BigBankCo Security Ain't Exactly Fort Knox

[sirwired]

I have my credit card with BigBankCo set up so that I get a text for every single transaction. (I simply set up an alert for any transaction $0.01 or over...)

Well, Monday morning I wake up and sit down to check my e-mail, and because I use Google Voice, all my texts appear in my GMail Window. I have two texts from 3AM waiting for me from my credit card: one for $40 from match.com (I'm 14 years happily married!), and one for around $3,000 (not a typo) from some random online store in Kuala Lumpur. (Neither I nor LadyWired have ever traveled to Southeast Asia.)

Well, I've been through this particular rodeo before, so I instantly call BigBankCo and work my way through to the fraud department. (Their VRU is terrible!) I report the fraudulent charges, and mention to the operator (emphasizing that I know she had nothing to do with it) that BigBank must have the absolute worst fraud detection software in the universe for letting through a charge on the other side of the globe for several $k without clearing it with me first. (I mean, they've called me in the past for $60 at the Best Buy ten minutes from my house...)

She thinks for a second, agrees, and typity-types for a while, and comes back with "Well, we denied it twice, but cleared it on the third try after the charge was verified." Me: "Verified? How? I certainly didn't verify it!"

While she's typing some more, I absentmindedly browse through my e-mail and see an e-mail from BigBank confirming that I've changed my e-mail address to Firstname.Lastname@WebMailProviderINeverUse.com

I mention this to her and ask her if that has something to do with it, and, by the way, I most certainly did not change my e-mail address. She confirms that the charge was "verified" by somebody clicking on a link in a verification e-mail.

Much typing and back-and-forth later, and two transfers to other departments, and I learn something very interesting: While their website is buttoned down like Fort Knox, with security questions, two-factor authentication, etc., all you need to do to change my e-mail address is have their customer service phone number, the account number, CID (which any fraudster will of course have already), and the last four digits of my SSN (which I have to give out SO many places, it might as well be the last four digits of my phone number!) That's it.

That's right, the website is locked down HARD, but you can get customer service reps to change your e-mail (providing a gateway to fraud) with the end of my SSN. I comment that fraudsters do not, in fact, want to read my online statement or pay my bill; they want the money, and it doesn't make any sense at all to let somebody completely bypass their fraud detection with such easily-obtained information.

FWIW, they have now set up a "security word" and any future interactions over the phone with them cannot be done without it. Talk about shutting the barn door after the $3k horse just ambled out the door...

The poor lady on the phone did agree with me that the last four of your SSN was indeed pretty pathetic security if it allows somebody to loot your account blind, and promised to send a request up the chain to have it fixed...

[MoonCat]

OMG somebody dropped the ball big time on this! Hope it's fixed SOONEST.

[lordlundar]

See, this is why I dislike how modern media portrays "hackers". They run under the concept that it's a person furiously typing away at a keyboard discovering the secret access port that no one knew about. Nope, easiest access into any network is by pretending that you're already allowed in.

It's why the fundamental rule for IT is "if you can't prove you're already allowed beyond the smallest inkling of a shadow of a doubt (court cases wished they had this level of requirement), then the only way you're getting in is over my dead body. To add, in that respect it won't do you any good because I'm going to make sure you're coming to hell with me."

[Crai]

See, this is why I dislike how modern media portrays "hackers". They run under the concept that it's a person furiously typing away at a keyboard discovering the secret access port that no one knew about. Nope, easiest access into any network is by pretending that you're already allowed in.

It's why the fundamental rule for IT is "if you can't prove you're already allowed beyond the smallest inkling of a shadow of a doubt (court cases wished they had this level of requirement), then the only way you're getting in is over my dead body. To add, in that respect it won't do you any good because I'm going to make sure you're coming to hell with me."

Truth on my network lol.

[BPFH]

See, this is why I dislike how modern media portrays "hackers". They run under the concept that it's a person furiously typing away at a keyboard discovering the secret access port that no one knew about. Nope, easiest access into any network is by pretending that you're already allowed in.

Hell, the "furiously typing" part is inaccurate, even if you can't use social engineering. Part of a former job of mine was reverse-engineering data file formats. Sometimes that meant hacking the program that produced the file, which meant you were spending a lot of time staring at the screen, trying to figure out what they're doing this time.

It could take days, like for the competitor that came up with a two-level encryption scheme, with the key for the first level being used to encrypt the keys for the second level, which in turn encrypted the actual data. Or it could take hours, like for the competitor that used encrypted .zip files that all used the same password, and had the password hard-coded into the executable. But in neither case was furious typing involved...

[notalwaysright]

Yeah, it's a bit scary how simple most "hacking" is. One of my teachers has a long running bet that if he randomly walks into any regular office, he can figure out the password. He doesn't even use logical guesses, like looking at pictures or books. He just looks under the keyboard and in drawers and such. He hasn't been beaten yet. And of course there's this.

It's not great how easy it was to get the email changed. I'll say that my mom gets a bit testy when she's asked for her social constantly. She knows it's not the phone support person's fault, but she can't quite hide her irritation. And she's right... Once you start giving it out as normal procedure, it stops being a secret, and then it loses any security it had.

[Daskinor]

I had to deal with once upon a recent time.

All the data inside an AS/400.

The passwords for the AS/400 where in PW protected access 97 file. In a network folder, anyone had access to if they knew what the hidden directory was called. The Access File was called MainFrmPWs

[BPFH]

I had to deal with once upon a recent time.

All the data inside an AS/400.

The passwords for the AS/400 where in PW protected access 97 file. In a network folder, anyone had access to if they knew what the hidden directory was called. The Access File was called MainFrmPWs

They actually used Access 97 to protect (excuse me, "protect") other passwords? That's a hacker's delight.

Seriously. An Access 97 database password was at most 20 (IIRC) characters long, and was stored at a particular offset in the .mdb file (I want to say offset 65, but don't quote me on that). No, it wasn't in plaintext - even mid-to-late 90s Microsoft with its marketing-driven focus on features over security knew better than that - but it was the next best thing: XOR encryption. So all you had to do to retrieve the password was grab the 20 bytes starting at the appropriate offset, XOR them with the 20 bytes that were there before the password was set (those 20 bytes were the same across all Access 97 files), and presto! You've got the password. Or if you were feeling particularly malicious, just write a null character to the password offset, and Access 97 would let you in without the password.

Later versions (when they moved to the .accdb format) were a bit better, but still...

[Daskinor]

I did make them change all the passwords when I found out about it, and put them in a keypass file.

But for almost 20 years..... yea.

[Ironclad Alibi]

Back before I retired I had to change my office computer passwords every 6 months. The passwords I choose were the names of Confederate ships, pictures of which I had on my office walls.

But even if a hacker figured it out, they wouldn't get to the files I wanted protected. They were on floppy disks locked in my desk drawer.

Since I retired I use an entirely different password scheme.

[MadMike]

A few years ago, I checked my email and found it flooded with all sorts of gibberish messages. There were literally tens of thousands of the damn things. And they just kept coming. While I was going through and trying to clean up the mess, I noticed a couple of emails that looked legit: One from Bill Me Later, confirming an address change, and another one from Apple confirming an order, and another one from them telling me it had shipped. I had not changed anything on my Bill Me Later Account, nor had I ordered anything from Apple. At first, I thought they were scams, but upon closer inspection, they looked like the real thing. So I figured that the two were connected, and someone was mailbombing me to try to keep me from seeing the other emails.

The first thing I did was called Bill Me Later and told them what happened. They confirmed that someone had called in to have my address changed, after giving them my correct date of birth and last four digits of my SSN. They closed my account and sent out some forms so I could file a fraud report.

Next, I called Apple and told them what happened. They confirmed that an order had been placed in my name using Bill Me Later. They assured me I wouldn't be responsible, but unfortunately, the order had already shipped. I just hope that they were able to stop it at the post office so the scammer wasn't able to get their hands on it.

Finally, I called my ISP about the mailbombing. I wasn't sure if they could do anything, but I figured it was worth a shot. I was trying to clean up the mess, but the junk was coming in faster than I could delete it. They told me they'd "create an incident report" and see what could be done. Shortly after that, the junk slowed down to a trickle and eventually stopped, so I don't know if they were able to stop it, or if it was just a coincidence.

What really sucks is that I can never have another Bill Me Later account. Unless they've changed things, all you need to open an account is your DOB and the last four of your SSN, and that's been compromised. The scary part is that those piece of information are floating around everywhere these days, as someone else pointed out. There's a lot of that information available at my job, and if I was a dishonest person, I could open up a million Bill Me Later accounts.

[Dreamstalker]

I could probably do a lot with what I've overheard on public transit. So many places use SSN as an identifier...the only entities that should have direct access to that that number is the IRS and banks. Until recently my state used one's SSN as the ID number on licenses.

Our bank once almost handed over someone else's account. I was given the wrong deposit receipt, and while it only has the last 4 digits of the account, I knew the first four (common across all 'standard' checking accounts) already. Chances were good that any one digit would result in an active account...not that I had the social engineering skills to pull anything off but was just curious how far I--or anyone--could get.

When mom let the bank know of the mistake they didn't seem all that concerned about it...

[Aragarthiel]

The first high school I went to used to put students' social security numbers on the report cards. It wasn't until I pointed it out to another student in the middle of my sophomore year that the news got passed through the school, and the next set of report cards had those numbers blacked out with permanent marker. In other words, someone thought it would be easier to print 500+ report cards and, one by one, mark the social security numbers out instead of not adding them in the first place.

[vikingchyk]

Long, boring ancedote

I could probably do a lot with what I've overheard on public transit. So many places use SSN as an identifier...the only entities that should have direct access to that that number is the IRS and banks. Until recently my state used one's SSN as the ID number on licenses.

I almost got into a yelling match over providing my SSN recently. I just bought a new car at the end of March, and while working on paperwork, one of the things the dealer tried to slip by me was a loan application.
Ummm, I'm paying cash, I don't need to fill this out.
- Yes you do, we need to report the information to the state.
Then there should be a different form, this is YOUR form, not a state form. I'm not filling this out, and I'm not giving you my SSN.
- But we're not going to do anything with it!
Then you don't need it.
- But it's a state law!
Show me.
{We go a few more rounds like this, then the salesguy gets a finance guy to come over an mansplain it to me }
- It's a state law!
Then find me the proper form. I'm not filling this out.
...
...
- But you have to because blahblahblahblahbogosity, do you understand?
No.
...
...
- But it's the law! Everyone has to do this! It's for security.
What?
- To make sure you can legally buy this car
WHAT? {oh, so now you're implying I'm, what, a money laundered or something??}
- they have to check that you're not, umm, uh...
I'm not filling out this form, and I'm not giving you my SSN. If the state needs it, it already has my SSN. You do not need to collect this information.
- But we're going to destroy this form as soon as it goes into our system!
There is no reason this information needs to go into your system. I am not giving you my SSN.
- Ummm... let me check something

{and, miraculously, he comes back a few minutes later, saying I don't need to fill that info in on the form, if I just fill out my name and address. I'm still not happy, because the form clearly says loan application. Ugh. Just give me my damn car and let me out of here. I cross out the SSN section and several other things they originally wanted me to fill in, and only put in my address, then sign it. The icing on the cake is I'd already been there for nearly 4 hours, I hadn't had an afternoon snack, and as I'm diabetic, I was hitting low blood sugar. So, I'm not going to get less stubborn about this, pal. Got a sugary drink in their vending area and spaced out until I felt better, while they worked on other paperwork. And I didn't take the car with me, cos they had to install some stuff before I could take it home, anyway. Let me out of here! }