Fiserv Inc. a US-based firm which provides technology services to financial institutions has just fixed a flaw in its web platform which exposed the personal and financial data of an unknown number of customers
Fiserv Inc. a US-based firm which provides technology services to financial institutions has just fixed a flaw in its web platform which exposed the personal and financial data of an unknown number of customers. According to KrebsOnSecurity, the flaw exposed the personal and financial data of countless customers across hundreds of bank Websites. The security researcher Kristian Erik Hermansen discovered the flaw When he logged in to an account at a tiny local bank which uses Fiserv platform and signed up to get email alerts whenever a new transaction happens, and the site assigned his alert to an ‘event number.’ The researcher was able to view and edit alerts set up by other customers by requesting the same page again after changing the site’s code in the browser like by requesting the same page with a different event number. He was able to view and edit customer’s email address, phone number and full bank account number. The attackers could use this flaw change or delete customers phone number or email address and redirect alerts to them. “I shouldn’t be able to see this data, Anytime you spend money that should be a private transaction between you and your bank, not available for everyone else to see,” said Hermansen. KrebsOnSeceurity author Brian Krebs and Kristian Erik Hermansen worked together to find out whether the flaw affects other banks which uses Fiserv platform and discovered that hundreds of other bank website were also vulnerable to the flaw. The researchers notified the company about the issue, and it was patched immediately. “After receiving your email, we promptly engaged appropriate resources and worked around the clock to research and remediate the situation. We developed a security patch within 24 hours of receiving notification and deployed the patch to clients that utilize a hosted version of the solution. We will be deploying the patch this evening to clients that utilize an in-house version of the solution.” said Fiserv spokesperson.
You may be interested in reading: Critical Flaw in Android Version of Fortnite Game make it Vulnerable to Man in the Disk Attacks