Hacker News Reader

Comment by darxius | Hacker News Reader

It makes me peeved when these reports omit the names of the parties that were compromised in the intent of "protecting" their name. If I was a customer of one of the banks that got broken into, I think it would be my right to know that they're insecure so that I could put my money elsewhere.

View on HN

It's even more infuriating when your bank tells you a vendor you did business with was compromised and they refuse to tell you who. And it gets worse when they issue you a brand new credit card with a new number because of the un-named compromised vendor. But rest assured dear customer, your old number will still function...

It tells you RakBank in the article and the wire service has the other bank

> Prosecutors said the scheme involved attacks on two banks, Rakbank, which is in the United Arab Emirates, and the Bank of Muscat in Oman.

http://www.smh.com.au/it-pro/security-it/massive-21stcentury...

edit: Oh, the NYTimes version of this story says it's a US based credit card processor name withheld http://newsdiffs.org/article-history/www.nytimes.com/2013/05... Other versions say the foreign banks themselves were the credit card processors http://mashable.com/2013/05/09/atm-hackers/

This indictment [1] seems to suggest an Indian payment processor was compromised, whose name "is known".

[1] : http://cbsnewyork.files.wordpress.com/2013/05/lajud-13-cr-02...

I've done a bit of digging and if you look at the RAKBANK prepaid portal [0] you can see the service is powered by ECS which is based in India [1], with offices in the US, UAE and Singapore.

Not sure about the other one, the bank of Muscat site is a bit crap, didn't find mention of the processor in the T&Cs or description of the cards [2].

[0] https://www.rakbankprepaidcard.ae/CustomerPortal/WebPages/Lo... [1] http://www.electracard.com/contact-us.php [2] http://www.bankmuscat.com/cards/prepaidmain.shtml

More importantly electraCard is certified PCI compliant by Control Case [0]. I think, this is the primary reason electraCard's name is not on the news; it has been certified secure by the payment industry standard [1]. Either Control Case failed to perform audit properly or the hackers had some serious skills.

[0] http://www.controlcase.com/ [1] https://www.pcisecuritystandards.org/

The point is that it isn't suppose to be the news to report it. Your bank should let you know, and let you know what they are doing it to prevent it in the future, etc. Otherwise everyone would be up in arms over something that may have been out of their banks control.

I am at a loss as to why the news supposed to report it? That is part an parcel of investigative journalism.

It maybe because the vulnerabilities still exist and they don't want the general public to know about it. Yet this rings hollow as the bad guys still know about it.

Looks like it was "debit accounts issued by the National Bank of Ras Al-Khaimah" and "cards issued by the Bank of Muscat in Oman" - not the ATM owners.

Reply on news.ycombinator.com