[HN Gopher] Stealing checks worth millions and pwning a bank
       ___________________________________________________________________
        
       Stealing checks worth millions and pwning a bank
        
       Author : vbisbest
       Score  : 97 points
       Date   : 2022-05-16 11:49 UTC (11 hours ago)
        
 (HTM) web link (www.jhaddix.com)
 (TXT) w3m dump (www.jhaddix.com)
        
       | triyambakam wrote:
       | The story ends inconclusively. I was expecting to know what the
       | bank's reaction was or if they ever addressed these issues.
        
         | MerelyMortal wrote:
         | Also, aren't the checks worthless at that point, since they've
         | already been cashed?
        
           | wiredfool wrote:
           | Yes, It's pretty difficult to deposit check images in bulk
           | for other people's accounts.
           | 
           | There's still a privacy issue, and if he ran OCR on them,
           | he'd have a bunch of account numbers, which would also be
           | bad.
        
             | [deleted]
        
           | IncRnd wrote:
           | No, of course they aren't worthless. They give you the
           | routing number, account number, and next check number in
           | order to print your own fake checks on other people's
           | accounts.
        
             | MerelyMortal wrote:
             | Sure, there is some value in the information printed on the
             | checks, but they're worthless because they can't be
             | redeemed as they've already been redeemed. These checks
             | cannot be "stolen" for "millions" contrary to the title.
        
           | toast0 wrote:
           | Kind of depends. In addition to using using them to forge
           | more checks (as discussed in a sibling comment), if you pull
           | them in real time, you can race to cash them first, and you
           | can sometimes present the same check multiple times and get
           | it cashed.
           | 
           | Of course, any of those options are going to end up with
           | transactions reversed eventually, so you've got to have a
           | quick exit planned.
        
       | doesnotexist wrote:
       | "The web app was so sensitive in nature I can't really even
       | describe the contents, but it was a big find by itself."
       | 
       | Maybe that's true, and certainly the vulnerabilities described in
       | more detail are already quite a big deal, but the author probably
       | should have omitted the above quote from their post as it leaves
       | the reader with some suspicion that perhaps this is a bit of a
       | "Fish Story" (fisherman exaggerating the size of the fish they
       | caught)
       | https://www.urbandictionary.com/define.php?term=Fish%20Story
        
         | ballenf wrote:
         | My first thought was that it was just an admin dashboard that
         | was poorly attempted to be hidden by obscurity. It probably was
         | thrown together during migration to work from home.
        
         | blueflow wrote:
         | Its self-promotion. Basically an ad for themselves. IMHO as
         | annoying as an ad, except HN allows me to downvote it.
        
           | more_corn wrote:
           | I like it because it describes how specifically the
           | vulnerabilities were found and what specifically they were.
           | If you're doing security review or building a secure tool
           | there are 5 items for your checklist.
        
             | blueflow wrote:
             | They are bad mistakes that should have never have passed
             | QA. Think a bit. Pentesting only makes sense if you don't
             | have a functional QA.
             | 
             | Its like hiring a guy with a sledgehammer to test the
             | stability of your bridge. You should hire a structural
             | engineer instead, before building it. If the guy with the
             | sledgehammer is successful, you should never have built the
             | bridge in the first place.
        
               | toss1 wrote:
               | True, _IF_ software were actually built like bridges, as
               | in actually engineered, effects calculated, simulated,
               | and tested ahead of time, according to required
               | standards, only by people who are trained. licensed, and
               | insured to do such work, and with the expectation that it
               | will be built once (not updated with patches on an ad-hoc
               | basis). Oh yes, and all subject to strong liability.
               | 
               | Instead we have project who care only about shipping
               | their latest favorite features yesterday to meet the
               | over-promised new capabilities to the new client/market,
               | and figure any problems will get caught with the update
               | cycle, and the coders scrambling to ship the first thing
               | that'll compile and pass the test screens, with QA being
               | a minimally funded function as yet another cost center to
               | be minimized... Oh, and all liability for failure is
               | disclaimed or fobbed off on the consumer for their
               | failure to maintain proper opsec. Oh, and in many cases,
               | the blame is put squarely on anyone who finds such a
               | fault instead of on the builder (e.g., when the governor
               | recently tried to jail a journalist who found an
               | egregious flaw in a state website).
               | 
               | So, yeah, it _SHOULD_ never be the case if there were
               | proper development and proper QA. But it hasn 't happened
               | in a half century of large commercial software. So, we do
               | really need pentesters. They're just delayed QA after
               | all.
        
               | pixl97 wrote:
               | You're assuming some companies have ways of testing their
               | QA effectiveness. Especially in the case where your
               | structural engineer is incompetent.
        
               | curiousllama wrote:
               | Think a bit more. Why have QA? If there are bugs, the
               | SWEs should have caught them with their test suite. Think
               | even more. Why bother with a test suite? The code should
               | be written correctly the first time. (this is sarcasm)
               | 
               | People make mistakes. Systems fail. Pen tests exist to
               | find out if your people are making mistakes, and if your
               | system is failing.
        
               | blueflow wrote:
               | It works like this in every other engineering discipline.
               | Except for software, were we somehow pretend that these
               | level of bugs are something normal.
               | 
               | Even the avionics and carmakers get software right, why
               | cant we?
        
       | confident_inept wrote:
       | It's 2022, can we please stop saying 'pwned'?
       | 
       | Sure, I'll take the karma hit for this comment.
        
         | [deleted]
        
         | vmception wrote:
         | I'm down for using it in limited circumstances, like maximum
         | pwnage, like when a university or municipality gets all of
         | their computers ransomwared and negotiations fail with all the
         | data being deleted with no backup.
         | 
         | But only in an off the cuff remark as a passive observer,
         | amused by the circumstance and grandstanding necessary to fail
         | so hard.
        
         | toolz wrote:
         | You could always make/install a browser extension that replaces
         | the word with one you like if you find it offensive.
        
         | bozhark wrote:
         | Pawned? He sold it at a massive loss?
        
         | Agamus wrote:
         | Allow me my fantasy: I imagine you are a younger, polite,
         | curmudgeonly person who sadly missed the bouncy joy of this
         | word when it was fresh. This fantasy makes me want to keep
         | using this annoying word that I somehow love.
        
         | bilekas wrote:
         | Have my upvote. I concur. The article doesn't really "pwn" in
         | the true sense of the word anyway but that's secondary.
        
         | [deleted]
        
         | ziddoap wrote:
         | What does it being 2022 have to do with it? Do colloquialisms
         | have pre-determined expiration dates?
         | 
         | I guess Troy Hunt didn't get the memo either.
        
       ___________________________________________________________________
       (page generated 2022-05-16 23:01 UTC)