Hacker News Reader

Comment by viraptor | Hacker News Reader

I did it scheduled past midnight, from "abroad", from known AWS us-east ranges, with headless resolution set to 1000x1000, completely ignoring their browser detection JS, identifying as either curl or "bank bot", not following links and redirects, causing lots of unexpected failures which should be impossible with a normal browser while developing my scripts. (including 503s from bad csrf token passing)

Basically if there was any check, I would fail it. I did that on purpose - better to know immediately than get silent failures later on. I really don't know what else I'd have to do to trigger "this it not a real person" detection.

View on HN

So, am coming back, more than a little humbled...

This security story from Canada came out Friday

https://www.theregister.co.uk/2019/09/18/scotiabank_code_git...

am with an FI (financial institution) in the great white north (I am, of course, not speaking for them in any way here) so this is all very very humbling. One theory that I have heard through my network is that event may be the result of agile / sprint work outside regular process ... but it is an unconfirmed rumor... and I do know for a fact that not all platforms are like this...

The assessment of security capability from the guy who found the code + credentials in the wild is brutal! - '"In my experience, this muppet-grade security is perfectly normal for Scotiabank, as they usually leak information once every three weeks on average," Coulls mused.'

Thanks for taking the time to explain this: it does indeed seem clear that they are just doing username and password detection for access.

A followup question: I have lived in Europe and have accounts in banks in Ireland. For those accounts, actually executing any financial transaction requires entering a one time token generated by a device that uses your debit card and PIN.

Like so:

https://www.youtube.com/watch?v=kEOEQzC8-Fc

Do the banks you tested have a similar setup?

Just trying to find out if these specific banks have chosen to control view transactions with just the username / password but require some other additional authentication for actual financial transactions.

None of them required extra authorisation to get data. (even transactions going back 5+ years) They did have the SMS validation when adding new transfer targets, but not for executing transactions to existing contacts - which is potentially an issue if you can pay off a different credit card just by changing the reference field.

Nice setup. Did you make it do something security-critical like change your address or even transfer money?

Mostly export statements and very rarely do transactions.

Reply on news.ycombinator.com