Good news about Nedbank security vulnerability

[Daniel Puchert]

Good news about security flaw that exposed people's financial information in South Africa

A credit score checking system on Nedbank’s website had a security vulnerability that attackers could have exploited to harvest the security questions of any financially active person in South Africa.

Nedbank confirmed the vulnerability but said that after a comprehensive investigation, there is no evidence to suggest that a malicious actor exploited it.

 

[The_MAC]

Cool story Bro!

 

[Alexander the Straight]

There's something very disconcerting about all this. Why can this kid, who's probably in his teens, identify stuff that top companies and professionals can't?

 

[pstation]

There's something very disconcerting about all this. Why can this kid, who's probably in his teens, identify stuff that top companies and professionals can't?

companies in SA generally don't want to pay, and when companies in SA do suffer breaches, they never really face any real consequences. this is unlike the US or Europe where companies face fines, class action lawsuits, reimbursing customers for losses, investor disclosures, etc.

 

[Thorium]

Nedbank confirmed the vulnerability but said that after a comprehensive investigation, there is no evidence to suggest that a malicious actor exploited it.

Glad it wasn't exploited.

Sure. I get a real warm feeling about this, because:

1. Nedbank would know;
2. Nedbank would tell us all, regardless of the plausible deniability of any transactions that are repudiated. /s

That's why, in a situation like this which affects clients outside of Nedbank's scope, such a discovery ought to be reported to a central body like SABRIC, who ought to have appointed independent investigators, who would publish the investigation's terms of reference and findings.

 

[veergosai]

companies in SA generally don't want to pay, and when companies in SA do suffer breaches, they never really face any real consequences. this is unlike the US or Europe where companies face fines, class action lawsuits, reimbursing customers for losses, investor disclosures, etc.

Not one Big South African company or government department has a pay out policy. You always get the “we evaluate on a case by case basis” response.

 

[ld13]

..

You sassa/nedbank hacker you

 

[Thorium]

/blah blah
They would be required to disclose that by law and it will be picked up in an audit so I'm going with they're telling the truth for now.