Slashdot Mirror
HSBC Online Banking Security Flaw Analyzed
greenechidna writes "The BBC is reporting that a vulnerability has been found in the online banking service of HSBC by researchers at Cardiff University. According to the story the attack would allow an attacker to log on to an account within 9 attempts. The attack relies on a keylogger being installed on the victim's machine. The article doesn't have any further technical details."
David Nicholson adds links to coverage at CNN and at the Guardian, writing
"The attack revolves around the order that customers are requested to enter random security numbers on the site. The main news stories fail to detail the vulnerability but I have provided an analysis of it here."
As a HSBC internet banking user, I can safely say you'd be locked out long before your ninth attempt, hell; four locked me out when I last forgot my IB code. Being locked out is something you can only fix by visiting your local branch and using your password to unlock the account again.
The number of attempts is not given, but the automatic lockout is at least covered at their security page
Sorry Cardiff University, no bank hax for you today.
Don't try to outweird me, three-eyes. I get stranger things than you free with my breakfast cereal. -- Zaphod Beeblebrox
So IF my computer has a keylogger and IF my logins are recorded as few as 9 times, THEN the dishonest individual has my security code and can access my account. Whereas, at another bank which asks for a username and passcode, the dishonest individual with the keylogger only needs me to log in ONCE to have the run of my account. So why is this news?
Nathan Friedly
So if i have a keylogger on my machine and i log into my online bank, it will log the details i put in and comprimise my online banking?
no shit sherlock.
Aminal - DRUMMS!!
will be 'flawed' if you get a keylogger on my pc since the majority rely on me supposedly knowing something you dont, until the logger records it for you that is.
Do not try to read the dupe, thats impossible. Instead, only try to realize the truth
What truth?
There is no dupe
[quote]The attack relies on a keylogger being installed on the victim's machine.[/quote]
Isn't this a vulnerability in *any* user/pass interface on any computer in the world?
A spokesperson for HSBC is quoted in the article as having said:
"The reality is that it would be more profitable for that fraudster to concentrate his or her efforts elsewhere."
A single compromised user could mean a payoff of tens of thousands of dollars for a determined "fraudster." Particularly if that fraudster resides in a third-world country, that could be enough to live for years. Moreover, having to concentrate efforts on only one attack minimizes a fraudster's exposure to risk--a single instance is much harder to identify than a systematic effort.
No, HSBC, this is a problem. With the prevalence of malicious software on today's internet, keyloggers are a very real threat. Alternative systems can eliminate this vulnerability. Use them.
Find your friends!
Ok, so I replied with a joke a few minutes ago... but I think this warrants more intelligent discussion.
As a vendor of a web-based, access-restricted product, keyloggers are a real issue. I've been considering setting up client-side SSL certificates in order to restrict access to only machines that have been "set up" in order to deal with the problem of keyloggers. Are there better solutions?
Does this bank have something that's: A) Easy to use, B) doesn't require painful machine-by-machine setup, and C) significantly improves security?
If so, I just might be interested!
I have no problem with your religion until you decide it's reason to deprive others of the truth.
I'm quite worried about key loggers so I always enter my password incorrectly the first two times and then input it successfully the final time. This ensures that my password is as secure as possible.
More so if I screw up the last attempt and have to request a new password.
Another simple solution is to keep your password in a text file and copy / paste it in.
Or your password could just be ******* that would work a treat...
Summation 2
This isn't a security flaw. If you have a key logger, you have everything for any bank site, or any other site for that matter. I wonder who disclosed this? Perhaps a competitor? Cause it's the stupidest thing I've ever heard.
HSBC had a virtual keyboard feature. A keylogger would not work with that. You use the mouse to enter letters on it. Maybe the virtual keyboard only has 9 positions, and maybe they are recording mouse movements?
-- these are only opinions and they might not be mine.
My ingdirect.com.au savings account has a login method that would stop any keyloggers.
You type in your account id (keylogger can pick this up obviously), then you are presented with an on screen keypad where you enter your pin number with the mouse. 4 digit pin number ( easy to remember), the numbers are in a different location on the on screen keypad every time. The only way any spyware can capture this would be with screen captures on every mouse click. I am not sure there are many spywares that go to these lengths.
Comment removed based on user account deletion
The only good way to beat keyloggers is some sort of per-machine file. One of the best things I've seen is where you have to pick a certain file off your computer and upload it every time you log in (e.g. a picture of your kids) in addition to a password. So even having the PW is useless without this extra file. This does require some setup - during account establishment the user has to go and select this file (and make sure its on read-only so no one can edit it and destroy account access).
Thats the best means I've seen so far to protect against keyloggers.
The Doormat
If you're not outraged, then you're not paying attention.
In the U.S., most places have taken to just displaying the last 4 digits of your credit card number on the receipts they give back to you. However, on a recent trip to Europe (Finland & Russia, actually), I noticed that the receipts there seem to favor a scheme where a random set of digits appear each time (e.g. XXXX-XXX1-234X-XXXX). If you're like me, you often accumulate a bunch of these receipts in your pockets as you travel; some people may just dump the days wad of receipts in a trash can. A fortunate dumpster diver may stumble onto a wad of receipts that allow him to reconstruct the credit card number. I'm not sure why the people that implemented that latter scheme thought it was preferable.
-BbT
This just in...
Another HSBC Security Flaw has been found. If you are logging into your account, and somebody is looking over your shoulder while you're doing it, odds are they can determine your username & password after only 1 successful login attempt.
Keyloggers would defeat the security at most online banking websites. I know it would defeat www.wamu.com which uses only a username and password. And yes, HSBC has taken better measures on some of their websites but this still does not protect against keyloggers.
So who should we look to for an answer? ING Direct! They use a two step process to log in. The first is a non-descript customer number. This step would be defeated by a keylogger or if someone had some mail stolen. Step two is to ask you to answer a pair of personal questions only you know the answer to. Still this could be defeated by a keylogger. The third step is pure genius though. First of all the page displays an image and phrase that you pre-selected. While a keylogger might pick up this phrease during account setup it would not pick up the image. If the image is not present, you are instructed not to enter your PIN number. Then the entering of the PIN number is via a keypad that you click with your mouse. Each number corresponds to a random letter that changes everytime you log in. If you choose you can type in the letter that corresponds to each number for that log in. In this case the data a keylogger might capture would be useless. This is the best security feature on the website and ensures almost nobody except the account owner can ever log in. Of course if the PIN is compromised then the whole system breaks down but a smart user will never have a compromised PIN.
Google's out to hijack my machine! ; )
No matter what kind of security mechanism you have, the moment a keylogger is acting as a man in the middle, the security is flushed down the tubes (I bet someone will find a witty joke... I'm waiting).
Banks here are using one time pads, quite sophisticated ones that are complicated enough to puzzle quite a few of honest users simply wanting to use their online banking service. And that's still no increased security. As long as the midm attack is possible, and that will be the case as long as there are not black box machines that can do NOTHING but actually communicate with the bank, without the possibility to install anything on them, this won't change. No matter what kind of security you implement.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
INGdirect's banking system sets you up with a 4-digit PIN. However, you don't actually enter that number; they have a numeric keypad image that you click on, and a Javascript applet enters letters which correspond to the number on each key. (If Javascript doesn't work for you, you have the option of just manually typing in the letters that correspond to the digits as shown by the image.) These letters change each time that you log in, so unless the keylogger can intercept that image too, it would be useless to know what letters you typed.
Also, INGdirect shows an image and a phrase selected by you when you log in, presumably to foil a man-in-the-middle attack, although I don't know the details.
I'm pretty impressed with INGdirect's cyber security practices: fairly secure yet practical, without needing a USB blood extractor/DNA analyzer dongle. By the same token, when I went to HSBCdirect's site, I was somewhat disappointed by their site. It's not that bad, but you'd expect better from an institution that bills itself as "the world's local bank". Part of this doesn't have to do with cyber security, just stuff like the web site being unclear, the hassle of having to wait for customer numbers in the mail, the delays in signing up for an account only to discover that although I had an "account", I did not yet have an "internet account". HSBC offers a higher interest rate in their savings account, but I'm going to take a very close look at them before I commit a whole lot of money to them.
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
I find this all pretty funny, especially the requirement of the keylogger, because it hits home pretty close. A web application I wrote and deployed to production about a year ago and now support was finally put through a third-party security check a few weeks ago. The results were fine for the most part. The application is more or less rock-solid since it is secured through Kerberos, hardened against sql injection, and invulnerable to cross-site scripting attacks.
What the company did list as issues (and severe issues mind you) was the fact the application displayed signs of being vulnerable to cookie stealing, and session hijacking through man-in-the-middle attacks, that the server type was sent in the http headers, and that ports 110 and 25 were open on the web server. Well, my complaint is that the security report listed the application problems first, and give them a higher score of criticality, which made everything else, including the open ports 1) seem less sever, and 2) seem as though they were application problems and not network problems, which is what they really are. The business people flipped out and thought the sky was going to fall, since there is some sensitive information stored in this system. Rather than breaking out champagne and celebrating the fact the system was secure against 99.9% of the attacks that would possibly be thrown at it, they lamented issues that weren't application issues. Now understand, I don't manage the servers this application runs on. I merely wrote the application. I don't know what all kind of shit the people who do manage it might have changed.
The funniest thing is, in order to successfully run any cookie stealing, or session hijacking, you (the hacker) had to already have access to not one, but two windows accounts on the domain! The only way to get those was to either work there and have an account, brute-force the username/password, or social-engineer someone out of theirs. And, in order to successfully run the man-in-the-middle attack, you would have to have penetrated the LAN, or hacked someone's computer at their home.
I began to run damage control, explaining how these exploits were possible, why they weren't application issues but network issues, and explaining lots of terms like ARP spoofing, cache poisoning, and how to avoid those things. I remarked that the open ports issue should be rated more highly than the MITM issues, and I also detailed how virtually every web application ever written was similarly vulnerable to these attacks in one way or the other, only to wind up being told that can't possible be true, how I'm extremely arrogant, and how I think I know everything! One person even threatened to have me removed from the project, the cocksucker.
At any rate, the requirement of the keylogger reminded me of the extenuating circumstances needed to exploit this application here: network penetration, not one but two valid accounts, and specialized knowledge of the application.
It's weird. You try to help people and do your job, and they hate you for it. I think I've been doing this for just too damn long.
hey, if you type in your pw, it will show as stars
<Cthon98> ********* see!
<AzureDiamond> hunter2
<AzureDiamond> doesnt look like stars to me
<Cthon98> <AzureDiamond> *******
<Cthon98> thats what I see
<AzureDiamond> oh, really?
<Cthon98> Absolutely
<AzureDiamond> you can go hunter2 my hunter2-ing hunter2
<AzureDiamond> haha, does that look funny to you?
<Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
<AzureDiamond> thats neat, I didnt know IRC did that
<Cthon98> yep, no matter how many times you type hunter2, it will show to us as *******
<AzureDiamond> awesome!
<AzureDiamond> wait, how do you know my pw?
<Cthon98> er, I just copy pasted YOUR ******'s and it appears to YOU as hunter2 cause its your pw
<AzureDiamond> oh, ok.
(taken from <url: http://www.bash.org/?244321> )
404555974007725459910684486621289147856453481154 in hex is "You sank my Battleship?"
[GPG key in journal]
Here in Indonesia, the largest bank (BCA) gives you a small gadget that generates a different password (8 digit IIRC) everytime which you then enter into your web browser. The gadget is tied to your account only.
I personally think it's a hassle, but it might work in this case.
google: verb - to search for information on the Internet.