5 ms·
Stealing checks worth millions and pwning a bank
- doesnotexist 4y ago"The web app was so sensitive in nature I can’t really even describe the contents, but it was a big find by itself." Maybe that's true, and certainly the vulnerabilities described in more detail are already quite a big deal, but the author probably should have omitted the above quote from their post as it leaves the reader with some suspicion that perhaps this is a bit of a "Fish Story" (fisherman exaggerating the size of the fish they caught) https://www.urbandictionary.com/define.php?term=Fish%20Story https://www.urbandictionary.com/define.php?term=Fish%20Story
- ballenf 4y agoMy first thought was that it was just an admin dashboard that was poorly attempted to be hidden by obscurity. It probably was thrown together during migration to work from home.
- blueflow 4y agoIts self-promotion. Basically an ad for themselves. IMHO as annoying as an ad, except HN allows me to downvote it.
- more_corn 4y agoI like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.
- blueflow 4y agoThey are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
- pixl97 4y agoYou're assuming some companies have ways of testing their QA effectiveness. Especially in the case where your structural engineer is incompetent.
- curiousllama 4y agoThink a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
- blueflow 4y agoIt works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?
- thomjrob 4y agoWhat? Avionics and carmakers definitely don't get software right...
- paulryanrogers 4y agoOther engineering fields don't do independent third party testing? Do they deploy multiple times daily? Deal with vague sometimes contradictory client requirements? Do their tools and platforms change daily?
- curiousllama 4y agoFunny you mention carmakers. Wouldn’t a crash test be the carmaker equivalent to a penetration test?
- blueflow 4y agocrash tests verify what the designers already predicted. You don't blindly construct a car and then crash-test it to safety in a trial & error manner.
- confident_inept 4y agoIt's 2022, can we please stop saying 'pwned'? Sure, I'll take the karma hit for this comment.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- bilekas 4y agoHave my upvote. I concur. The article doesn't really "pwn" in the true sense of the word anyway but that's secondary.
- toolz 4y agoYou could always make/install a browser extension that replaces the word with one you like if you find it offensive.
- bozhark 4y agoPawned? He sold it at a massive loss?
- Agamus 4y agoAllow me my fantasy: I imagine you are a younger, polite, curmudgeonly person who sadly missed the bouncy joy of this word when it was fresh. This fantasy makes me want to keep using this annoying word that I somehow love.
- vmception 4y agoI'm down for using it in limited circumstances, like maximum pwnage, like when a university or municipality gets all of their computers ransomwared and negotiations fail with all the data being deleted with no backup. But only in an off the cuff remark as a passive observer, amused by the circumstance and grandstanding necessary to fail so hard.
- ziddoap 4y agoWhat does it being 2022 have to do with it? Do colloquialisms have pre-determined expiration dates? I guess Troy Hunt didn't get the memo either.
- triyambakam 4y agoThe story ends inconclusively. I was expecting to know what the bank's reaction was or if they ever addressed these issues.
- MerelyMortal 4y agoAlso, aren't the checks worthless at that point, since they've already been cashed?
- wiredfool 4y agoYes, It's pretty difficult to deposit check images in bulk for other people's accounts. There's still a privacy issue, and if he ran OCR on them, he'd have a bunch of account numbers, which would also be bad.
- deleted 4y ago[deleted]
- IncRnd 4y agoNo, of course they aren't worthless. They give you the routing number, account number, and next check number in order to print your own fake checks on other people's accounts.
- MerelyMortal 4y agoSure, there is some value in the information printed on the checks, but they're worthless because they can't be redeemed as they've already been redeemed. These checks cannot be "stolen" for "millions" contrary to the title.
- IncRnd 4y agoThe checks disclose 100% of the information that is needed to write new checks against the accounts. Those accounts could be completely drained from this. That accords with the title.