News for hackers. Stuff that matters.

A comment on Tesco Bank halts online payments after money was taken from 20K accounts. Parent comment

Re:Tesco Bank halts online payments after money was taken fr... by spydum on Monday November 07, 2016 @07:35AM (#12890550)
could be entirely a software bug? Though I tend to agree that it looks worse than that.
[ Parent | on HN ]
Re:Tesco Bank halts online payments after money was taken fr... by zigzigzag on Monday November 07, 2016 @08:25AM (#12890800)
Sure. All it takes is a REST endpoint without the proper XSRF checks.
[ Parent | on HN ]
Re:Tesco Bank halts online payments after money was taken fr... by TACIXAT on Monday November 07, 2016 @01:50PM (#12893708)
This was my first thought. A lot of the replies here are going all out, but it is likely some simple web vuln that trusts the browser.

    /transfer_money?from_account=NNNN&to_account=MMMM&amount=$$$$
It would actually be really interesting if they faxed in transfer forms or something.
[ Parent | on HN ]