Hackers pluck 8,300 customer logins from bank server

Unix/Linux enviroment ?

> it was a unix/linux system them, being as the only way to rebuild your server from base is in a Unix/lLinux enviroment.

Like how, what was it running on upto Dec 24 ? What is it about other systems that prevents rebuilding from base. Install system, apply patches, apply customised configuration ..

> At least, when an MS server is compromised you don't have to rebuild from scratch, or compensate x thousand/million/billion customers.

You mean like the Heartland fiasco ?

http://www.usatoday.com/money/perfi/credit/2009-01-20-heartland-credit-card-security-breach_N.htm

And a BANK at that!

A BANK was storing passwords in cleartext? Not only should they compensate customers for any losses, their systems engineers should be charged with criminal negligence.

Cute little bank?

Yes, you're probably right.

http://maps.google.com/maps?f=q&source=s_q&hl=en&geocode=&q=Suffolk+County+NATIONAL+Bank,+Suffolk+County&sll=40.716428,-73.303871&sspn=0.040985,0.110378&ie=UTF8&radius=2.89&rq=1&ev=p&hq=Suffolk+County+NATIONAL+Bank,+Suffolk+County&hnear=&ll=40.721112,-73.356571&spn=0,359.889622&t=h&z=13&layer=c&cbll=40.721208,-73.356619&cbp=12,92.33,,0,-0.27

[streetview, give it a few moments to load itself up]

That *was* a petrol station once upon a time, wasn't it?

Big Banks versus small

Quite true that small banks tend to be rube. But I am not necessarily impressed with big banks sheerly due to numbers. The most positive thing about 100 firewall teams is the opportunity for internal schooling and cross-checking. But reality is that big banks use quite a bit of those IT resources even firewall teams internally and not on external customer websites. Then add in that with millions of customers Deutshe bank actually may have fewer security man hours per customer than a rube rural bank.

You just hope that the big bank degree of professionalism is that much greater and well applied. But it is not always. Usually 30-50 percent of the teams are interns and other trainees who when they start maybe no better trained than the least of the rube bank security people. So it often comes down to how well their mentors supervise them and when mentors get sick, etc. Thus stupid stuff can still happen especially if some well-trained mentor is ducking a tedious but essential monitoring or configuration task and foisting the job on some marginally qualified trainee without frequent checkups.

Not relic

Banks can still be State or Federally chartered. And that is all that the inclusion of State or Federal means --- which set of regulations takes precedences (well usually both apply to a certain extent but...).

Good point. The article does not say how the server was compromised.

However if true passwords in the clear DOES point to a default *NIX install or a custom web database. While not great MS product do default to some level of encryption. Only a few *NIX distributions and *NIX databases even have the ancient options to store passwords in the clear...let alone the default that let the unsophisticated fall into that trap.

I would go for foreign logging installed to a Windows IIS website as probably more likely. Or even simple eavesdropping on a logon page that defaulted to HTTP as Hotmail.com does. (what is the point of a password Hotmail.com?) Of course in the latter case I would suspect a new visiting security auditor simply counting the number of unique logons rather than the idiot who installed the logon page with HTTP instead of a working HTTPS page.