PIN Scandal 'Worst Hack Ever'

[DealBot]

QuietLagoon writes "The evolving Citibank PIN scandal is getting worse with each passing day. Gregg Keizer of TechWeb News writes: 'The unfolding debit card scam that rocked Citibank this week is far from over, an analyst said Thursday as she called this first-time-ever mass theft of PINs 'the worst consumer scam to date.' ... The problem...is that retailers improperly store PIN numbers after they've been entered, rather than erase them at the PIN-entering pad. Worse, the keys to decrypt the PIN blocks are often stored on the same network as the PINs themselves, making a single successful hack a potential goldmine for criminals: they get the PIN data and the key to read it.'"

http://rss.slashdot.org/Slashdot/slashdot?m=4193

[dstryr420]

as an engineer I cannot understand how technology like this can have such major flaws that aren't realized until its too late

who remembers the massive credit card number thefts from last yr?

[ZeldaForever]

Who that heard it could forget? Unfortunately, the wonder that is technology has a tendancy to cascade forward at a rate that challenges anyone to keep up: programmers, digital artists, debuggers, etc. In millions of lines of code, that one weak link tends to be much easier exploited than found and fixed (until it's too late). I know the Citibank affair is more in-depth than this, but it still basically comes down to hackers advancing on decryption and data theft technology before the involved parties can (or realize they should) make a change in their software, databases, or policies.

[dstryr420]

large companies tend to find it easier/cheaper/faster to market imperfect items just to get to market first (xbox 360 anyone?) or to meet deadlines, etc, figuring it can be corrected/fixed/ touched up in a later release/version/model etc. Unfortunately, what you said it correct- finding and repairing a bug in millions of lines of code can be a pain in the butt- the best way is to develop it to better standards in the first place... sometimes greed hurts in the long run.

even still, the problem isnt a 'bug' necessarily, but more a flaw in the logical design. Pins being stored with the decryption blocks are like locking your front door and taping the key to the lock.... This is something that should have been watched for- 'how is the key to the lock being handled?'