Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tesco Bank halts online payments after money was taken from 20K accounts

bbc.co.uk

Post reply on HN
Print view View original

111–120 of 174 posts

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#111

Post by TACIXAT »

spydum wrote: post #3
joosters wrote: post #2

I wonder what the security flaw was? It is interesting that all the customers are still allowed to use their cards for cash withdrawals and payments, and they can all still log in to their online accounts. There doesn't seem to be any mention of a system-wide password reset. So... it sounds like there wasn't a widespread theft of account credentials, and that the attack was some kind of weakness in the bank's online…

could be entirely a software bug? Though I tend to agree that it looks worse than that.

This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser.

    /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$
It would actually be really interesting if they faxed in transfer forms or something.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#112

Post by [deleted] »

joncrocks wrote: post #83
simonvc wrote: post #63

Earlier quoted context omitted.

Tesco ask you to log on with "character 2 and 4 from your password" which sort of implies they must store the password in clear text (unless some kind of zeroknowledge/homomorphic encryption magic i've not heard of.)

Depending on the length of the password, it's possible to encode/hash (+salt) all possible outputs of challenge combinations at the point of storing your password. It's a bit like having a number of related passwords, which the bank can ask you for any of them, and then verify is correct.

[deleted]

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#113

Post by johansch »

johansch wrote: post #84
parenthesis wrote: post #71

Earlier quoted context omitted.

The UK doesn't import everything.

No, but quite a lot. "Overseas Trade Statistics. In July 2016 the value of exports (EU and Non-EU) decreased to £23.9 billion, and imports (EU and Non-EU) decreased to £39.7 billion, compared with last month. Consequently the UK is a net importer this month, with imports exceeding exports by £15.9 billion." https://www.uktradeinfo.com/Statistics/OverseasTradeStatisti...

So, (brits), why did you downvote this without commenting?

(It went from +3 to 0.)

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#114

Post by johansch »

brador wrote: post #76
parenthesis wrote: post #71

Earlier quoted context omitted.

The UK doesn't import everything.

Whether you like it or not the USD is the world peg right now and a currencies worth in USD is its true measure of inflation. What the national bank prints is negligible in comparison.

They seem to be in full self denial mode right now.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#115

Post by verbify »

mcbuilder wrote: post #50
simonh wrote: post #48

Earlier quoted context omitted.

I don't understand why you're subtracting inflation. Yes I know doing so gives you the 'real terms' increase in value, but if you stuff £3,000 in a mattress and pull it out after a year you don't notionally add inflation to it's value when comparing it to the value of savings. The savings in that account would still be 3% more than your mattress money, not 2.4% more. Unless you're comparing it to spending all the mon…

He's probably subtracting inflation to make the interest rate of Tesco relative to the rest of the economy. Stuffing money in a mattress is a pretty poor idea when it should be very easy to find an investment scheme that covers inflation.

But investing in 'the economy' generally means investing in the stock market. Which introduces risk, which isn't great for an emergency fund - and you'll no longer be covered by FSCS.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#116

Post by nommm-nommm »

distances wrote: post #86
nommm-nommm wrote: post #44

Earlier quoted context omitted.

OK while I am a big fan of multiple bank accounts (I have three, all for different purposes) this advice is total overkill and inappropriate for anyone who isn't financially stable, which unfortunately, is half of Americans. Two different countries? No thanks, I'm not screwing with that nightmare. I'd like to keep my money in the form of US dollars, I have no need for foreign currency and I don't want to waste money…

Perhaps the suggestion was made from an European standpoint? Two accounts in Euros within the SEPA area [1] means no costs for currency conversions or bank transfers between your accounts. [1] https://en.wikipedia.org/wiki/Single_Euro_Payments_Area

Well, the bank in question holds GBPs, converting to/from Euros to GBPs seems incredibly inconvenient and has no real benefits. Most people get their wage in a single currency and use a single currency in their every day lives.

I have a family member who gets their pension in Canadian dollars but lives in the US. Since he lives in the US he has no need for Canadian dollars. He says that his money loses a quarter of its value converting from Canadian dollars to US dollars. I don't know if that's true, its what he told me.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#117

Post by jameshart »

elcct wrote: post #24

> Tesco Bank is stressing that relatively small amounts were taken from 20,000 accounts If someone is living month to month, said £500 missing could be very serious complication of life and £25 "emergency fund" is a joke. I personally doubt a wealthy person would use that bank and yet they seem to think their customers are pissing gold.

Another way to look at it is that a relatively large amount of money was taken from Tesco, and Tesco has simultaneously been fooled into reducing the reported balance on 20,000 customer accounts.

The difference is between whether this is seen as a bank robbery, or a series of minor incidents of identity theft.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#118

Post by dogma1138 »

alex_anglin wrote: post #68
laumars wrote: post #53

Earlier quoted context omitted.

In many instances the amount taken is significantly more than £500 too. One colleague has had £800 taken. He's quite stressed right now.

Wouldn't that be covered under deposit insurance?

Tesco is a bank for effectively the working poor, young and migrant workers that cannot open an account at a normal highstreet banks.

These are people who may have to pay rent more than once a month, have direct debits for bills and more likely than not not have an overdraft over 100£ if at all.

If your bills bounce you will end up with fines, and even a lower credit score than the one which prompted you to open an account with Tesco in the first place.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#119

Post by dogma1138 »

conjectures wrote: post #110
johansch wrote: post #79

Earlier quoted context omitted.

I'm wondering why the individual the amounts were so (relatively speaking) small? Perhaps some strategy to avoid tripping warning systems. Do you know if the the £800 was all there was in that particular account?

An interview with Tesco exec on Radio 4 this morning suggested something like this was going on. Obvs they don't say what their detection rules are. Which makes you wonder how the attackers gamed them (inside info, or reverse engineering after compromising many accounts?)

Honestly based on the average amount in a checking account at a bank like this they probably could've drained the entire balance without triggering any limits.

Re: Tesco Bank halts online payments after money was taken from 20K accounts

#120

Post by nthcolumn »

andybak wrote: post #82

I know banking and retail are separate but as an organisation Tesco hasn't got a good history for security: https://www.troyhunt.com/the-tesco-hack-heres-how-it-probabl... https://www.troyhunt.com/lessons-in-website-security-anti/

I sent them multiple vuln for free for both their online shopping site and an online (yes on the internet) payroll system https://payslipview.com/Login.aspx?ReturnUrl=%2fdefault.aspx

I had a smug thank you response.

Post reply on HN