Slashdot Mirror
IE Devs Criticize Bank Security Vulnerabilities
mrcaseyj writes "A post on the IE blog criticizes some banks for no longer using secure connections for entire login pages and only encrypting the password as it goes back to the bank. This prevents simple password sniffing but doesn't prevent a man in the middle attack from replacing the unsecured login page with one that has disabled encryption. This is especially a problem if you are using an unencrypted wireless connection such as at a coffee shop, because hackers can easily use the airpwn package to intercept the login page and steal your password. An easy remedy for when a secure page isn't available is to enter a bad username and password which usually brings up a secure page telling you to try again. But can you really trust your money to a bank that doesn't even offer the option of a secure login page?"
"But can you really trust your money to a bank that doesn't even offer the option of a secure login page?""
But can you really trust your money to a web browser and operating system that are the most hijacked in the world?"
There, fixed it for you.
Links goes to some 2 year old blog entry.
The entire session should be secured. Bank account numbers, credit card numbers, transaction histories, information about billers and automatic withdraw dates etc. are easily sniffed.
Just because they can't get your password doesn't mean they can't get useful information about you. Sniffing out an online banking session could be a big jackpot for an identity thief.
"This is especially a problem if you are using an unencrypted wireless connection such as at a coffee shop"
Surely anyone who logs onto their bank site from a wireless connection in a coffee shop is just asking to get owned?
Personally, I wouldn't trust any bank whose security system relies on user supplied credentials. Any bank that does not supply its customers with an electronic hardware-based security token is not trustworthy enough to handle my savings.
Football Odds
I petitioned my credit union to force SSL on the entire bank website, complete with a few dozen signers (several of them with very large accounts). Shortly after the entire website is accessible via SSL only, with any HTTP page redirecting you to the homepage (SSL). Sometimes banking with a small credit union has its advantages.
I suggest everyone do the same.
This same annoying tendency of banks has another artifact (it's probably not intentional). It typically prevents the user's password management scheme (like Keychain on Mac OS X and analogous 3rd party password managers for Windows) from working properly. Without a tool like this to support the effort, most people wind up using the same password for all their web logins, which exposes them to dramatically increased risk. (Bad guys can exploit this common human behavior by plucking username / password combinations from any arbitrary p0wn3d web site, and then testing them at all the banks.
If you mod me down, I shall become more powerful than you could possibly imagine.
Published Wednesday, April 20, 2005 6:44 PM by ieblog
Two thousand and five.
Why should I really worry about security anyway they've either thrown away my information in a dumpster or were compromised...
Scott Trade
Verizon
Bank of America
Choicepoint
Mastercard
AT&T
Department of Edumacashun
Chase
Infiltrated dot Net
Great article, but WHICH BANKS are the problem?
I'd love to complain to my bank if it is guilty of these lapses, but how would I know?
They're just file extensions buddy, they can't hurt you.
Spelling mistakes, grammatical errors, and stupid comments are intentional.
Just put your money in your mattress and avoid all those newfangled bank things.
Big banks have the tools and means, but also a whole wall of 'change control' that requires you to explain in detail why, exactly, you think the way they're doing it is moronic, and to assess it's impact exhaustively alongside the relative costing of project to redesign and implement a solution.
I have worked with computer programmers who think they know how to write secure software, but don't. They know maybe one or two basic principles, and think they have it all figured out. I call this the "well no one told me" phenomenon.
Not every IT professional wants to spend lots of his free time researching the latest means of breaking into something, and defending against the break-in. So a lot of people just don't go out of their way to find out if they really know enough to write secure software...it is easer to assume that one's current knowledge is sufficient and to let one's employer take the heat when something surprising comes up.
Furthermore, employers don't like sending their employees off to training which ultimately will not increase their bottom line, and which may not even turn out to be necessary at all (after all, he DOES believe he can write secure software...). Worse yet, employers don't want to hire people to try to hack into their site, seeing as how that costs a lot of money and time too, and there is no guarantee that the third party actually tried hard.
The end result is quite predictable: insecurity all around.
Reduce, reuse, cycle
Banks have a much bigger problem than this. With the amount of spyware out there and the almost total lack of understanding of what vulnerabilities this exposes, probably more than 1/3 of the passwords and account details are known by Black Hats.
There are many ways to slip money out of accounts it isn't funny.
Trading accounts:
Create a series of bad trade orders. Offset these with legitimate trade orders in legitimate accounts. There are many thinly traded companies where it is easy to figure out who has the buy order and who has the sell order. All one has to do on a thinly traded company for instance is place a lowball buy order and have the victim's account buy shares at whatever price and then sell them into the lowball. This can be triggered from instance by a stop loss order. Once the shares are owned they can then be sold to another victim.
Chequing accounts: Create fraudulent transactions by paying for goods not ordered. These goods can even be shipped to create a semblance of legitimacy. By the time any of these goods arrive and the transactions are noticed the perpetrators are long gone with their loot.
Its quite easy to create a series of dummy companies to accomplish this. Of course, since this is e-commerce one would obtain valid certificates ahead of time.
This is one reason that secure communications offer limited protection. A felon in Jail can always get his lawyer to register a corporation for him and these are legitimate corporations. Its just they are run by crooks. But then Enron was run by crooks too it would seem. In fact, there are a HUGE number of companies run by crooks. Lots of people invest in them.
These really are just a few of the many many things we do to protect your data. In fact, I deleted 2 of the list items that I originally wrote about because I didn't want to give away any information that could be useful to a potential crook.
We take security very seriously for two main reasons. First, we're liable for any losses you have due to a security breach. But more importantly, we can't afford to lose the faith of our customers. If they don't trust us they'll take their money somewhere else. The actual financial loss from an attack on our system would be minor compared to the loss of trust from our customers.