all big since we never had a crash), has only 6 numerical digit passwords. You can have a 6 (not less or more) alphanumeric password, but any letters get mapped to numerical digits.
Deimorz 8y ago
> Asynchronous requests were made by changing the src attribute of a 1px <iframe>. And you're posting on a site that still does it that way - voting on HN works by creating an <img> and setting the src attribute to the vote url.
- spraak 8y ago
  That's really interesting. How does it however wait to vote until you press the up or down arrow?
  - Deimorz 8y ago
    Oh, Javascript creates the <img> tag when you click the arrow, it's not present beforehand.
- _bxg1 8y ago
  That's interesting, but Hackernews doesn't exactly handle top-security data. I've always been surprised/charmed by how old-school this site is. In some ways it's nice - it's blazingly lightweight - but it seems ironic that a tech incubator wouldn't have updated their website in ~12 years.
wmeredith 8y ago
Easy to get in, but hard not to get caught has always been the case. Anyone with a lack of morals can go execute tellers and pull money out of cash drawers. But they’ll be in jail by the end of the day.

by _bxg1 8y ago

dsfyu404ed 8y ago

>I would think it's easy to get in, and hard to not get caught. Imagine you're an new employee at a big old company with a lot of legacy tech that's had mediocre maintenance and documentation over the years as is typical. You are going to leave footprints everywhere just learning to do your job. Imagine how many footprints you leave when you're an outsider who has to learn it all from scratch without documentation or assistance from other employees with historical knowledge. Now try getting anything done in that system without leaving tracks or triggering alerts when you hit some API that even the employees don't knows exists. The reason nobody ever gets caught is because insurance doesn't usually require a conviction before paying out and the effort required to determine who broke in is much higher than figuring out the exact sequence of events because you'd have to do the same investigation on every compromised system they used along the way.

kolpa 8y ago
At some point, if the attacks got too frequent or severe, insurance rates would climb to the point where attacks would be better defended or retaliated against.

chaostheory 8y ago

The door code for one of the US's top banks' offices used to be 0000. I wonder if they finally changed it? EA QAs their games better than a lot of financial institutions as well

bpchaps 8y ago
EA is largely hosted and managed by rackspace, who, for years, had default passwords on their iLOs - with public IPs. ;)
- Scoundreller 8y ago
  FYI to those like me: > Integrated Lights-Out, or iLO, is a proprietary embedded server management technology by Hewlett-Packard which provides out-of-band management facilities. The physical connection is an Ethernet port that can be found on most Proliant servers and microservers[1] of the 300 and above series.
  - bpchaps 8y ago
    Yeah - it's basically a PCIe KVM over ethernet.

vpmpaul 8y ago

It is and it is (sorta). I worked in the bank industry for many years and I could have stolen money a hundred different ways without getting caught. The problem is that in the end the money has to go somewhere or be spent (why else steal it?). Also to live a legal life (house,car,boat) you have to have a source of income/spending that does not set off red flags. If you are a high paid bank employee why even bother? Many (most?) financial type crimes have no statue of limitations so to get away you literally have to get away with it for the rest of your life. The other side is even if you get away you will spend the rest of your life wondering if today is the day you get caught. To be honest I think that is why so many white collar crimes are so brazen looking. I think they would rather go to jail for a few years be done with it and live the rest of their lives with the money they have "lost". Unless you live in a country like Russia where stealing money from the US is basically legal. Then go for it.

downandout 8y ago
Many (most?) financial type crimes have no statue of limitations so to get away you literally have to get away with it for the rest of your life At least in the US, this is inaccurate. Most financial/fraud crimes have a statute of limitations of 3-5 years, both at the state and federal level. Some federal crimes specifically against financial institutions have a SOL of 10 years. Generally the only crimes that have no statute of limitations are punishable by life/death (such as first degree murder). See https://www.justice.gov/usam/criminal-resource-manual-650-length-limitations-period https://www.justice.gov/usam/criminal-resource-manual-650-le...
- kolpa 8y ago
  SOL is a timer from time of crime to time of indictment, and indictment doesn't necessarily require knowing the precise identity of the defendant or capturing the defendant. In GA, fleeing stops the clock, and in WA, "John Doe" can be indicted, subject to some restrictions. https://tollefsenlaw.com/statute-limitations-tolled-against-john-doe/ https://tollefsenlaw.com/statute-limitations-tolled-against-...
- vpmpaul 8y ago

jiveturkey 8y ago

> IT security at banks ... is pretty crappy? I would think it's easy to get in, and hard to not get caught. Yes it is not state of the art. They need a compliance regime in order to be secure, and they meet that and that only. But I think you're missing an aspect, things like passwords that change daily and require collusion, advanced social engineering, physical access, etc. Further, being easy to get caught is the definition of good security. It's super easy to physically enter a bank and take all available cash at gunpoint. Nearly impossible to get away with it. That's good security. Extend that to the digital realm.

3pt14159 8y ago
Better security is not letting them get the cash at all.
- sorokod 8y ago
  In some banks in Europe, a customer needs to be buzzed in to enter the premises.
- jefe_ 8y ago
  Cost of dealing with a dead teller is probably higher than the amount of cash that will satisfy most traditional robbers. If that robber-satisfying amount can be recovered with a certain degree of reliability, the security model is effective in deterring attacks, minimizing attack damage, and ensuring physical safety of team members.
  - Retric 8y ago
    There are only around 5,000 bank robberies in the US each year. If they each walked away with 100,000$* which is unlikely that's only 0.5 billion which is peanuts vs the 44 billion retail loses from shoplifters and other issues. PS: 100k in 20's is ~11 pounds. Some people might leave the bank with more than that, but not that much as most branches don't much have cash and simply simply moving it becomes difficult.
  - 3pt14159 8y ago

jjeaff 8y ago

> I have a friend who briefly worked at a company which exclusively makes software for financial institutions. Sounds like Jack Henry. My bank uses them for their client web portal. Up until last year, they had an 8 character max limit on your password, and you couldn't use any special characters or spaces. But at least they make you verify your "personal photo" every time you log in. Which is more than useless since I assume they are trying to protect you from phishing and any decent phishing attempt would just skip that step and no one would notice. Or, if they wanted, they could just port your username to the real site and pass the photo along to you through the phishing site UI.

Scoundreller 8y ago
Pffft, a major Canadian bank (they’re all big since we never had a crash), has only 6 numerical digit passwords. You can have a 6 (not less or more) alphanumeric password, but any letters get mapped to numerical digits.

Deimorz 8y ago

> Asynchronous requests were made by changing the src attribute of a 1px <iframe>. And you're posting on a site that still does it that way - voting on HN works by creating an <img> and setting the src attribute to the vote url.

spraak 8y ago
That's really interesting. How does it however wait to vote until you press the up or down arrow?
- Deimorz 8y ago
  Oh, Javascript creates the <img> tag when you click the arrow, it's not present beforehand.
_bxg1 8y ago
That's interesting, but Hackernews doesn't exactly handle top-security data. I've always been surprised/charmed by how old-school this site is. In some ways it's nice - it's blazingly lightweight - but it seems ironic that a tech incubator wouldn't have updated their website in ~12 years.

wmeredith 8y ago

Easy to get in, but hard not to get caught has always been the case. Anyone with a lack of morals can go execute tellers and pull money out of cash drawers. But they’ll be in jail by the end of the day.