24 June 2017
download the report now

Citigroup hackers broke in through the public Website - NYTimes

15 June 2011  |  11257 views  |  0 arrow on screen

The hackers who made off with the personal account data of 200,000 Citigroup customers allegedly broke into the bank via its public Website, focussing on a simple vulnerability in the browser address bar.

One of the investigators working on the breach has told the New York Times that the attack was both simple and ingenious.

The NYTimes source, billed as a "security expert familiar with the investigation", said the attackers logged on to the part of the bank's site reserved for credit card customers - and substituted their own account numbers which appeared in the browser's address bar with other numbers. Using a computer-based random number generator, the hackers created tens of thousands of possible account numbers, which opened the door to the profiles of other customers.

Citi confirmed the breach last week, saying that names, account numbers and e-mail addresses had been compromised but not birth dates, social security numbers and card security codes, which are held elsewhere.

Thieves found Citigroup site an easy entry - New York Times

Finextra verdict: If true - and the NYTimes is careful to mask its source - this a truly embarrassing security failure for Citi. Inserting customer account numbers into the visible display bar on the browser is a basic error. Heads must roll.

Comments: (0)

Comment on this story (membership required)

Finextra news in your inbox

For Finextra's free daily newsletter, breaking news flashes and weekly jobs board: sign up now

Related stories

Hackers hit Citi card customers

Hackers hit Citi card customers

09 June 2011  |  8810 views  |  0 comments

Related company news

 
visit vasco.com/news/PSD2-compliant-solutionsdownload the report nowvisit www.events.sap.com

Top topics

Most viewed Most shared
Live: EBAday 2017, day twoLive: EBAday 2017, day two
9346 views comments | 4 tweets | 5 linkedin
Worldpay pilots app-only mPOS for small retailersWorldpay pilots app-only mPOS for small re...
9059 views comments | 18 tweets | 27 linkedin
Live: EBAday 2017, day oneLive: EBAday 2017, day one
8514 views comments | 3 tweets | 4 linkedin
UK banks will need to change one million sort codes under ring-fencing rulesUK banks will need to change one million s...
8058 views comments | 8 tweets | 25 linkedin
What Banks and their customers can expect for the futureWhat Banks and their customers can expect...
6910 views comments | 7 tweets | 10 linkedin

Featured job

Six Figure Base + Commission + Stock Options
London

Find your next job