SoylentNews is people
SoylentNews
Submitted via IRC for TheMightyBuzzard
A Czech court recently sentenced two hackers to three years in prison for accessing Vodafone customer's mobile accounts and use them to purchase 600,000 Czech Koruna worth of gambling services. Vodafone reportedly wants the hacked victim's to pay for these charges as they were using an easy password of "1234".
According to reporting from Czech news site idnes.cz, the hackers accessed mobile customer's accounts by using the password 1234. Once they were able to gain access, they ordered new SIM cards that they picked up from various branches. As they knew the phone number and password they were able to pick up the SIM card and install it in their phones without any other verification.
This allowed the attackers to charge over 600,000 Czech Koruna, or approximately 30K USD, for gambling services.
What do you lot think, should there be a blatant stupidity tax?
(Score: 5, Insightful) by Fluffeh on Thursday September 13 2018, @12:29AM (1 child)
That's spot on.Because in this case, it isn't the customers who got hacked, it is poor Vodafone processes and a lack of controls in place to mitigate the risk that has caused this. Were the customer passwords daft? Yes. But it was the company rules and processes that allowed this to happen, so Vodaphone can't pass the buck here when some (at least partly) clever crooks gamed the system and made everyone look stupid.
I would say from a PR point of view, the best thing Vodafone could do would be to shut up and change their processes to try to stop this happening again. Also, given the crooks had access to accounts, how many personal voicemails were saved, was there any access to customer cloud data?
Lastly, I'm also going to say that there must have been an AWFUL lot of customer accounts being TESTED to see if their password was 1234. Isn't a good part of intrusion security checking for anomalous traffic out of no-where? You would think a single IP suddenly trying to access thousands of accounts using a password of 1234 should sound alarm bells. This should have been picked up and shut down before a single SIM card was ordered or a single bet was placed.
(Score: 5, Insightful) by Mykl on Thursday September 13 2018, @03:24AM
Vodafone can't claim that they are offering super security when there are a maximum of 10,000 passwords available. If, as the summary implies, the "hackers" just trawled the customer base with a set PIN, they'd be bound to pick up a number of accounts no matter which PIN they entered. 1234 was probably just picked because it was likely to have slightly more results than another random number