How I Hacked a Bank and Made 40 Bucks

"Your service is crap. It says I have several ‘Major’ issues. That can’t be right. We’re a bank!” said John, the security officer of a local bank. He had called me to discuss his report findings after I had recommended he scan the bank site, just in case of course.

I told him I would certainly refund his money if it turned out to be true, but it deserved a closer look. I was away from my computer at the time so I couldn’t really check anything immediately. I only asked him if I had permission to dig deeper and if he would say so in writing. He did.

It turned out, the scanner was right: it did find a major security flaw on their site: a SQL Injection. It was on some calendar application they paid a developer in India to write for $9 bucks an hour. They put it in a separate database schema with a separate username and password, and called it secure, though it was using the same master database their website ran off of. The same server some of their user information and encryption keys were stored on. Small businesses have so many security holes most of them are like swiss cheese – they just don’t realize it. No one thinks they are a target until they are. And they make easy pickings for the smart criminals.

The database was an older version, unpatched, with a known vulnerability allowing SQL Injection to gain root on the server. I didn’t go that far – I just dumped out some admin tables and sent him an email letting him know that in a couple of hours, I could probably have access to his bank accounts and encryption keys.

I was interested by then, so I kept tabs on their site, but it didn’t get fixed. Not for 2 months. They decided by then to just remove the whole thing and be done with it – they didn’t have a development team and had trouble finding someone qualified to write secure code. They had to pull in and brief the CEO. This was a one hundred million in assets bank. One Hundred Million.

After the changes were done, John wanted another scan. I asked him, out of curiosity, how much would you have paid consultants for the same work? “Easily $10,000, maybe more.”

Back then I was charging forty bucks a scan, but I have since lowered my prices (I love my customers, and want them to be secure).

Today it would be $13.