Forest Global Training Partners

Cyber Risks · Krebs on Security

Fiserv Flaw Exposed Customer Data at Hundreds of Banks

Summary: Fiserv fixed an information disclosure flaw in its online banking platform that let anyone logged in view and edit other customers' transaction alerts - including email addresses, phone numbers and account numbers - simply by decrementing a sequential event number by one digit in a browser request. KrebsOnSecurity replicated the finding at two small Virginia banks, and experts told the publication some 1,700 banks use Fiserv's retail banking platform; Fiserv said it developed a patch within 24 hours of notification and replaced the sequential event numbers with a pseudo-random string.

Key Takeaway: With Fiserv holding more than 37 percent of the bank core processing market, a single editable digit exposed alert data across hundreds of community banks and credit unions that cannot build or audit these systems themselves - and the same access let an attacker add or delete alert contacts, quietly removing a fraud detection control customers believe they have.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related