Slashdot Mirror
UK Banking Law Blames Customers For Insecure OS
twitter writes "If you use an insecure OS in the UK and someone drains your bank account, the banks say it's your fault. The Register reports: 'The Banking Code produced by the British Bankers' Association (BBA), and followed by most banks, makes it clear that banks will not be responsible for losses on online bank accounts if consumers do not have up to date anti-virus, anti-spyware, and firewall software installed on their machines.'" twitter went on to note that the majority of consumer PCs use an operating system with a history of security issues. Should end users be ultimately responsible for the state of their systems?
But I think there's an ulterior motive here. As a part of Chip-and-PIN, the UK is testing a brilliant two-factor authentication system this year for cards that will cryptographically render browser, PC, and merchant security moot. It's possible this is being used as a "warning shot" to frighten consumers into picking up the tab for the high cost (approximately $70) of the handheld security module.
They have the technology to keep it safe now. I think they're just too cheap to fund it themselves. (And I really wish we'd start seeing that kind of security technology available here in America. I'd switch banks and pay the $70 myself in a heartbeat.)
John
So, to summarize:
bankers: "You better use a secure OS, or you'll be liable for any fraudulent transactions with your account."
customers: "Okay. What if we use Firefox on Linux?"
bankers: "That'll work."
customers: "Hey, we can't access your site using Firefox!"
bankers: [British equivalent of "hah! Sucks to be you!"]
Apology to Ubuntu forum.
Look, if an account compromise occurs as a result of a compromise on the bank's side (web server, backend network, etc), it's the bank's fault. If the compromise occurs because the user's login gets sent to some dude in Russia by a keysniffer running on the user's already compromised workstation, it's MOST DEFINITELY the user's fault. This isn't complicated. Wow.
Suppose one is running a hardened version of OpenBSD on some PA-RISC machine. Suppose then that this person's bank account is drained out and that said draining has NOTHING to do with their computer or OS. Suppose it's drained by someone who prints checks with a random bank account number on them and it just so happens to be this OpenBSD user's bank account. Again, the theft has NOTHING to do with their computer, OS, computing practices, or hair color. What will happen? Will the bank file a discovery motion to check if the person has anti-virus software on their hardened machine? What? No anti-virus software? Never mind that there is no virus to check for. This is scary as it gives the bank a way to weasel out of its own responsibilities.
McCain/Palin '08. Now THAT's hope and change!
In the US, a friend of mine (a lawyer) basically described the state of banking laws as "the bank is always right, if the bank is wrong the bank is still right". This was based on 1930's banking laws when the banks went to the gov't looking for a bail out and convinced enough people to severly restrict their liability.
If there is a lawyer in the house can they confirm this?
Not sure what the state of the laws are elsewhere, but knowing what a bunch of whining snivelers the banking industry is it's probably the same. The bank is always right and the depositors and the taxpayer pick up the bill.
putting the 'B' in LGBTQ+
I just seen on news the same news about our Polish banks. And to be honest, I can't see any way security can be made when used compromised operating systems on client's accounts. Even USB tokens are not enough when someone else than you controls your PC.
Should end users be ultimately responsible for the state of their systems?
The Microsoft Windows OS is not the property of the consumer using it. It is the property of Microsoft used under a license from Microsoft. If the usage of the OS complies with the license then surely any inadvertent behavior on the part of the OS is the responsibility of the owner (Microsoft) and not the license holder (the end user).
]{
1. How do they know whether or not one's computer had an AV, anti-spyware, and firewall software installed at the time it was supposedly compromised? (Privacy issue.)
2. Bank customers do have some responsibility in security. Analogy: A homeowner has no locks, leaves door unlocked all day long, then tries getting his or her insurance company to pay out when he or she is ripped off.
3. AV, anti-spyware, and firewall. All three must be done? I think most people are familiar with the AV and firewalls, but how many know about anti-spyware software? (I believe Lavasoft's AdAware is one program.) What they should do is say that the person must make a reasonable attempt at securing their computer. (This could include having a separate computer used solely for banking, and nothing else.)
4. A thought just crossed my mind. Will they deny a claim if someone just happens to have an unsecured computer, even if the computer never was used for banking?
I'm pretty freaking tired of all this "advice" that you need this protection for Windows machines.
Why should I have a firewall? I have a NAT router (hardware firewall).
Why should I have antispyware? I know what I'm downloading.
Why should I have antivirus?
- I don't download cracks. When I DO need to use a crack I upload it to virustotal and then run it in a virtual machine.
- I run IE7 and Firefox. Although neither are perfectly secure I don't make it a habit to go to Russian warez sites.
Dear god, SOMEONE explain to me why any reasonable user should need this resource-hogging crap?
Someone who obtains a bank account number via spyware is ethically (and should be legally) no different than someone who obtains a credit card number by picking someone's pocket.
People can be be so negligent that they are practically asking for their wallet to be stolen... in which case they should share some of the responsibility for the theft. But the criminal is still guilty of a crime.
Banks can also be negligent, by not keeping tabs on account activity, or not taking several other measures that can reduce theft and fraud. If they do not do those things, then they should share some responsibility, too.
I see nothing new here, unless the banks are trying to weasel out of their share.
even if a user's computer has a keylogger installed, the bad guys would only be able to steal the access code, not the password of the user - because the passwords are from a list and are unique for each session. At least that's how they do it in all banks in Finland. Once the user is logged on, to start a new (parallel) session, a new password would be requited, even if the bad guys would manage to steal the one-time password just when the user is logged on.
"The agriculture ministry is not in charge of Gundam" - Japanese ministry official.
No "sensible" person leaves their cheque book open, with 25 presigned cheques ... because the bank could hardly be held responsible if someone stole that chequebook and emptied your account.
... because no insurer would ever pay out for the theft of that car.
... this culture of "what the hell, someone else can be the scapegoat" make us all too lax ...
... maybe if you knew that YOU were going to have to pick up the tab for your losses, you'd take a bit more care about what you do online.
... but MSIE, Firefox, any other solution is really academic ... ANY solution is only as secure as the PC you are running on, and a keylogger logs keystrokes from ANY application ... so be 110% sure you DON'T have a keylogger before using online services ... and don't expect someone else to pick up the tab when you screw up. Because let's face it, it ISN'T the bank picking up the tab anyway, it's the rest of us.
No "sensible" person leaves their car wide open, with the engine running
So why is it okay to leave your PC "wide open" and the banks have to pick up the tab ?
Your security is your own personal responsibility
I like this proposal
Okay, so the banks are two faced for talking about secure browsing, and then only accepting Internet Explorer
Someone finds a security hole in IE7 or Firefox. At the same time, they find a security hole in IIS or Apache. Using both these holes, they attack some well known and trusted site, maybe a newspaper, and use it to do drive-by attacks on visitors.
Yes, this does happen.
client rings up the bank, 'i have been stolen from',
bank rep asks: whats your operating system:
client says: mac osx
rep says: im sorry sir that means your liable for the losses
client asks: why
rep says: you dont run norton antivirus, only norton antivirus protected computers are safe. Thank you for banking with us, can i help you with anything else?
I wholeheartedly agree. It's only logical. Banks are responsible for the security within their own networks and their web servers which are on the edges. That is Just Fine.
I (The Bank Customer) am 100% responsible for the security of my own systems that I use to access the banking website. How could I POSSIBLY expect the bank to be liable for rootkits, malware, spyware, etc. I can't. That's just not reasonable.
The only thing I can think of that might go either way would be DNS type hacks since that would depend on how it was done and just exactly what point in the communication it was affecting.
Now with that being said.........
It would be the BANKS'S RESPONSIBILITY to TELL the consumer THE BAD NEWS. I can't wait. That's a "shitstorm" waiting to happen.
So basically, the vast majority of PC's are hopelessly insecure. We could talk forever about Microsoft this and Microsoft that, and "what about Safari?", blah blah blah blah. The situation is still the same. The Bank Customer's computer is just not secure enough in most cases and it could only be a matter of time before you are the "lucky" one and get nailed. Kind of like a lottery, except you get bent over.
In the end the only thing that will happen is that people will stop using online banking. I know plenty of people now that outright refuse to use it for the perceived security risks NOW. If the bank's outright say that they will not be responsible for the security on your computer, that will only make the situation worse (for them).
I'm pretty good at securing my systems, but even I know it would only take one determined person to get me. If the bank will not at least insure my losses, I can't take the risk of online banking. That simple.
If this really does go down, that will be a pretty big statement about PC security in general. Regardless of who is responsible, if a bank says it will no longer trust the end user's security that is a bad omen for the rest of e-commerce. What about the credit card companies? How will they react to the bank's position?
This may sound facetious, but is any system really secure from keylogging?
I dual boot Ubuntu and Windows. If I type:
sudo apt-get install lokkit (as an example, not an accusation) how do I know I'm not getting a free keysniffer as an added bonus?
I run windows with a firewall, have a firewalled router with minimal ports forwarded, use ad-aware/the windows spyware program/spybot search and destroy as well as AVG. How do I know that none of these pieces of software are, in themselves, spyware/keylogging software? How do I know that my browser hasn't been attacked by some 0-day hack embedded in an ad banner despite rigorous/consistent upgrading of both of my OSes?
Are people really diligent to that point that every time they're about to do their banking, they close all active programs, update and run their suites of virus scanners and anti-spyware software, and *then* do their banking once the all-clear is given by all programs?
Honestly, I just see it as a game of probabilities. *Most likely* I don't have a key logger installed on my system, and *most likely* my banking experience is going to be a sane one, but if the shit ever hits the fan, I'm willing to bet that there are people hired to specifically poke holes in my system and say "Linux is an unapproved OS. We can't cover your banking losses."
I look forward to a better solution.
My old bank closed my online banking account without warning, and without bothering to tell me they had. I called them and they said it was because "I had a virus". This, despite the fact that I run a secure operating system (with no known viruses) and have an up-to-date virus scanner. Couldn't they just suspend my account until I "fixed" the problem? No, I had to open a whole new one.
I did. At another bank.
... from physical cheque books and credit cards. If I leave my wallet in a place where cards, etc. might be stolen, I'm responsible for any loses that occur - shouldn't the same be true if I leave my electronic 'wallet' open? I really think that, within limits, people need to be held responsible for their actions/inactions - too much 'I never realised/knew/expected/thought that might happen' in the world. The banks should have similar guidelines to those used for stolen physical banking paraphernalia - if you suspect your PC might have been compromised, report it to the bank within a given time fame and they thereafter accept responsibility for subsequent losses.
I am bald
Comment removed based on user account deletion
So just exactly who decided to put customer information / account access on the internet where security problems are widespread and well known? Those so-called professionals at the banks must have known that this would lead to problems - and did it anyway.
Pointing at insecure computers, spyware, malware, etc as being the problem is ingenious. This is simply an attempt by the bank to move some of its expenses onto its customers.
Remember - none of these internet security / fraud problems would exist if the bank hadn't put the customer accounts online. They knew this was likely to happen and now this bad idea is starting to affect their bottom line. Rather than take responsibility for their mistake, they're abusing the legal system to move the losses onto their customers.
Gotta love those banking corporations...
Funnily enough, this reminds me of something I once read, by Schneier:
"In Beyond Fear I wrote about ATM fraud; you can see the same mechanism at work:
'When ATM cardholders in the US complained about phantom withdrawals from their accounts, the courts generally held that the banks had to prove fraud. Hence, the banks' agenda was to improve security and keep fraud low, because they paid the costs of any fraud. In the UK, the reverse was true: The courts generally sided with the banks and assumed that any attempts to repudiate withdrawals were cardholder fraud, and the cardholder had to prove otherwise. This caused the banks to have the opposite agenda; they didn't care about improving security, because they were content to blame the problems on the customers and send them to jail for complaining. The result was that in the US, the banks improved ATM security to forestall additional losses--most of the fraud actually was not the cardholder's fault--while in the UK, the banks did nothing.'
The banks had the capability to improve security. In the US, they also had the interest. But in the UK, only the customer had the interest. It wasn't until the UK courts reversed themselves and aligned interest with capability that ATM security improved."
from http://www.schneier.com/blog/archives/2006/06/aligning_intere.html
it proved so unpopular that banks were effectively forced to reduce their hard-line stance:
http://www.consumer.org.nz/newsitem.asp?docid=5114&category=News&topic=Internet%20banking%20rule%20back-track
http://catless.ncl.ac.uk/risks/18.25.html#subj5
Why fix your own systems when you can blame the customer?
Mea navis aericumbens anguillis abundat
"If you act without reasonable care, and this causes losses, you may be responsible for them."
In other words, if your authentication info gets stolen by a virus that's in the wild, and would have been blocked by up-to-date antivirus software, you're responsible for what happens as a result.
This does not appear to be intended to make the customer's software a scapegoat, just to hold people responsible for failure to take reasonable steps to protect their accounts. It is still very much in the bank's interest to improve account security measures, as most losses will not be clearly attributable to a cause that would allow this provision to be invoked.
There's no failure quite as dissatisfying as a complete and total solution to the wrong problem.
Of course the bank shouldn't be responsible for losses incurred that are because the customer's own access device had a problem the customer should have known to fix. If the customer's device was vulnerable, but not actually compromised, of course the bank is liable if the bank's system caused the loss. Even if the customer's device was vulnerable and compromised, if that compromise didn't cause or contribute to the loss, of course the customer is not liable, if the loss was entirely the bank's fault.
If the loss was incurred by a bad guy exploiting an open vulnerability in the customer's access device, then the liability should be exactly the same as if the bad guy had entered the customer's home and stolen the key to their vault at the bank. If the door was locked, the customer is not liable at all, and the burglar is fully liable.
If the "door" was not locked, then the local laws, wherever the burglar did whatever they did to subvert the customer's device, will determine whether the burglar has any less liability for picking an easy target. The laws local to the customer's "unlocked door" will determine whether the customer has any more liability.
This is all a matter of obvious principles of liability for one's actions, and long-settled law governing that liability. Of course the bank is liable for losses it caused, even if just through negligently failing to protect its own systems. Now, of course the bank is going to try to weasel out of that liability, if it can: banks don't care about principles or laws, just the money they can make or lose. But if I leave my credit card at a restaurant, and then some burglar breaks into my safe deposit box while the bank security guard sleeps, of course the bank is liable, and not me, and not the waitress who was trying to charge a new TV to my account at the time - even if she's responsible for the TV charge, completely independently.
--
make install -not war
So give every customer a Live CD of a really locked down Linux and a special purpose browser pointed to the bank.
Say what you will about Paypal and eBay, but Paypal has the option (at least in the US) to pay $5 for a Security Key. This provides two factor athentication, something that you have (the security key) and something that you know, your password. Something that has been arround for over 20 years. Most current trojans are out to grab your ID and password and store them for later use. You can't do that with a constantly changing security key number.
Banks, like any other business, just do not really care about security. What they do care about is liability. It's the same as insurance companies. Which costs less, added security or the losses involved in security that is "just good enough"? What we are now seeing is that this balance is changing as a result of an increase in computer trojans that are out to steal money.
Until the banks provide the consumer with better security options, in my opinion, the liability falls on their doorstep.
David
And if an exploitable bug should be found in the browser, what then? Send out new CDs to all your customers and hope nobody continues to use the old one?
Building your system around read only media has always been a bad idea. You can't patch it when something goes wrong - and something always goes wrong.
--Gareth
Not to say the other method isn't better, but it isn't quite that bad. I used to work in the debit processor industry, essentially our computers were the ones that the PIN was sent along to.
It actually works like this: PIN entry -> Unique encryption in keypad (light sensitive PRAM typically) -> Debit machine processing -> VPN or dial-up direct to processor -> decryption based on id of machine and uniquely assigned encryption keys -> somehow (varying) communicated to bank ->back up the line with approval/denial.
It is supposed to be using hardware that never stores the encryption keys (triple DES mandated) anywhere that is accessible from the machinery that processes the transaction and they're tamper resistant (not quite proof, but difficult) with the encryption key knowledge being split between (at least) two people. The keys are unknown to the people who handle them until the time of entry and only stored in the end machine and in the processing machine (identified by serial number or machine ID.)
It is possible for the systems to be compromised in several ways, but paranoid safeguards are in place to make it difficult. Getting card numbers is no terrific feat, as evidenced by all the news stories about exactly that, but mechanically getting PINs usable for debit transactions is tremendously more difficult. That isn't to say it can't be done, but it does raise the barrier much higher than just sending your PIN along.
On the other side though, the decision on whether to approve or deny a transaction is typically just a matter of an unencrypted 0 or 1 along with the mirror of the transaction. If a transaction is denied, but the machine gets a 1 where it should have received a 0, then the merchant has no immediate indication that the cash or goods weren't paid for. Machines using debug or emulation modes occasionally get into service and approve everyone without even validating the transaction, but as you can imagine that gets pretty prompt attention.
B) Eliminate all the stupid users. This is frowned upon by society.
Isn't this the bank simply saying "we're too lame and lazy to write a secure website and teach our users how to safely surf the Internet"?
If you configure the browser to connect to the bank's site but nowhere else, who can exploit the vulnerability in the browser?
But it is still a bad idea. While I am working, I want to do some banking stuff several times a day. If every time I need to restart my notebook it would suck. I might start using a VMware instance but not every bank customer is able to.
Search RapidShare and MegaUpload!
If Barklay sets up this stuff and adheres to it, and I as a possible customer have an account there by which I physically pay my bills by cheque, but never by using any of the online services, and in fact never even initialize any of the access online, and someone accesses my account and rips me for all my funds, am I still responsible??
I think that deserves a look don't you? Language after all; is still legal and how you phrase your "terms of service" is how you either are forced to replenish the customers funds, or you get off Scott-Free and not face any repercussions.
Just a thought...
All content in this message is copyright (c) 2008. All rights reserved. RIAA is prohibited here.