21–30 of 35 posts
Earlier quoted context omitted.
Also, aren't the checks worthless at that point, since they've already been cashed?
Yes, It's pretty difficult to deposit check images in bulk for other people's accounts. There's still a privacy issue, and if he ran OCR on them, he'd have a bunch of account numbers, which would also be bad.
Earlier quoted context omitted.
I like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.
They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
Earlier quoted context omitted.
They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
Even the avionics and carmakers get software right, why cant we?
Earlier quoted context omitted.
I like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.
They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.
Instead we have project who care only about shipping their latest favorite features yesterday to meet the over-promised new capabilities to the new client/market, and figure any problems will get caught with the update cycle, and the coders scrambling to ship the first thing that'll compile and pass the test screens, with QA being a minimally funded function as yet another cost center to be minimized... Oh, and all liability for failure is disclaimed or fobbed off on the consumer for their failure to maintain proper opsec. Oh, and in many cases, the blame is put squarely on anyone who finds such a fault instead of on the builder (e.g., when the governor recently tried to jail a journalist who found an egregious flaw in a state website).
So, yeah, it SHOULD never be the case if there were proper development and proper QA. But it hasn't happened in a half century of large commercial software. So, we do really need pentesters. They're just delayed QA after all.
Earlier quoted context omitted.
Also, aren't the checks worthless at that point, since they've already been cashed?
No, of course they aren't worthless. They give you the routing number, account number, and next check number in order to print your own fake checks on other people's accounts.
The story ends inconclusively. I was expecting to know what the bank's reaction was or if they ever addressed these issues.
Also, aren't the checks worthless at that point, since they've already been cashed?
Of course, any of those options are going to end up with transactions reversed eventually, so you've got to have a quick exit planned.
Earlier quoted context omitted.
Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?
Earlier quoted context omitted.
No, of course they aren't worthless. They give you the routing number, account number, and next check number in order to print your own fake checks on other people's accounts.
Sure, there is some value in the information printed on the checks, but they're worthless because they can't be redeemed as they've already been redeemed. These checks cannot be "stolen" for "millions" contrary to the title.
Earlier quoted context omitted.
Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?
Do they deploy multiple times daily? Deal with vague sometimes contradictory client requirements? Do their tools and platforms change daily?
Earlier quoted context omitted.
Think a bit more. Why have QA? If there are bugs, the SWEs should have caught them with their test suite. Think even more. Why bother with a test suite? The code should be written correctly the first time. (this is sarcasm) People make mistakes. Systems fail. Pen tests exist to find out if your people are making mistakes, and if your system is failing.
It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?