SoylentNews is people
SoylentNews
Submitted via IRC for AnonymousLuser
7-Eleven's Bad App Design Let Criminals Steal More Than $500,000
Hundreds of 7-Eleven customers who downloaded a new mobile payment app in Japan were robbed out of hundreds of thousands of dollars due to some staggeringly idiotic security lapses in the app.
Yahoo Japan reports that 7-Eleven Japan released the 7pay app on July 1, and within a day customers started complaining about suspicious charges to their linked payment cards. On July 3, the company confirmed accounts could be accessed by third parties and announced it would stop charging credit and debit cards through the app.
According to the Yahoo report, hackers simply needed to input a customer's birthdate, phone number, and email address to request a password reset link. But it seems that a hacker could even request that the reset link be sent to whatever email address they wanted. It also seems that if a customer hadn't entered a birthdate, then the app would default to January 1, 2019, which would make it even easier for a fraudster to gain access.
Also at:
https://techbeacon.com/security/7-elevens-7pay-app-hacked-day-due-appalling-security-lapse
https://www.engadget.com/2019/07/06/7-eleven-japan-app-security-loss/
(Score: 2) by Sourcery42 on Friday July 12 2019, @04:34PM
l33t skillz. You just reminded me of high school typing. Half the room was electric typewriters, but the other half were old (even for the time) PC clones. They were on a network, however. Student logins left you trapped in a rudimentary word processor. The young teacher had been a babysitter of mine in the days of her youth. Usernames were uniform and easily guessed, and wouldn't you know it, her password was her maiden name. Login as a teacher and you got an ncurses like interface to the school network. I couldn't even pull up other people's grades, let alone change them or anything like that that might have got me promoted to god status and in serious trouble like that. I could access accounts and look at their schedules, iirc. That was about the extent of it; from my probing of the network I got the impression that was about all that was really done electronically back then. It was still a little thrill for 15 year old me.