Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by clord on Monday May 28, 2018 @10:04PM (#17175933)

A little bird told me it's because they still use cobol fixed width data and are basically scared to change it. To fix, first they have to finish their rewrite.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by skissane on Monday May 28, 2018 @10:45PM (#17176097)

Sometimes people resist fixing serious issues with a legacy system, because rewriting the legacy system is seen as preferable to evolving it. But, the rewrite always takes a lot longer than you expect, which can result in a lengthy period in which those issues continue to bite you. Just hire a few good mainframe COBOL programmers (they still exist) and fix the serious issues in the legacy system.

Changing a legacy mainframe COBOL system shouldn't be scary. Provided you have qualified staff and the right tools (such as COBOL static analysis tools), it is not inherently more risky than changing a Java or .Net app.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by jeromegv on Monday May 28, 2018 @10:58PM (#17176149)

What I don’t get is that tangerine was originally ING Direct. Which was a new bank that just started in Canada toward the end of 90s or early 2000s. How did they end up with a COBOL system?

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by Scoundreller on Monday May 28, 2018 @11:51PM (#17176345)

ING Direct's parent, the dutch ING, fell on hard times during the 2009 recession.

So ING sold it off to The Bank of Nova Scotia (BNS).

Canada's bank-friendly anti-consumer policy meant that ING Direct had some value, and BNS coughed up the most cash.

They were only allowed to use the orange ING branding for a few years, so they changed it to something that was borderline familiar: an orange fruit.

BNS probably had to, or chose to, switch ING clients over from the Dutch back-end to their Canadian one.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by jeromegv on Tuesday May 29, 2018 @08:11AM (#17178364)

6 character limit was already there during ING Direct years. Possible they were using the old Dutch systems but i find it a tad surprising, they would have needed to set it up from scratch in Canada (as I don’t think anything was stored in Netherlands). So they purposely setup an old-ass system in the 90s. What a shit show

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by graeme on Tuesday May 29, 2018 @09:23AM (#17178888)

Plausible, but they had six digit codes from the beginning.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by giancarlostoro on Monday May 28, 2018 @10:27PM (#17176031)

Ouch... It saddens me when rewrites are not taken as seriously as they should be... Instead they rather risk people's personal information and finances.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by starky on Tuesday May 29, 2018 @12:32AM (#17176517)

It is because these companies are too lazy to change their systems to separate telephone banking and their online banking.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by gruez on Monday May 28, 2018 @09:35PM (#17175810)

at 6 characters, does it even matter? even salted + hashed + memory hard kdf isn't going to save you.

[ Parent | on HN ]

Re:Two Canadian banks say accounts compromised: CIBC 40,000 ... by kevin_nisbet on Monday May 28, 2018 @10:16PM (#17175989)

Agreed, napkin math say's around 3 day's on a single CPU core to test every password.

[ Parent | on HN ]