Hacker News Reader

Comment by Eliezer | Hacker News Reader

Legitimate banks don't get hacked? Is that true?

They've been getting hacked as long as there have been banks, it's just that they used to have to physically break in, rob the tellers at gunpoint, or commit fraud by assuming someone's identity (say, by forging their signature). Either way, there is a regulatory framework in place that ensures that the depositors are made whole in the event of a such a 'hack'.

Commercial banks do get hacked, it's a very well established fact. For obvious reasons they don't like to talk to the press about these things.

https://bitcoinfoundation.org/blog/?p=106

"I was told confidentially by an IT Security specialist from a major bank that the public would be shocked if they knew the amounts that are stolen daily from online financial institutions via ACH and wire fraud. Typically, breaches and total numbers are not revealed because they don’t want to advertise a weakness and they certainly don’t want to alarm customers. Some of the more vicious attacks are State sponsored. I believe him. That’s what bitcoin is up against as it progresses into the mainstream. The leading security experts are in that world, already protecting against the barbarians at the gate. They are not in the bitcoin world."

Bank accounts require identification and bank transactions have paper trails. Additionally international transactions have a lot of delays built in. Robbing a bank is probably safer then hacking one.

Legitimate banks don't get hacked via Rails exploits.

You don't hear of any high-profile bank disclosures, which I imagine is probably because they have security teams that keep up with everything religiously. Most old brick banks have internal systems architected in ways that a younger intruder in the Anonymous mold wouldn't know anything about, as well; you're starting to get into big iron Cobol land.

That said, I don't think it's an impossible task (is anything?), and I'm sure some day there will be a large disclosure through some means, internally-assisted or otherwise.

There was actually a high-profile incident not too long ago with one of the big banks' online banking system. Users could view other people's account information just by incrementing an integer in the URL as I recall. It's not necessarily so much that banks are secure, but hacking them is much riskier than hacking Bitcoin sites, especially for white-hats.

Are you thinking of Heroku? Heroku isn't a bank.

It was probably Santander: http://www.h-online.com/security/news/item/Santander-s-onlin..., though there have been other instances of bad bank web practices.

Putting plaintext passwords in a cookie doesn't sound anything like incrementing an integer in a URL.

Nothing is impossible, but remotely hacking a bank is pretty damn close. A number of years ago, a friend worked for a large multi-national bank. He once described to me some of the key components of the security system. While the details are hazy (such as I understood them at the time), I do remember that one of the key points was that one of the "very important" servers that handled transactions between outside entities (i.e. other banks) and internal systems was double-firewalled. That is, you couldn't initiate connections from the internet or the intranet. The server would only make connections to hosts of its own choosing, on its own schedule.

Modifying or updating anything on the server required physical access.

That server was located in a secure vault.

Reply on news.ycombinator.com