Skip to main content

How UOB's Paper Trail Amplifies IT Greatest Security Threat

UOB required you to do everything on paper. If you want to change your mobile number for your banking account with them or for your credit card, you need to fill up a form.

Yet, this paper trail represented a potential security fail for the bank - Human Error.

So a bitcoin expert walked into UOB to open a bank account. The bank employee had to print a form from a online pdf document to fill in this bitcoin expert's particulars.

When it came to entering the bitcoin expert's email, that's when the forgotten art of handwriting was the most obvious of the digital generation.

Wrote Robert Capodieci,

My name is Roberto Capodieci, as most of you know. and my email address is very obvious to decode. It is not a p4l_l337_s0u1@gmail.com, but it is a more obvious roberto@capodieci.com, thing that, right after reading my name in the same form, should come out easy. Still, a data entry personnel of the UOB bank (or of a service provider the UOB bank uses) entered it as roberto@c2podieci.com.

So this meant Mr Capodieci needed to download a form to change his email address and post it to UOB. Simple?

Not exactly, by the time Mr Capodieci received his activation link, he was already in Bali, Indonesia. If he mailed the form out, it would take 3 weeks to reach UOB.

Unfortunately, that would have passed the statue of limitations for the form which was two weeks.

What could Mr Capodieci do?

Set up an email for roberto@c2podieci.com to get his activation link.

The first problem I think for UOB is that its computer does not have an Adobe PDF writer to allow its bank employees to fill in forms by typing out the particulars rather writing it out.

With a stroke of a pen, an activation code was send to the wrong and non-existing email.

However, the ease of Mr Capodieci setting up an email address online to get his activation code put the spotlight on how a human error might have lead to a hacked account.

It would be of great odds that the activation link be send to the wrong person and that wrong person knows how to clone an email.

But sending a letter to solve a email is quite ironic itself.

Comments

Popular posts from this blog

Will mrbrown's post on Mr Tan Kin Lian's thermometer app "misadventure" promote technology ageism?

I am not ashamed to say I support Mr Tan Kin Lian as a presidential candidate because I believed in what he stood for. And when Mr Tan posted his "misadventure" with a thermometer app, I did shake my head in disbelief that he did that. Source:   http://www.mrbrown.com/blog/2013/07/we-could-have-had-him-for-president.html Thinking twice, there could be a possibility that Mr Tan misunderstood how this app work. Most  thermometer app take data from various weather stations to display the temperature on it. Yes, the technology savvy will do a #facepalm when they read the post and mrbrown's post demonstrated it perfectly. Wrote mrbrown , "Maybe the former Presidential-hopeful didn't realize he needed to upgrade to the Pro version of the app. Then his iPhone would not only measure temperature, it would also measure current PSI (PM2.5 included), tell you if you are having your period, and cook instant noodles. Good thing he didn't try to measure boil

NEL Train Fault Shouts Lack Of Crisis Communication

The North-East Line train fault of 11 April 2018 was my virgin experience of a rush hour train fault since I moved to Punggol. One would have thought that with the number of train faults experienced by the North-East Line operator, SBS Transit, they would have improved the communications and handling of train faults. However, my personal experience told another story. First, there were no announcements at the Punggol LRT stations of the train fault even though SBS Transit manages them. The train fault was reported as early as 7.10am as I had a friend who was also stuck in the train. I boarded the LRT at Coral Edge around 7.30am and I didn't hear of any announcement nor was there any signage to inform me o the train fault at Punggol Station. Second, the announcement kept saying that there would be a 15 minutes delay, but 15 minutes passed and the trains, on both side, wasn't moving. If the announcement would be more frank to say it will be a longer delay, commuters would