Comments on: Citizen’s Bank Online Gets Scary

By: Shane Shepherd

Shane Shepherd — Tue, 03 Jan 2006 22:14:14 +0000

@Joshua: The error you saw is a common ASP.NET error screen. It would be nice if a more friendly message was displayed when an error occurs though.

@Ron West: FYI – The error displayed doesn’t reveal anything about the server except that the site is built in ASP.NET….something a hacker probably could already tell by looking the file extensions (.aspx) on the rest of the site. I’m not trying to defend the appearance of the message, it should have been avoided.

By: Kate

Kate — Sun, 25 Dec 2005 12:45:26 +0000

o, i’m sorry… not msn, but hotmail.com… SORRY

By: Kate

Kate — Sun, 25 Dec 2005 12:42:50 +0000

Btw, the same problem is on the msn.com at the Opera browser (at least version (7.23)[my favourite]…

By: benry

benry — Sat, 24 Dec 2005 01:36:25 +0000

I’d guess that this was due to their new site launching. It’s up now. Simply better efforts to launch off hours, with a page telling people the new site was coming would have avoided this problem and the reputational risk they have now to enjoy with your post.

By: Steve Portigal

Steve Portigal — Fri, 23 Dec 2005 20:57:58 +0000

I thought of you just now…I am having SBC problems and went to their system status page
http://csc1.sbcis.sbc.com/systemstatus/
and clicked on California and instead of any status I get a page of HTML (which of course I can’t really exactly paste here because it gets interpreted as, well HTML…something like this, then):

HTML
HEAD
META NAME=”ROBOTS” CONTENT=”NOINDEX, NOFOLLOW, NOARCHIVE”>
META HTTP-EQUIV=”Expires” CONTENT=”0″>
META HTTP-EQUIV=”Pragma” CONTENT=”no-cache”>
META HTTP-EQUIV=”Cache-Control” CONTENT=”no-cache”>
TITLE>SBC System Status: Summary
link rel=”stylesheet” href=”/systemstatus/css/status.css”>
script language=”javascript”>
function checkAll(){
for (var i=0;i

By: Ron West

Ron West — Fri, 23 Dec 2005 13:49:25 +0000

I have seen this error before too. I also do business with Citizens Bank and I also was concerned when I saw this error. Not to metion that this error gives a potential hacker some useful knowledge about the application which scares me a bit more. Thanks for posting this I am glad to see someone out there cares about this kind of stuff.