Slashdot Log In
IE Devs Criticize Bank Security Vulnerabilities
Posted by
Zonk
on Tue May 08, 2007 08:22 AM
from the i-tend-to-like-that-little-lock-icon dept.
from the i-tend-to-like-that-little-lock-icon dept.
mrcaseyj writes "A post on the IE blog criticizes some banks for no longer using secure connections for entire login pages and only encrypting the password as it goes back to the bank. This prevents simple password sniffing but doesn't prevent a man in the middle attack from replacing the unsecured login page with one that has disabled encryption. This is especially a problem if you are using an unencrypted wireless connection such as at a coffee shop, because hackers can easily use the airpwn package to intercept the login page and steal your password. An easy remedy for when a secure page isn't available is to enter a bad username and password which usually brings up a secure page telling you to try again. But can you really trust your money to a bank that doesn't even offer the option of a secure login page?"
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Fixed it for ya! (Score:3, Funny)
"But can you really trust your money to a bank that doesn't even offer the option of a secure login page?""
But can you really trust your money to a web browser and operating system that are the most hijacked in the world?"
There, fixed it for you.
Re: (Score:2)
Re:Fixed it for ya! (Score:4, Insightful)
So back to the obvious explanation: the IE team can't code for shit
Parent
Re:Fixed it for ya! (Score:4, Informative)
Apache: http://secunia.com/search/?search=Apache [secunia.com]
IIS 6: http://secunia.com/product/1438/ [secunia.com]
The fact of the matter is that you do not have enough information to conclude that IE is more poorly coded that any other browser out there. You are coming to this conclusion based on assumptions, not based on facts.
Parent
Re:Fixed it for ya! (Score:4, Informative)
Comparing IIS 6.0 to, say, Apache 2.2, we see 3 advisories for each product. Also, the comparison fails for only comparing the number of advisories and not the severity level of each one of them. Granted, Apache 2.2 has one unpatched advisory compared to zero for IIS 6.0, but it is not nearly as clear cut and one sided as your post made it seem.
Parent
Re: (Score:3, Informative)
To compare them somewhat accurately, one should compare IIS 6 with the version of Apache that has been out a similar amount of time, and, ideally, has a similar market share.
I guess this would mean you would compa
Re:Fixed it for ya! (Score:5, Interesting)
IIS security holes [secunia.com]
Apache Security Holes [secunia.com]
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Interesting)
There is a lot of blame to go around for unsecure bank transactions. In the example, we are presented w/ the whole case of user on unsecured wireless. I think the lack of security of the bank in that case is the end users - I never would do bank transactions on an unsecured network except in extreme cases.
Granted, I do believe that banks do share some responsibility. I think they would be best served to do all of their pages as se
Re: (Score:2)
Hooray for https://mail.google.com/ [google.com]
Re:Fixed it for ya! (Score:5, Insightful)
Parent
potmeetkettle (Score:2)
One word answer: mattress (Score:3, Funny)
Security is expensive. (Score:2, Insightful)
Not every IT professional wants to spend lots of his free time researching the latest means of breaking into something, and defending against the break-in. So a lot of people just don't go out of their way to find out if they really know enough to write secure software...it
Isn't this a little old? (Score:5, Informative)
Re:Isn't this a little old? (Score:4, Informative)
Parent
Nevermind Just The Login Page (Score:5, Insightful)
Just because they can't get your password doesn't mean they can't get useful information about you. Sniffing out an online banking session could be a big jackpot for an identity thief.
Re: (Score:2)
Um... (Score:3, Insightful)
Surely anyone who logs onto their bank site from a wireless connection in a coffee shop is just asking to get owned?
Re: (Score:2)
Re:Um... (Score:4, Insightful)
Why? SSL protects you from MITM attacks and provides strong encryption & authentication.
That is exactly what SSL is for, to protect you from sniffers/spoofers between you and the website.
Parent
Re:Um... (Score:5, Insightful)
Not really - this is the whole point of SSL. If you trust both endpoints, you don't much care about what's in the middle.
Now, if you'd said "anyone who logs into their bank site from a random Internet cafe PC is just asking to get owned", I'd agree. It wouldn't require a great deal of sophistication to install keyloggers on every PC. Or if you're rather more sophisticated, you could set up some sort of proxy which sets up a MITM with every HTTPS session, presenting a self-signed certificate for $BANK and configure the client PC's with the appropriate certificate from the proxy's root CA.
Parent
Re: (Score:2)
Sure, but are they aware of this fact? I'd say about 75% of the people (random number) don't know the dangers in logging in on a wireless network.
For anecdotal evidence, yesturday I was sitting in a hotel with two public iMac terminals. A lady sat down and right off the bat asked her husband how to "turn the Apple off", by which I think she meant "how do I switch to windows".
People l
Don't trust any bank that relies on credentials (Score:5, Insightful)
Re: (Score:2, Insightful)
Man ..
It's all software .. It's all software.
Re: (Score:2, Interesting)
Credit Unions (Score:5, Interesting)
I suggest everyone do the same.
Re: (Score:3, Interesting)
Wachovia's site is as the article describes and only gives you https after login. I wondered about it myself and so began going to the site by manually specifying https://www.wachovia.com/ [wachovia.com] -- this works and gives you SSL for the entire browsing session. You may want to type it manually every time, though it would be nice if all banks made their sites HTTPS only.
Re: (Score:2)
Right this second, Washington Mutual's site https://www.wamu.com/ [wamu.com] does the exact opposite, it redirects me back to http:/// [http]
It annoys me, but not enough to withdraw my cash. I just hit log in with the fields blank to get to the SSL page and then actually log in.
Re: (Score:2)
bank web security practices annoy (Score:3, Interesting)
Come on guys... (Score:5, Insightful)
Two thousand and five.
Re: (Score:2)
;-)
What me worry (Score:5, Interesting)
Scott Trade [consumeraffairs.com]
Verizon [consumeraffairs.com]
Bank of America [consumeraffairs.com]
Choicepoint [consumeraffairs.com]
Mastercard [consumeraffairs.com]
AT&T [consumeraffairs.com]
Department of Edumacashun [consumeraffairs.com]
Chase [consumeraffairs.com]
Great article, but (Score:3, Insightful)
I'd love to complain to my bank if it is guilty of these lapses, but how would I know?
Re: (Score:2)
Thanks for your input though.
Re: (Score:2)
Step 2) Look for the pretty little lock picture in your browser that tells you that the website is SSL encrypted.
Without the lock, there is no guarantee you're even on your bank's website when you click the login button that takes you to who knows where. ESPECIALLY when the bank helpfully puts a username/password form on the front page (see http://www.wamu.com/ [wamu.com] ) for you to fill out and hit submit and hope that the page it's submitting to actually IS encrypted.
I work with insurance companies, they suck (Score:2)
Their password policies for acessing extranets, for instance, are in most cases completely insane. They impose so many arbitrary constraints (such as changing the password monthly) in the name of security, no less, that invariably passwords en up being "password1", "password2" and so on. Furthermore most of them block an account after three unsuccesful login a
Jab at firefox (Score:2)
I wonder how a MITM attack could do that..
They're really giving the phishers a hand (Score:2)
While the article may be older than dirt, I'm glad the issue has been brought up, because many financial sites still haven't done anything about the problem. It always pisses me off when I go to my bank's or credit card companies' site and am confronted with a login prompt on an insecure page. To add insult to injury, they generally have put some sort of little lock icon next to the login fields. Oh, well great! That must mean it's secure!. I mean, surely no phishing site will think to put a lock icon
Mother's Maiden Name (Score:4, Insightful)
Pot calling the snowball black? (Score:2)
For almost all successful bank frauds here, the culprit was a trojan in the IE. Banks do hire very good people to secure their online money transfer routines (at least here, cannot vouch for the US). What fails, though, is the security on the user side.
Faciliated by IEs way of treating plugins. To slip a plugin into the IE, all you have to do is set a few registry keys. It does not even need any user inte
Banks have a much bigger problem (Score:3, Interesting)
There are many ways to slip money out of accounts it isn't funny.
Trading accounts:
Create a series of bad trade orders. Offset these with legitimate trade orders in legitimate accounts. There are many thinly traded companies where it is easy to figure out who has the buy order and who has the sell order. All one has to do on a thinly traded company for instance is place a lowball buy order and have the victim's account buy shares at whatever price and then sell them into the lowball. This can be triggered from instance by a stop loss order. Once the shares are owned they can then be sold to another victim.
Chequing accounts: Create fraudulent transactions by paying for goods not ordered. These goods can even be shipped to create a semblance of legitimacy. By the time any of these goods arrive and the transactions are noticed the perpetrators are long gone with their loot.
Its quite easy to create a series of dummy companies to accomplish this. Of course, since this is e-commerce one would obtain valid certificates ahead of time.
This is one reason that secure communications offer limited protection. A felon in Jail can always get his lawyer to register a corporation for him and these are legitimate corporations. Its just they are run by crooks. But then Enron was run by crooks too it would seem. In fact, there are a HUGE number of companies run by crooks. Lots of people invest in them.
I'm in the bank business (Score:3, Interesting)
These really are just a few of the many many things we do to protect your data. In fact, I deleted 2 of the list items that I originally wrote about because I didn't want to give away any information that could be useful to a potential crook.
We take security very seriously for two main reasons. First, we're liable for any losses you have due to a security breach. But more importantly, we can't afford to lose the faith of our customers. If they don't trust us they'll take their money somewhere else. The actual financial loss from an attack on our system would be minor compared to the loss of trust from our customers.
Re: (Score:2)
Re:Cringe (Score:4, Insightful)
They're just file extensions buddy, they can't hurt you.
Parent
Re: (Score:2, Insightful)
Re: (Score:2)
Oh wait, IE is known for having exploits, therefore an IE developer talking about security of any kind, even SSL/TLS which IE supports fully, correctly and handles sensibly, is ironic, right? That's ironic indeed. You and Alanis Morisette should team up and write a song about these things you find ironic. I'd listen, I really would.
Re: (Score:2)
Re: (Score:2)
You should never be sending sensitive information over nonencrypted email in any case. Securing the hotmail login page and then sending your bank details by email would be rather like locking the barn door, then demolishing large parts of the other three walls of the barn, whilst keeping the lock intact. Utterly pointless. And that applies to any webmail system, not just hotmail.