Accidentally found a flaw in major online bank...


Status
Not open for further replies.

craigix

Mega GP Mania
Joined
Feb 3, 2003
Messages
11,008
Location
England
Website
twitter.com
I've accidentally found a major flaw in an online bank allowing me to access other peoples accounts.


This flaw is related to the connected email account and allows a way to hijack other accounts as long as you know the email address of the account holder.


Emailing the bank has given no response. I don't even have an account with the bank in question.


What shall I do? Tweet anonymous?


I should add that I can think of a simple way to use this trick to 'own' and empty accounts set up with the bank.


Edit: I'm considering tweeting pictures of other peoples accounts to get the attention of the bank, but I don't want to be arrested.
 
Last edited by a moderator:
Edit: I'm considering tweeting pictures of other peoples accounts to get the attention of the bank, but I don't want to be arrested.
Maybe send pictures of other people's accounts to the bank (without making them public)?


What if they were people who you know (so they won't get upset about your breach of their privacy)?
 
Someone could seriously empty a lot of accounts if the wrong type of person found this flaw too.


Is there any other way of contacting the bank in question I wonder.


Maybe they will give you a reward for being a good samaritan but I wouldn't 'bank' on it. :)
 
Email multiple departments simultaneously with copies of previous emails (and pics of accounts) and say your concern about inaction is likely to lead to you bringing the issue to the attention of the media in general.


EDIT: Tweeting anything could backfire spectacularly. Look at Sally Bercow right now!
 
Last edited by a moderator:
Exciting, indeed. You know this, of couse, but I'll say it anyway: Make extremely sure that noone can accuse you of logging in to any accounts. Do not touch. Since an error on this scale is very embarassing, it wouldn't be the first time that the organisation in question would want to shoot the messenger.
 
Please try to keep this as private as possible. think about yourself if you'd want to see your bank account data published by anonymous...
 
Take extreme caution. You may be trying to help but if you actually do "hack" into other people's accounts then you could be setting yourself up for a very difficult lawsuit. Even just publicly stating that such a thing is possible could be considered "destructive" and you could get dragged into court.


Inform a security expert and wipe your hands of it, they're professionals with experience dealing with stubborn companies and usually have lawyers on staff (or at least retainer) backing up what they do.
 
go talk to bank in person. emails arent the way to go here as "annon"
 
AFAIK, there's very little you can do with someone's online bank without getting caught. You can't just become a Payee in the banking systems without a whole bunch of documentation of who and where you are.
 
More emails sent.


Don't worry, I won't release the method, but it's alarming that for all their encryption and password protection that this little trick works.


Usually I would just post evidence online but lately police in the UK seem to be knocking down doors for even tweeting the wrong thing.


I just wonder how many people may already know about this and are keeping it quiet... there is no way I can be the first person to notice this.
 
Last edited by a moderator:
AFAIK, there's very little you can do with someone's online bank without getting caught. You can't just become a Payee in the banking systems without a whole bunch of documentation of who and where you are.

Criminals have no problems setting up fake accounts, or indeed they just pay someone who does not care what happens and use their account.


Bank accounts can be bought from people pretty easily, no doubt in some cases for drugs.
 
Last edited by a moderator:
I'll deal now.


If you get anything from my bank account we can go 50/50 and I will not speak of this to anyone else.
 
There are guidelines on how to do this... but maybe best to hand it off to a security person, let them get the glory/risk; if you handle it wrong, you go to jail. Its tough to be a 'white hat'.


jeff
 
I will come and visit. We can have tea and dripping. Followed by broon.


You like broon, yes I think?


CHAPTER SIXTEEN : The Lies Of Regret

Wrong thread, sorry.
 
Last edited by a moderator:
Status
Not open for further replies.
Back
Top