Submitted via IRC for AnonymousLuser
7-Eleven's Bad App Design Let Criminals Steal More Than $500,000
Hundreds of 7-Eleven customers who downloaded a new mobile payment app in Japan were robbed out of hundreds of thousands of dollars due to some staggeringly idiotic security lapses in the app.
Yahoo Japan reports that 7-Eleven Japan released the 7pay app on July 1, and within a day customers started complaining about suspicious charges to their linked payment cards. On July 3, the company confirmed accounts could be accessed by third parties and announced it would stop charging credit and debit cards through the app.
According to the Yahoo report, hackers simply needed to input a customer's birthdate, phone number, and email address to request a password reset link. But it seems that a hacker could even request that the reset link be sent to whatever email address they wanted. It also seems that if a customer hadn't entered a birthdate, then the app would default to January 1, 2019, which would make it even easier for a fraudster to gain access.
Also at:
https://techbeacon.com/security/7-elevens-7pay-app-hacked-day-due-appalling-security-lapse
https://www.engadget.com/2019/07/06/7-eleven-japan-app-security-loss/
(Score: 4, Insightful) by SomeGuy on Friday July 12 2019, @03:48PM (1 child)
Thank you for creating a new account with us!
The password we made you select is: TGu%^ATy7=mB\psTD*MF@sWZT8{gj`rWu[4Ntw%6^wrA4g'J>%)'P#\?NSg(BaHua9r"2_@),__4)vP9{*Xn7X*SE
(meets their MINIMUM requirements)
Your password recovery questions are:
First pet's name: spot (it's all over your farcebook page)
Your favorite color: blue (who would have guessed?)
The name of the school you graduated from: Git High (Public record)
And we will send recovery links unencrypted to whoever intercepts your e-mail! Or we may even allow sending to any e-mail address just in case you changed your address! How nice of us!
(Score: 2) by maxwell demon on Saturday July 13 2019, @01:16PM
Your favourite colour: Blue. No yel-- Auuuuuuuugh!
The Tao of math: The numbers you can count are not the real numbers.