I Drivel » security http://blog.justinlintz.com whatever comes to mind Wed, 12 Oct 2011 01:37:13 +0000 en hourly 1 http://wordpress.org/?v=3.2.1 Commerce Bank’s huge security failure http://blog.justinlintz.com/2009/09/commerce-banks-huge-security-failure/ http://blog.justinlintz.com/2009/09/commerce-banks-huge-security-failure/#comments Tue, 29 Sep 2009 02:31:37 +0000 admin http://blog.justinlintz.com/?p=43 My checking account is part of Commerce Bank which about a year ago was bought out by TD Bank. Up until this summer their site http://www.commerceonline.com still worked for all my online banking. The theme had changed on the site but all the same login functionality was there. Then September 20th rolled around and . . . → Read More: Commerce Bank’s huge security failure]]> My checking account is part of Commerce Bank which about a year ago was bought out by TD Bank. Up until this summer their site http://www.commerceonline.com still worked for all my online banking. The theme had changed on the site but all the same login functionality was there. Then September 20th rolled around and I goto log into my account to check on some things only to find that http://www.commerceonline.com now is a search engine spam page?! A whois lookup on commerceonline.com shows…

% whois commerceonline.com

Whois Server Version 2.0

Domain names in the .com and .net domains can now be registered
with many different competing registrars. Go to http://www.internic.net
for detailed information.

Domain Name: COMMERCEONLINE.COM
Registrar: CYDENTITY, INC. D/B/A CYPACK.COM
Whois Server: whois.cypack.com
Referral URL: http://www.cypack.com
Name Server: NS1.TRAFFICZ.COM
Name Server: NS2.TRAFFICZ.COM
Status: clientTransferProhibited
Updated Date: 20-sep-2009
Creation Date: 30-jul-1996
Expiration Date: 29-jul-2011

For the non-technical person, they let their fucking domain name expire. If they did this purposely they don’t deserve to be a bank, if this slipped passed someone… they don’t deserve to be a bank. Why this is bad you ask? Right now there is nothing preventing the owner of the site from going to web archive of commerceonline.com and just copying the old look of the site and stealing X number of identities by faking a registration page or login page.

Besides the whole fuckup of their old domain, apparently the login mechanism is different on tdbank now and my login information doesn’t work. Yet I can’t sign up for a new account as it says I’m already registered. I’m seriously considering switching off TD Bank because of this pisspoorplanning .

]]> http://blog.justinlintz.com/2009/09/commerce-banks-huge-security-failure/feed/ 4