4 ms·

I learned early on in my career not to mess around with account information, especially at a bank. My first job out of university was in corporate IT for a big

I learned early on in my career not to mess around with account information, especially at a bank. My first job out of university was in corporate IT for a big bank around the time that l0phtcrack came out. I used it to crack hundreds of user passwords, and then showed my boss the vulnerability. He promptly told the director, the director sent out an email saying that people's NT passwords had been breached, and I got in a little bit of trouble for cracking people's passwords without authorization, even though people were using passwords like "password", "apple", etc. I realize it's dumb to to blame me (or the guy in the original story), but I've come to learn that when you're dealing with big corporations like banks, they are eager to cover their own asses and to throw the blame wherever they can. So it's best to never mess with them. The fact that the guy downloaded actually customer information is what opened him up to potential problems, that's the one step I probably would have avoided. Of course, this ridiculous behavior by the banks will only make it more likely that any security breaches won't be reported, which means if you're a customer, you should change banks immediately to a bank that actually cares about the security of your information.

DanBC 15y ago
But what you did was not ethical, or sensible, or best practice; and was obviously going to get you into trouble. You're lucky you kept your job. There are ways you can raise concerns about security and yours was a bad way.
felipemnoa 15y ago
>>Of course, this ridiculous behavior by the banks will only make it more likely that any security breaches won't be reported Or people will simply release it in the wild for all to see and let the bank's asses burn
shabble 15y ago
You're lucky you're not Randall Schwartz[1], who performed an unauthorised security audit on some intel boxes, and ended up being convicted and spent something like 10 years (and a hell of a lot of money) getting the ruling overturned.[2] [1] https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Schwartz https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Sch... [2] http://www.lightlink.com/spacenka/fors/ http://www.lightlink.com/spacenka/fors/
narcissus 15y ago
About 10 years ago my SO at the time was logging into an 'industry specific credit union' banking website for the first time. She called out to me to ask me about the error she was seeing on screen so I wandered over and couldn't believe my eyes... Part of the login credentials was the requirement for her surname which just happened to be of the Irish persuasion and the apostrophe caused the SQL query to break. I was dumbfounded but even then, at the back of my head all I thought was "I know I should report this, but no doubt they'll swing it against me". Needless to say, I said nothing, other than telling my girlfriend to a) try it without the apostrophe; and b) not to ever put any money in the account.
steve8918 15y ago
Actually I think the responses are right and I misspoke, it was pretty dumb of me. However, I did know at the time I was lucky not to get fired. I did think they were overreacting though, but in my defense, I was a dumb kid, and it was 1996 so security concerns weren't nearly as huge as they are now. The Internet was growing and popular, but 10% of what it was today, so things like security weren't really thought of except for Bugtraq which I was subscribed to, which gave me the inspiration to run l0phtcrack.

DanBC 15y ago

But what you did was not ethical, or sensible, or best practice; and was obviously going to get you into trouble. You're lucky you kept your job. There are ways you can raise concerns about security and yours was a bad way.

felipemnoa 15y ago

>>Of course, this ridiculous behavior by the banks will only make it more likely that any security breaches won't be reported Or people will simply release it in the wild for all to see and let the bank's asses burn

shabble 15y ago

You're lucky you're not Randall Schwartz[1], who performed an unauthorised security audit on some intel boxes, and ended up being convicted and spent something like 10 years (and a hell of a lot of money) getting the ruling overturned.[2] [1] https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Schwartz https://secure.wikimedia.org/wikipedia/en/wiki/Randal_L._Sch... [2] http://www.lightlink.com/spacenka/fors/ http://www.lightlink.com/spacenka/fors/

narcissus 15y ago

About 10 years ago my SO at the time was logging into an 'industry specific credit union' banking website for the first time. She called out to me to ask me about the error she was seeing on screen so I wandered over and couldn't believe my eyes... Part of the login credentials was the requirement for her surname which just happened to be of the Irish persuasion and the apostrophe caused the SQL query to break. I was dumbfounded but even then, at the back of my head all I thought was "I know I should report this, but no doubt they'll swing it against me". Needless to say, I said nothing, other than telling my girlfriend to a) try it without the apostrophe; and b) not to ever put any money in the account.

steve8918 15y ago

Actually I think the responses are right and I misspoke, it was pretty dumb of me. However, I did know at the time I was lucky not to get fired. I did think they were overreacting though, but in my defense, I was a dumb kid, and it was 1996 so security concerns weren't nearly as huge as they are now. The Internet was growing and popular, but 10% of what it was today, so things like security weren't really thought of except for Bugtraq which I was subscribed to, which gave me the inspiration to run l0phtcrack.