News for hackers. Stuff that matters.

A comment on How Hackers Stole 200,000 Citi Accounts Just By Changing Numbers In The URL. Parent comment

Re:How Hackers Stole 200,000 Citi Accounts Just By Changing ... by raganwald on Wednesday June 15, 2011 @10:53AM (#2657340)
Unrelated anecdote:

When working with a substantial financial organisation, there were strict rules prohibiting my team from communicating with the code audit and other security teams. Going for coffee with one of the internal audit people would get you both fired. The external testing was done by a security consulting firm. Their reports were passed on to me with the identifying details stripped out so that I wouldn't even know who they were.

Talk about "low coupling!"

[ Parent | on HN ]
Re:How Hackers Stole 200,000 Citi Accounts Just By Changing ... by biot on Wednesday June 15, 2011 @01:03PM (#2657938)
No doubt the goal there is to prevent collusion between a developer who introduces a subtle but exploitable bug and the auditors/testers who might be interested in failing to find such a bug, for an appropriate percentage of course.
[ Parent | on HN ]
Re:How Hackers Stole 200,000 Citi Accounts Just By Changing ... by tptacek on Wednesday June 15, 2011 @12:22PM (#2657742)
It shouldn't matter to you who the external firm is. Stripping out their contact info, at least in the archives, is probably smart; it makes it easier for the company to keep multiple security firms working on their projects. Which, when you're a huge bank, is what you want to be doing.
[ Parent | on HN ]