News for hackers. Stuff that matters.

A comment on British Airways fined £20m over data breach.

Re:British Airways fined £20m over data breach by dbm44 on Friday October 16, 2020 @09:22AM (#24800548)
Does seem a very large reduction in the fine, even allowing for current pandemic issues.

Of course if BA had been more security conscious and actually checked their third party JavaScript files regularly, perhaps using https://ScriptScanner.com ( full disclosure it's my app), then they would have caught the hack a lot quicker.

This would have greatly reduced the fine and the distress caused to their customers having to cancel their cards.

[ Parent | on HN ]
Re:British Airways fined £20m over data breach by Nextgrid on Friday October 16, 2020 @09:59AM (#24800861)
> checked their third party JavaScript files regularly

Or used subresource integrity to prevent any unauthorized JS from loading. Or just not loaded third-party JS on the checkout page to begin with.

[ Parent | on HN ]
Re:British Airways fined £20m over data breach by dbm44 on Friday October 16, 2020 @10:13AM (#24800989)
Agreed.

Very poor form for a company of BA's size to have third party JavaScript on the checkout page

[ Parent | on HN ]
Re:British Airways fined £20m over data breach by makomk on Friday October 16, 2020 @10:31AM (#24801126)
As far as anyone's been able to tell, I think the third party JavaScript files were hosted on the same BA server as the website itself, so subresource integrity wouldn't help - the hacker could just change the tags loading the JS so that the integrity checks passed.
[ Parent | on HN ]
Re:British Airways fined £20m over data breach by dkdk8283 on Friday October 16, 2020 @12:44PM (#24802534)
If this is true then they should’ve moved JS to a CDN or something and used SRI.
[ Parent | on HN ]
Re:British Airways fined £20m over data breach by dghf on Friday October 16, 2020 @12:54PM (#24802632)
> if BA had been more security conscious and actually checked their third party JavaScript files regularly

Or not stored credit-card details in plain text.

[ Parent | on HN ]