Revealed: How Citigroup hackers broke in 'through the front door' using bank's website
By Lee Moran
Last updated at 2:16 PM on 14th June 2011
Hackers who stole the personal details of more than 200,000 Citigroup customers 'broke in through the front door' using an extremely simple technique.
It has been called 'one of the most brazen bank hacking attacks' in recent years.
And for the first time it has been revealed how the sophisticated cyber criminals made off with the staggering bounty of names, account numbers, email addresses and transaction histories.
They simply logged on to the part of the group's site reserved for credit card customers - and substituted their account numbers which appeared in the browser's address bar with other numbers.
It allowed them to leapfrog into the accounts of other customers - with an automatic computer programme letting them repeat the trick tens of thousands of times.
The security breach, which was only spotted in May during a routine check, follows the high profile and embarrassing hacking of Sony's Playstation network.
Security experts said it also showed the threat posed by the rising demand for private financial information from the world of foreign hackers. It was also a 'sign of things to come', they said.
One expert, who is part of the investigation and wants to remain anonymous because the inquiry is at an early stage, told The New York Times he wondered how the hackers could have known to breach security by focusing on the vulnerability in the browser.
He said: 'It would have been hard to prepare for this type of vulnerability.'
It is not known how much the incident is going to cost Citigroup and its customers.
Spokesman Sean Kevelighan declined to comment as it was an 'ongoing criminal investigation'.
But in a statement he said Citigroup discovered the breach in early May and the problem was 'rectified immediately'.
He also said the bank had initiated internal fraud alerts and stepped up its account monitoring.
Law enforcement officials said the expertise behind the attack was a 'sign of what is likely to be a wave of more and more sophisticated breaches' by high-tech thieves.
This is because, according to a report by Verizon and the Secret Service, the demand for data is on the rise.
In 2008 the underground market for data was flooded with more than 360 million stolen personal records, compared to just 3.8 million in 2010.
As the credit cards, whose numbers were stolen in 2008, expire, there is a rush to find new accounts.
It could see the price for basic credit card information rise from their current level of only pennies to several dollars.
Bryan Sartin, forensic investigator for Verizon's consulting arm, said: 'If you think financially motivated breaches are huge now, just wait another year.'
The hackers which targeted Citigroup did not gain expiration dates or the three-digit security code on the back of the card.
Those two elements would have made it much easier for the thieves to use the information to commit fraud.
Comments
Post a Comment