Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Stealing checks worth millions and pwning a bank

jhaddix.com

Post reply on HN
Print view View original

31–35 of 35 posts

Re: Stealing checks worth millions and pwning a bank

#31

Post by arez »

blueflow wrote: post #18
more_corn wrote: post #12

Earlier quoted context omitted.

I like it because it describes how specifically the vulnerabilities were found and what specifically they were. If you’re doing security review or building a secure tool there are 5 items for your checklist.

They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.

if you think that you just need QA and then you don't need pentesting anymore you have no idea what pentesting is.

QA doesn't find XSS, SQL injection, CSRF, IDOR

Re: Stealing checks worth millions and pwning a bank

#32

Post by 4gotunameagain »

IncRnd wrote: post #28
MerelyMortal wrote: post #25

Earlier quoted context omitted.

Sure, there is some value in the information printed on the checks, but they're worthless because they can't be redeemed as they've already been redeemed. These checks cannot be "stolen" for "millions" contrary to the title.

The checks disclose 100% of the information that is needed to write new checks against the accounts. Those accounts could be completely drained from this. That accords with the title.

Are you saying that if somebody writes me a check, I can drain their account by writing new checks?

How would that not be super abused in the wild ?

Re: Stealing checks worth millions and pwning a bank

#33

Post by IncRnd »

4gotunameagain wrote: post #32
IncRnd wrote: post #28

Earlier quoted context omitted.

The checks disclose 100% of the information that is needed to write new checks against the accounts. Those accounts could be completely drained from this. That accords with the title.

Are you saying that if somebody writes me a check, I can drain their account by writing new checks? How would that not be super abused in the wild ?

That is exactly the case.

Re: Stealing checks worth millions and pwning a bank

#34

Post by blueflow »

arez wrote: post #31
blueflow wrote: post #18

Earlier quoted context omitted.

They are bad mistakes that should have never have passed QA. Think a bit. Pentesting only makes sense if you don't have a functional QA. Its like hiring a guy with a sledgehammer to test the stability of your bridge. You should hire a structural engineer instead, before building it. If the guy with the sledgehammer is successful, you should never have built the bridge in the first place.

if you think that you just need QA and then you don't need pentesting anymore you have no idea what pentesting is. QA doesn't find XSS, SQL injection, CSRF, IDOR

If its not QA, who else is auditing and reviewing your code?

Re: Stealing checks worth millions and pwning a bank

#35

Post by blueflow »

curiousllama wrote: post #30
blueflow wrote: post #23

Earlier quoted context omitted.

It works like this in every other engineering discipline. Except for software, were we somehow pretend that these level of bugs are something normal. Even the avionics and carmakers get software right, why cant we?

Funny you mention carmakers. Wouldn’t a crash test be the carmaker equivalent to a penetration test?

crash tests verify what the designers already predicted. You don't blindly construct a car and then crash-test it to safety in a trial & error manner.
Post reply on HN