Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000

http://www.cbc.ca/news/business/simplii-data-hack-1.4680575

by t1o5 • 8 years ago

139 121 8 years ago

cbc.ca

bearcobra• 8 years ago

This doesn't surprise me. My BMO credit card has a 6 character password limit. Not minimum, limit!

xexers• 8 years ago

Wow! That seemed so unbelievable I had to google it:

"Tangerine, much like BMO, also has a six character limit – numbers only, no letters and no special symbols allowed."

https://www.theglobeandmail.com/technology/digital-culture/w...

ymlaree• 8 years ago

This smells plain text password storage..

kevin_nisbet5• 8 years ago

It's even better than that, to login to the tangerine website, you first enter you're username, and it returns back a picture and phrase you pre-select, before entering you're pin.

When showing you the picture and phrase: >Important: If you don't recognize or see your picture and phrase, don't enter your PIN. First check that you entered the correct information. If you're still unsure, call 1-888-SAFE(7233)-304.

Anyone care to guess my username, and steal my picture and phrase?

gruez4• 8 years ago

Not minimum, limit!

1 character passwords allowed?

52-6F-62• 8 years ago

[Source: I have a Tangerine account]

The password size is fixed at 6 integers. No more, no less.

pietroglyph2• 8 years ago

Was there ever a reason why a limit like this was a good idea?

gruez4• 8 years ago

legacy systems

turingcompeteme• 8 years ago

Not a 'good idea', but it's partly because the same password is used for telephone banking. And people seem to have trouble with typing long passwords on numerical keypads.

ams61102• 8 years ago

Most likely a limit on the underlying Mainframe software that was written in the 1980s.

mitchty2• 8 years ago

Dollar to a donut there is a machine with IBM on it backing this up. At a prior life the ultimate reason why "you can type as many characters as you want but only the first 8 matter" came down to passing the login auth to a mainframe which only took 8 characters. Yes in EBCDIC, glad I never had to actually interface with them much, except for having to deploy ftps (ftp with ssl encryption, its an abomination, all due to no sftp on the mainframe at the time).

sangaya• 8 years ago

It's also case insensitive !!

nneonneo• 8 years ago

On the plus side, I guess this means you aren't using that password on any other sites? :P

RaceWon• 8 years ago

With "account security" questions too?

bitmapbrother• 8 years ago

The security of these Canadian banks is very weak IMO. CIBC/Simplii, for example, does not support 2FA, has no sign in or transfer email/SMS alerts and their maximum password length, I believe, is 12 characters.

andrewgjohnson• 8 years ago

I can confirm the 12 character limit. I'm hopeful that will change as part of this.

Scoundreller5• 8 years ago

It's pervasive in Canadian banking. I have a multi-word job title.

Credit card apps will ask: "Enter your occupation, be as descriptive as possible", and I'll hit the limit...

kjax• 8 years ago

That beats the heck out of a certain Canadian credit union that has a numerical password with a length limit of 7 digits...

miguelrochefort5• 8 years ago

Tangerine's limit is 6.

ResearchAtPlay• 8 years ago

I can confirm that Scotia Bank, another major Canadian bank, does not support 2FA. This has always bothered me and is especially concerning because Canadian bank accounts can be used to log into Canada's immigration services (CIC). That immigration account is protected only by one more layer of self-selected security questions, after which the intruder potentially has access to a swath of personal data, including passport numbers, and a very detailed personal history section.

In my opinion, Canadian banks are way overdue to switch to 2FA.

verelo4• 8 years ago

Nor does TD. They don't even do phone notifications of logins.

Ironically i signed up with one of the local credit unions in Toronto to take advantage of a high interest savings account for a future tax debt of which I am sitting on the cash for, and found they supported SMS 2FA, and texts when anyone (even me) logged into the account. I wish TD supported this, but then again, as long as their money is backed by the government i don't really care all that much.

ams61102• 8 years ago

SMS as a 2FA has been discredited, but I suppose it's better than nothing.

kevin_nisbet5• 8 years ago

Actually I think TD just launched a SMS based two factor, I set it up on the weekend (I got prompted when I logged into EasyWeb, and it's also in my security settings). It's SMS based, and can be configured on how aggressive it is (when you change IP/computer, or every time you log in).

I would much prefer to see a second factor like TOTP, U2F, etc as the problems with SMS based second factor are well documented, but I'll take what I can get.

soperj• 8 years ago

TD is actually terrible. If you forget your password and you can answer one of the questions about the person (Ie: what was your high school mascot?) they actually just let you change the password at that point.

Pxtl• 8 years ago

Hah, I remember when TD actually started supporting proper password lengths and published a bunch of fluff pieces about good password practices, as if none of their users remember their old short password restrictions.

mabbo• 8 years ago

one of the local credit unions in Toronto

Got a name? And do you recommend them? Long-time RBC customer, which means they treat me terribly. Mortgage is coming up for renewal soon enough.

auxym• 8 years ago

To my knowledge none of the big canadian banks support U2F or TOTP.

Accounts can also be used to log in to the CRA website.

miketery• 8 years ago

CRA = Canada Revenue Agency (Canada's IRS)

flyGuyOnTheSly3• 8 years ago

When you sign up to CRA's online control panel... they actually make you tick a box that says in essence:

"we're not responsible if we get hacked and lose all of your CRA related data to some random hacker... that's your fault"

himom• 8 years ago

Grrr. Google Authenticator and such are free. It would be mostly user support costs to deploy. Heck, could even SMS or robodial (Twilio etc) a TOTP code for people without smartphones.

Scoundreller5• 8 years ago

can be used to log into Canada's immigration services (CIC)

I've looked around an account I'm a representative on, and other than passport numbers, not much sensitive personal data.

CIC is still a lot of pen and paper these days, but perhaps it depends on one's immigration pathway...

The bank's information can be used to log into CRA however...

throwaway2048• 8 years ago

Its pretty ridiculous that all the big banks give you a smart card, but not a $5 smartcard reader to login with...

miguelrochefort5• 8 years ago

Tangerine doesn't support 2FA, and passwords must be 6-digit numbers...

sebtoast• 8 years ago

I just wanted to say that Scotia's corporate accounts do have 2FA with a physical token generator, so they do have the technology they just don't enforce it for consumer accounts.

swat535• 8 years ago

What really bothers me about these banks is that they attempt to keep their platforms secure by things like disabling the back button. Just so that hypothetically, if somehow a person has access to your physical machine, they can't just press back and view a cached copy of your account. Yet they fail on actual security practices. No 2FA - check Maximum password length of 6 characters - check Storing / Sending passwords in pain text - check The list goes on.

It boggles my mind that institutions with such financial power, fail to employ these practices.

It's clearly not a question of cost..

dflock2• 8 years ago

As many people in this thread pointed out: lots/most banks suck ta this. Tiny max length passwords, not 2fa, etc, etc...

Are there any Canadian banks which don't suck at this?

sergers• 8 years ago

I have TD and RBC, both can have complex longer passwords upto 32 character, but not a requirement(atleast when I changed passwords last time).

RBC supports finger print auth with their app, and forced security questions.

diab0lic• 8 years ago

That 32 character password (on RBC) is case insensitive, unfortunately. I noticed when I logged in with caps lock on (so my cases were inverted) and it worked. =\

dflock2• 8 years ago

Actually, I have a new/beta wealthsimple savings account which supports 2fa, etc...

bonestamp2• 8 years ago

Chase is awful too, their passwords aren't case sensitive! If you have an account you can try it right now, type in your password and change the case of a letter and it doesn't make a difference.

chatmasta• 8 years ago

So chase is storing passwords in plaintext? Or maybe storing a hash of every combination of case?

paulsutter• 8 years ago

I was visiting friends in Canada and I asked “is it true that Canadians don’t lock their doors?” And they responded “oh no, Steve right? Yeah we know a guy, he locks his door”. Always polite, trying to make me feel OK for being from a place where everyone locks their door.

otoburb• 8 years ago

Torontonians generally lock their doors, as do Vancouverites; so, definitely not all Canadians.

uiri• 8 years ago

Even in Ottawa, folks generally lock their doors. It is a rural vs urban thing, just like it is in the US.

dmix• 8 years ago

Reality is a bit different in Canada than the one manufactured in Michael Moore films.

richjdsmith2• 8 years ago

I grew up in a town of around 25,000 people. My family never locked its doors. When I moved to Calgary (pop ~1.2mm), I still rarely locked them.

I pay for home insurance for a reason.

ehonda• 8 years ago

I don't know if home insurance covers theft if you don't take basic steps to protect your property (ie locking your door).

jpambrun2• 8 years ago

I live in Montreal and I only make sure the doors are locked at night. In some Montreal neighborhoods, it's common for people just leave their front door open to let the air in, even at street level.

miguelrochefort5• 8 years ago

I think he meant when you're leaving the house.

I don't think people in the US lock their doors when they're home during the day.

ficklepickle• 8 years ago

I find CBC has a bad habit of writing corporate fluff pieces. They quote an "expert" from SAS making some vague assurance that their security is good. SAS is a vendor to CIBC[1], but the article fails to mention that conflict of interest.

[1] https://www.sas.com/en_ca/events/14/cibc-user-group/home.htm...

zouhair• 8 years ago

This is why CBC needs to go the BBC's road an go full ad free. The moment you need ads to survive, everything start to work around making advertisers happy.

monkeynotes2• 8 years ago

This is all good, but as a Canadian I don't want to be forced to buy a TV license to cover the CBC's budget.

The UK essentially taxes households with a TV in order to prop up the BBC. When I was growing up in the UK in the early 2000s we didn't watch broadcast TV but we had a TV. A couple of times a govt license officer came over and demanded to be let in the house to inspect our TVs. I loved how my dad stood up to him and told him to basically fuck off.

mistermann• 8 years ago

If the Canadian Government is their only source of funding, it raises the risk of don't bite the hand that feeds you, and the CBC already has a habit of not asking terribly uncomfortable questions of our government.

But then, all of our media outlets are like that so maybe it's just a Canadian thing. Take this as an example:

http://toronto.citynews.ca/2018/05/28/fake-passports-convict...

You can get a passport by simply skipping a line and heading straight to a known to be compromised employee, no simple secondary checks in place. An obvious gaping hole, and not a single newspaper has the competence (or bravery) to notice.

flyGuyOnTheSly3• 8 years ago

I have to say... I'm not at all surprised about Simplii financial's hacking...

I had a PC Financial bank account... and then PC Financial decided to merge their points program with Shopper Drug Mart for some reason... and then I started getting calls from Simplii financial asking me to verify my identity and let's setup my new online bank account...

"What?" is all I could think...

I had never heard of Simplii financial before... nor was I aware that PC was dissolving/selling their banking arm...

I logged into the account once, transferred all of my money out of that account, and logged out forever...

The reason I say that I am not surprised that Simplii financial was hacked is because it is hardly even a Bank imho... it was an afterthought.

giarc• 8 years ago

They merged points because Loblaws bought Shoppers Drug Mart.

Simplii isn't "hardly a bank". It's a bank powered by the same software as CIBC. It's like the Koodo of Telus.

flyGuyOnTheSly3• 8 years ago

I assumed that because I had never heard of them before... that they were just a new name for the old PC Financial banking brand but I could be wrong.

richjdsmith2• 8 years ago

Lovely. One can only hope that other would-be hackers don't start poking the rest of the Canadian Bank's archaic systems or we'll soon see the rest of our not-so-fantastic banks on the front page of HN.

For anyone not from Canada, our banks are at least a decade behind the rest of the world in terms of IT - mostly due to strong government protectionism. I was a mortgage broker before changing into IT, and up until the summer of 2015, to submit a mortgage application to Scotiabank, one of big 4, you had to fax it. My buddy who works for Scotia said it wasn't until Q1 2016 before they were able to submit a mortgage application without a fax internally.

manishsharan• 8 years ago

>For anyone not from Canada, our banks are at least a decade behind the rest of the world in terms of IT

I would not agree with your assertion. I work at the bank with the "Green Sofa " and I can assure you we are very competitive with the US banks as far as technology goes.

moltar• 8 years ago

Recently tried to login into PC Financial MasterCard online account. And got “your password is too long” error. What? Right! Password length validation on the login form!

I called CS and explained that this is impossible as I use a password manager and it worked just not long ago. They assured me that this was always the case and that I’m an idiot for forgetting my password.

They sent me to password reset procedure page.

The password procedure emails plain text temporary password, which then let’s you pick a new password.

When picking a new password, I tried to enter my old password that was too long, just for the heck of it, to see if it’d go thru.

Lo and behold, the system answered that I “cannot reuse the same password as previous 6 passwords”.

That’s banking-grade security right there.

randomdata• 8 years ago

Is the validation done using Javascript? I have used a credit union that used to do that until they merged with another credit union and switched to a new system. Password requirements were limited to 0-9, maximum of six digits. However, if you bypassed their client-side validation logic, you could use any password you wanted.

mikeash• 8 years ago

My bank has a password length limit of 8 characters.

Do they throw up an error? No, they silently truncate it.

The cherry on top is that it’s also case insensitive.

I stick with them because they’re good otherwise and they make it clear that they take responsibility for any losses due to this nonsense. But holy crap, “bank grade security” is definitely not a positive thing in my eyes.

p0rks2• 8 years ago

I feel the term "bank grade security" used to mean something before we were banking online. "Bank grade security" conjures images of actually having to physically go to your bank and then having your money stored in a vault.

Def not the case anymore.

There is no cloud, just other people's computers.

zmpeg• 8 years ago

I have the same PC MasterCard, but in the PC Bank website that was replaced by Simplii, I found that the last character of my password, a period, did not matter to get logged in. I could enter it, or not. It worked either way. Perhaps something similar is happening for you.

p0rks2• 8 years ago

First mistake? PC Financial.

wcdolphin• 8 years ago

What is wrong with stopping people from reusing the same password? It can be done securely using the same storage mechanism as passwords, ie storing hashes only.

UnFleshedOne• 8 years ago

The point was that the system knew his too-long password and the password was correct, just being suddenly rejected on the frontend, unlike what support said.

branchless• 8 years ago

Then later Monday morning, Bank of Montreal revealed that it, too, had received a tip that "fraudsters" had stolen data on up to 50,000 of the bank's customers, "and a threat was made to make it public," BMO spokesperson Paul Gammal said.
In BMO's case, at least, the tipsters were the hackers themselves.
"We took steps immediately when the incident occurred and we are confident that exposures identified related to customer data have been closed off," BMO said.

Which "incident"? The theft or the data or being informed they were selling their own ass back to them?

The only fraudsters here are the banks, claiming they are secure.

Will CIBC and BMO be paying higher interest rates for the elevated risk of banking with them?

dade_2• 8 years ago

HSBC Canada requires 2FA with a token or their mobile bank app. It also isn't possible to change account contact info, setup new Payees, transfer money to another country, without generating a security code with a token PIN. The contact centre agents are unable to access your account unless you can correctly answer the security questions. This does mean an agent can lock out your account though. It is a pain, but compared with the goofy BMO 6 character passwords, or worse using CIBC at all, it was a welcome change. Legacy systems galore: Scotiabank gave me a debit card once in a branch because I got angry with them and also use mail extensively (though they have a much bigger problem right now), TD Canada Trust and US TD Bank are integrated with mail and fax, and RBC has 3 different domains (not AD) (East, Central and West) and they are completely isolated which can be a nightmare when moving across the country.

rb808• 8 years ago

HSBC is the only bank I've seen do this properly with a dedicated device. In the US at least you can log on a do a few basic things without the device.

https://www.hsbc.com.hk/help/security-centre/device/

Ntrails• 8 years ago

Over in the UK NationWide started sending out the little pin/auth machines 10-ish years ago (from memory). They're pretty smart about requiring it for anything "unusual" but allowing standard stuff (moving money between my own accounts, paying my usual credit card bill) is fine based purely on password login.

mrybczyn• 8 years ago

Sure, HSBC gets security right. They just deal with criminals directly rather than indirectly :-)

https://www.google.com/search?q=hsbc+criminal+investigation

Scoundreller5• 8 years ago

When HSBC decided to close their free Canadian small business accounts, they decided to mail out the notices and $$$ closing bank draft to the registered address, and not the mailing address they sent everything else to before...

mFixman• 8 years ago

I have an account in BMO that I'm in the process of closing. Besides kicking myself for opening an account in a 6-digit password site, what should I keep in mind regarding my compromised data?

Two Canadian banks say accounts compromised: CIBC 40,000 and BMO 50,000

Related Stories