Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

1/10/2008
03:57 PM
Tom LaSusa
Tom LaSusa
Commentary
50%
50%

Brit Posts Bank Account Number, Gets Hacked

The world is filled with daredevils: bungee jumpers, mountain climbers, those crazy guys who get chased by bulls in Spain. However, none of those thrill-seekers hold a candle to British columnist/TV celebrity Jeremy Clarkson. Fearless to the core, Mr. Clarkson decided to publish his own personal bank account number in the paper, confident that no one would be able to do anything with it.

The world is filled with daredevils: bungee jumpers, mountain climbers, those crazy guys who get chased by bulls in Spain. However, none of those thrill-seekers hold a candle to British columnist/TV celebrity Jeremy Clarkson. Fearless to the core, Mr. Clarkson decided to publish his own personal bank account number in the paper, confident that no one would be able to do anything with it.Over the last few months, Mr. Clarkson's colleagues in the British media have been reporting about a massive data loss suffered by HMRC (Her Majesty's Revenue and Customs) -- a department of U.K. government that deals mostly with tax collection. In November, it was revealed that two of the department's discs, containing various data on nearly 25 million individuals, had vanished. The discs were password protected, but not encrypted.

The incident has resulted in board resignations, lawsuits, public outcries for changes to data protection, and more. One of those not overwhelmed or impressed by the massive data loss -- Mr. Clarkson.

As mentioned earlier, convinced that everyone was blowing the situation out of proportion, Clarkson decided to "prove a point" by publishing his bank account number in the newspaper. According to him, the only thing that anyone could do with a bank account number would be deposit more money in the account. (Aww, isn't he cute?).

Needless to say, a point was made.

The following month, his bank statement indicated that his account had been set up to make a direct debit of £500, with the money being given to a charity. Furthermore, because of a U.K. law called the Data Protection Act (DPA), the bank -- and Clarkson -- are prohibited from investigating and determining who set this up. Nor can they prevent it from occurring again, unless, of course, he closes that account and starts up a new one.

It goes without saying I'm fresh out of sympathy for Mr. Clarkson. His "brazen" act smacks of complete and utter naivety of how data theft works, and what exactly can be done with your identity when its stolen. He's very fortunate that the person who used the account information was merely trying to prove a point as well, and pulled a "Robin Hood" by giving a small amount of money to a charity.

But hey, maybe this is how Clarkson lives his life on the edge. No climbing K2 for him. Forget swimming with sharks. Risking his identity is what gets his blood pumping.

You know what? So does exercise.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Firms Improve Threat Detection but Face Increasingly Disruptive Attacks
Robert Lemos, Contributing Writer,  2/20/2020
Ransomware Damage Hit $11.5B in 2019
Dark Reading Staff 2/20/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
How Enterprises Are Developing and Maintaining Secure Applications
How Enterprises Are Developing and Maintaining Secure Applications
The concept of application security is well known, but application security testing and remediation processes remain unbalanced. Most organizations are confident in their approach to AppSec, although others seem to have no approach at all. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17274
PUBLISHED: 2020-02-26
NetApp FAS 8300/8700 and AFF A400 Baseboard Management Controller (BMC) firmware versions 13.x prior to 13.1P1 were shipped with a default account enabled that could allow unauthorized arbitrary command execution via local access.
CVE-2019-17275
PUBLISHED: 2020-02-26
OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers.
CVE-2020-3169
PUBLISHED: 2020-02-26
A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying Linux operating system with a privilege level of root on an affected device. The vulnerability is due to insufficient validation of arguments passed to a spe...
CVE-2020-3170
PUBLISHED: 2020-02-26
A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause an NX-API system process to unexpectedly restart. The vulnerability is due to incorrect validation of the HTTP header of a request that is sent to the NX-API. An attacker could expl...
CVE-2020-3171
PUBLISHED: 2020-02-26
A vulnerability in the local management (local-mgmt) CLI of Cisco FXOS Software and Cisco UCS Manager Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system (OS) of an affected device. The vulnerability is due to insufficient input vali...