Bank sues victim of $800,000 cybertheft | Hacker News Reader

Bank sues victim of $800,000 cybertheft

computerworld.com

12 pointsilamont10 comments

"The complaint itself is somewhat unusual in that it doesn't seek anything specific from Hillary. Rather, all it asks is for the court to certify that [the bank's] systems are reasonably secure."

Presumably the victim's credentials (likely just a password or PIN, and possibly the proper response to a "secret question") were obtained with a trojan keylogger or some other means. The question is who's fault is that? Not really the bank's. The bank's claim that they honored a properly authenticated transaction is not completely unreasonable.

What the court is really being asked to decide is whether simple password authentication is "reasonably secure." What are the alternatives? Seems that they'd have to use a physical smart card or fob device to generate one-time passwords, or use an alternate communication channel (email? SMS?) to verify that the authorized user is attempting to authenticate. Any of which substantially decreases the perceived usability of the system by a typical business customer.

No it's not unreasonable that they honoured the transaction. However my bank, HSBC, required me to call and contact them to make debit withdrawals over $400 when outside the country. Their approval period only lasts for 6 months (the length of time you're legally allowed to stay in most foreign countries) before renewing it.

At the time I also had to clarify that I would be making wire transfers to a foreign account. I believe my parents had to do the same from their bank when they transferred over 10K into their own foreign account.

Why UK banking has these protocols in place for consumers that are far likely to transfer money over seas is bizarre if they're not in place for business. However, this could likely be due to different banking regulations. I know I've heard people being warned against getting US bank accounts here in Canada, they recommend getting a US-Dollar account with international transaction fees waved as you're money is, allegedly, a lot safer.

I doubt there is really a usability decrease.

A former bank of mine implemented a system where: (1) you were highly advised to enter your banking pin via mouse using a pad; (2) in addition to entering your password, you also had to have a further passphrase, from which you would be prompted to enter a few characters at random indexes; (3) you could not simply wire funds to any random account; you first had to "add" that account "as beneficiary" -- and this "add" action had to be confirmed via a code SMS'd to you by the bank.

Not to say this makes things completely secure, but it certainly raises the barrier.

This was deployed 7 years ago by a third-world-country bank, afaik its still in effect today.

They are presumably trying to set precedence. The East Texas District Court is notorious for upholding software patents, this is the area where many patent trolls have set up shop. It wouldn't surprise me if the bank thinks that it will have a good chance of being favored in the case, and because it's a federal court, a ruling could have a much wider reaching impact.

My bank wouldn't let 1% of that money to leave my account without calling me to verify.

Some banks even send clients an SMS after each transaction, just in case.

So in this case, because of the amount, I think it was really the bank's fault.

Security by legal declaration? Not very confidence-inspiring.

Very true.

It seems like the bank has a security system in place whereby only authorize computers with credentials may log in - not just a username and password. These computers need access to the accounts to be enabled by the bank, initiated by an email.

The fraudster spoofed Hillary's email address from IP addresses located in Romania and Italy. You would think the bank would have an adequate verification process (and done their due dilligence, such as a phone call) to determine that these emails were spoofed - red flags should have been going up everywhere.

If this is the state of security at that bank, keeping your money there is about as safe as keeping it in a suitcase on the street corner. All you've got going for you is security by obscurity.

The article mentions that the bank had gotten requests to register two new computers for the company that was sent from the company's internal email. This makes me think that their bank credentials weren't the only thing compromised. This in turn suggests that the company's security practices could be improved.

I suspect the end result of lawsuits such as this will be more legislation, especially if they are ruled in favor of the banks.

Reply on news.ycombinator.com