Why hasn't there been much furore about the hacking?

dunno TP. seems to me like it was totally outwith BF's control that this wasn't a catastrophic security breach rather than a mere nuisance.

Betfair was not hacked. The directory / naming service above it was hacked, which could have resulted in visitors being directed to the wrong site.

Think of it like a telephone directory. You want to call betfair so you look up their name in the directory.

Betfair = 555-1234567

You dial the number and speak to Betfair, all sounds great. Nothing wrong there.

Later that day hackers infiltrate the telephone directory and change the number. When you dial Betfair you are now redirected to 666-6666666. When the phone answers you hear some turkish guy ...

In most cases your phone would have 'cached' the proper 555-1234567 number. But for some people their cache (the browser, the pc, the ISP) may have refreshed and thus given out the 666-6666666 number instead. Certainly anyone who has never visited Betfair before would have been given the 666-666666 number.

Worst Case Scenario
Worst case scenario is that the hackers could have created a fake betfair site at 666-6666666 If you tried to login (and on some sites except betfair, even just visiting the site with loaded cookies) you could have given your username and password to the hackers.

In this example though I am sure it was just bragging - there was no harmful payload. But if the turkish guys had their 15 minutes of fame what about the hackers who did not boast about their conquest? What if 2 weeks ago serious criminals did the same thing but did not mention it? They could have cloned login details for thousands of customers in a quick 30 second grab and no one would know.

As I say this is no fault of betfair, or dell, or the telegraph. It is a wakeup call to the whole internet industry - things are not safe out there and more needs to be done to secure sites.

Thanks for the info but I'm aware it's not been hacked, in fact I'd read the piece Betfair plagiarised a good hour or so before they tweeted it.

http://nakedsecurity.sophos.com/2011/09/04/dns-hack-hits-popular-websites-telegraph-register-ups-etc/

I also mentioned in my opening post that it wasn't hacked into as such.

I'am also aware it's not betfair's fault as such although there are things they could do to prevent a serious event from happening.

What I don't get is why there's been hardly any mention of it on the forum.  I'm assuming it's more to do with the time that it happened rather than forumites being mature enough to understand what had happened.

I also don't understand why there's no mention at all of the hacking on the BBC website.  Surely it's more newsworthy than a car being on Mt Snowdon or a comedian swimming the Thames?

viva the way i see it is that banks are responsible for losses that they cant prove are due to their customers fault, so they have introduced higher levels of log in security to help save themselves money.  Whereas Betfair have no such legal reponsisbility and hence have poor log in security.

we all log in, and then betfair bosses take 445% pay increase from our comissiens.  is big money to take from all of us.

.. that wrapped on forum classic: /technology/news/8741597/Major-websites-hijacked-by-Turkish-hackers.html

templeton - i was on the tennis forum last night and there were a few grumbles, but not many.

the most likely explanation being that many, myself included, would have betfair's real IP address cached locally on our PCs in our dns cache so would not be redirected, so everything was business as usual. the most active users, and therefore those most likely to grumble, were likely have the lowest probability of being affected.

pittsburgh - i don't think the single password is the biggest flaw in the betfair security model: unencrypted authentication cookies are.

Pittsburgh Phil : The betfair password system is not secure. Any financial site which allows login in by a single password is open to abuse from

keyloggers
brute forcing (unless there are X incorrect password attempt lock-outs)
3rd party hacking (where XYZ site is hacked and a user has the same username and password on this site)

Brute forcing can be ruled out as I've been locked out several times, the most recent of which was last night.

Betfair should only allow login via a unsername, selected letters of a password (enter your 3rd, 5th and 8th letter of your password) and / or a pin number.

Or a text message pin sent to your mobile phone, such as paypal does.

Problems arise though because any users logged in via the API will have their password submitted many times per hour by their software without their knowledge, this is how I was locked out last night, because Gruss was submitting my old password every time I clicked on a price graph (I changed the password without closing/reopening Gruss).

Obviously Gruss/Geek/BA etc can't automatically enter 3rd, 5th and 8th letters many times per hour. Why the continuous API password requirement is required I cannot imagine, but it would have to be scrapped to allow for selected letters log ons.

Are you guessing DStyle? Are you saying that I've imagined it? Which API software do you use?

Trevh , the graphs aren't available via the api so gruss is basically getting round it by logging into the main site to retreive them. It was probably trying to login each time you clicked a graph as you'd changed password and each attempt got rejected.

DS, you don't need to login to see the graphs but the data's delayed if you're not logged in.

I very much doubt gruss makes repeated logins once it's retreieved a succesful session cookie for the web but as trev changed passwords mid session any login request to the site using the old password would result in an unsucessful request and subsequent requests for another graph would just try to login again and also fail.

ghetto joe - i guessed that probably what gruss is doing.

are you sure about the graphs being delayed though, i just though it was the prices? besides it would take a very keen eye to pick a relatively minute amount of staleness on a mature market.

Sorry guys, I didn't mean to turn this into a Gruss thread! But you were all right, Gary from Gruss said...

"It logs in to the website in the background so that it can scrape the price charts from the website and it is this request that is causing failed login attempts".

It must do it for every graph request I think, or me changing the password mid session wouldn't have effected it as it had already been logged in for hours.

Yes you're right Ghetto Joe with the cookie thing, all makes sense now.

I just checked the security tab though, and it shows the last 10 logons from my IP address all at 00:01 and 00:02! I'll check it again later as it may update slowly.