HSBC has finally fixed a security problem that allowed web surfers to browse the directory structure of a supposedly secure website it helps to run. The John Lewis Partnership card secure website (a joint venture with HSBC) allowed hackers to view the directory structure, changing directories at will. Certain directories will always show a webpage, if the page exists in the directory. HSBC should have installed a blank index page so this problem never would have happened. Simple htaccess programming would have prevented the problem.
Some hackers knew of the problem since early April. This is not the first programming problem to plague HSBC. Changes to web code caused payment systems to crash at least three times, leaving merchants frustrated while customers could not pay for their goods.
Related posts:
