TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

British Airways faces record £183M fine for data breach

232 点作者 adzicg将近 6 年前

20 条评论

K0nserv将近 6 年前
&gt; At the time, BA said hackers had carried out a &quot;sophisticated, malicious criminal attack&quot; on its website.<p>Compromising a single JS resource that was being carelessly loaded on a payment page doesn’t qualify as sophisticated in my mind. It might not be uncommon in the industry, but tools like SRI and CSP stop these attacks dead in their tracks.<p>I believe we are about one huge attack[0] of this kind away from realising how dire the situation truly is.<p>As a victim of the earlier Ticketmaster attack I’m curious as to if the ICO is investigating that too.<p>0: <a href="https:&#x2F;&#x2F;hugotunius.se&#x2F;2018&#x2F;11&#x2F;29&#x2F;how-to-hack-half-the-web.html" rel="nofollow">https:&#x2F;&#x2F;hugotunius.se&#x2F;2018&#x2F;11&#x2F;29&#x2F;how-to-hack-half-the-web.ht...</a>
评论 #20381987 未加载
评论 #20382576 未加载
评论 #20381161 未加载
评论 #20381007 未加载
评论 #20382606 未加载
评论 #20382587 未加载
评论 #20382341 未加载
EnderMB将近 6 年前
I&#x27;m glad to see a solid fine given for a data breach.<p>I&#x27;ve worked on projects in this sector before, and it&#x27;s a common story to others - client cuts cost as much as possible, until the risk of an inferior product has grown too high to handle. It&#x27;s a race to the bottom, and security rarely comes into consideration outside of a basic pen test being mentioned (if it happens).<p>Still, I&#x27;m quite annoyed at the lack of follow-up against what is blatant bullshit from BA. When your business is so heavily reliant on taking payments online, their security procedures should be airtight. I can understand that it&#x27;s quite a clever hack, but it&#x27;s security 101 to know what third-party code is doing on your server.<p>The fine is good, but it would be nice to enforce rules where a company caught in a data breach has to accept liability and not contest the severity.
评论 #20382546 未加载
评论 #20384639 未加载
评论 #20382417 未加载
jrpt将近 6 年前
For those who are wondering what happened, British Airway’s website had malicious JavaScript included in some files they were using. Compromised third party libraries (in this case, the Modernizr library) was the attack vector. The malware would take sensitive data off the webpage and send it back to the hackers surreptitiously.<p>Most sites still would have no idea if this were to happen to them today.<p>That’s why I’ve developed Enchanted Security (<a href="https:&#x2F;&#x2F;enchantedsecurity.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;enchantedsecurity.com&#x2F;</a>) - a virtual content security policy that tracks the network requests and even blocks malicious ones. It’s like a firewall but running on your users’ browsers. This would’ve prevented what happened to British Airways. Get in touch if you’re interested in learning more.
评论 #20380796 未加载
评论 #20380840 未加载
评论 #20382285 未加载
评论 #20380788 未加载
评论 #20381965 未加载
planetjones将近 6 年前
Seems very just. BA clearly had no controls to understand the code running in production was the code they had deployed. I hope this serves as a wake up call to other companies who have a blatant negligence for infosec.
评论 #20380814 未加载
评论 #20380833 未加载
topogios将近 6 年前
&quot;The information included names, email addresses, credit card information such as credit card numbers, expiration dates and the three-digit CVV code found on the back of credit cards, although BA has said it did not store CVV numbers.&quot;<p>Is it standard for airlines to handle storing payment card details themselves and hence having to be PCI certified instead of delegating to a PSP?
评论 #20380662 未加载
评论 #20380810 未加载
评论 #20380839 未加载
jajag将近 6 年前
Statement on the Information Commissioner&#x27;s website: <a href="https:&#x2F;&#x2F;ico.org.uk&#x2F;about-the-ico&#x2F;news-and-events&#x2F;news-and-blogs&#x2F;2019&#x2F;07&#x2F;ico-announces-intention-to-fine-british-airways&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ico.org.uk&#x2F;about-the-ico&#x2F;news-and-events&#x2F;news-and-bl...</a>
评论 #20381269 未加载
OliverJones将近 6 年前
UK&#x27;s ICO and other data security enforcers are acting. That&#x27;s good. They&#x27;re changing companies&#x27; calculus about putting resources into infosec. That&#x27;s even better.<p>The public and press perceive that &quot;justice is served,&quot; so we&#x27;re tempted to think the problem is solved. I don&#x27;t think that&#x27;s helpful. These fines don&#x27;t address root causes of the problem. They don&#x27;t make our systems more resilient.<p>They&#x27;re drawing a significant amount of money from the system and transferring it to their governments&#x27; general accounts. Is that the best use of that money? Should some of that money be used to help address infosec problems? To fund training for citizens, legislators, and governments? To step up law enforcement efforts against cybercreeps? To publicly fund independent security researchers (white-hat hackers) to help detect this stuff and nip it in the bud? To help subsidize the significant expense of comprehensive infosec audits for municipal governments, ngos, and small firms?<p>Here in USA, the National Security Agency has, by hoarding zero-day exploits and inadequately protecting them, done major infosec damage to civil institutions worldwide (UK&#x27;s NHS, the Baltimore city government, you name it). I suspect similar things have happened in other governments. To what extent is it their responsibility to help clean up the mess? Can other governments use their resources to backfill where the US government can&#x27;t or won&#x27;t act?<p>Do governments now join identity thieves as enemies of people doing infosec? That cannot be good. We have to get this right and we can&#x27;t do it if we&#x27;re fighting each other rather than the criminals causing the trouble.
评论 #20383258 未加载
评论 #20383786 未加载
jfk13将近 6 年前
Just FTR, note that BA might appeal against this, so it may be subject to revision before it&#x27;s all over...<p>“BA has 28 days to appeal. Willie Walsh, chief executive of IAG, said British Airways would be making representations to the ICO. &quot;We intend to take all appropriate steps to defend the airline&#x27;s position vigorously, including making any necessary appeals,&quot; he said.”
xhgdvjky将近 6 年前
This may be the beginning of the end of hiring front end devs in house. Suddenly they are a serious liability... much nicer if you can pass on the fine to a third party!
评论 #20381671 未加载
olliej将近 6 年前
So this is ~$366 per person whose data was compromised. That seems fairly cheap all things considered.<p>It&#x27;s a far sight better than the &quot;credit protection&quot; they normally provide (from our point of view, rather than the people who are used to not having any penalties for abusing their customers). Remembering of course that the typical cost to companies making when they settle with &quot;credit protection&quot; is much lower than the already low $30 individuals would have to pay.<p>I&#x27;m also tired of newspapers parroting press releases that say things like &quot;sophisticated, malicious criminal attack&quot;. Just like a few years ago every publicly exposed+default password service was compromised by &quot;Nation state attackers&quot;, and before then &quot;Advanced Persistent Threats&quot;. If you make a claim like this, you should be required to provide the full details of the attack:<p>- what level of employee account was compromised, and if none was needed, why not? Otherwise, did the targeted employee need the level of access that the attackers used? If not, why did they have it? Simply being a C-level executive does not imply requiring access.<p>- Did it make use of any software exploits? If it did, were those exploits fixed in the release versions? If those exploits were fix in released software, why was that out of date software being used?<p>- Is your company using established best practices: 2FA for all accounts, TLS for all networking, service isolation.<p>- Did the compromise come about due to loading content from a third party? If so, how was that code authenticated (multiple browsers support SRI)? Was that code used to support the site functionality, or was it for tracking or advertising?<p>This seems like a perfectly reasonable bare minimum if you want to support a claim that the compromise was unavoidable.
biddlesby将近 6 年前
Do the regulators take into account whether the firm is actually at fault?<p>Without considering what happened in this specific scenario, surely there are cases where companies take the utmost care, follow standard security principles and still get hacked; or the issue was not with the company operating the website but rather with, say, a hardware manufacturer?
评论 #20381766 未加载
评论 #20380989 未加载
评论 #20381063 未加载
alkonaut将近 6 年前
Excellent. Now I wish they pick another big corporation (just pick one) and hand them a similar fine for using a standard GDPR opt-in-by-default popup.<p>They need to make it clear through <i>action</i>, not just vague wording, that having a default of allowing all tracking is not ok.<p>Pop ups should say “hi and welcome to site X. Click the yelliow button to enter with tracking&#x2F;personalization and the blue button to enter without”.
评论 #20381209 未加载
评论 #20381206 未加载
kkm将近 6 年前
Websites need to really up their game, specially given the amount of third-parties they are using.<p>I&#x27;ve tried highlighting similar issues in the past, where even if there is no active breach, but they are leaking sensitive data to multiple third-parties when it&#x27;s not needed in the first place.<p><a href="https:&#x2F;&#x2F;dev.to&#x2F;konarkmodi&#x2F;watching-them-watching-us-how-websites-are-leaking-sensitive-data-to-third-parties-1nn3" rel="nofollow">https:&#x2F;&#x2F;dev.to&#x2F;konarkmodi&#x2F;watching-them-watching-us-how-webs...</a><p><a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16516687" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=16516687</a>
rlpb将近 6 年前
Original source: <a href="https:&#x2F;&#x2F;ico.org.uk&#x2F;about-the-ico&#x2F;news-and-events&#x2F;news-and-blogs&#x2F;2019&#x2F;07&#x2F;ico-announces-intention-to-fine-british-airways&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ico.org.uk&#x2F;about-the-ico&#x2F;news-and-events&#x2F;news-and-bl...</a>
TomAnthony将近 6 年前
Is there a good reason for them not to launch a bug bounty program?<p>The cost of doing so would be significantly cheaper than any future fines, and would reduce the chances of future breaches.
jeffail将近 6 年前
&quot;amounts to 1.5% of its worldwide turnover in 2017&quot;<p>I imagine that&#x27;s a significant sum but I&#x27;m struggling to get my head around it. If so then good for the ICO I suppose. I remember reading endless comments a few years back speculating GDPR would never have any bite.
评论 #20380539 未加载
评论 #20381067 未加载
simion314将近 6 年前
Is good that we see on the font page of HN more GDPR fines for non US companies because I seen a lot of US users accusing that only US companies are targeted(there are other non US examples but those did not appeared or stayed on the first page here on HN ).
评论 #20381972 未加载
sbhn将近 6 年前
So who gets the money? The people who had there data stolen?<p>Who gets the money are the people who create laws. The more crimes commited, the safer there jobs are. The people who had there data stolen, are now on a register sold to the insurance industry, and the insurance industry decides they are a greater risk to insure, so the costs to the consumer go up. Strange how crime really drives the economy.
评论 #20380943 未加载
评论 #20380568 未加载
评论 #20380589 未加载
dijit将近 6 年前
This is a death knell for BA, my friends father is a high level manager and if he’s to be believed they are running on major thin margins.<p>Mostly due to compensating employees fairly in the 90’s-early-2000’s. Now they’re desperately trying to remove those compensation packages.<p>Although it could just be cost aversion masquerading as a hard requirement.
评论 #20380569 未加载
评论 #20381138 未加载
评论 #20383132 未加载
sneak将近 6 年前
Too bad this will all go to the state and not to any of the people who were actually damaged in the breach. :&#x2F;
评论 #20380630 未加载
评论 #20381351 未加载