Slashdot Log In
Boarding Pass Hacker Targets Bank of America
Posted by
kdawson
on Thu Apr 12, 2007 10:51 AM
from the augmented-man-in-the-middle dept.
from the augmented-man-in-the-middle dept.
Concerned Customer writes "The fake boarding pass guy is at it again. His blog shows a demonstration phishing website that is able to bypass the SiteKey authentication system used by Bank of America, Fidelity, and Yahoo. Users will be shown their security image, even though they're not visiting the authentic websites." This hack compounds the study showing that users don't pay attention to the SiteKey pictures anyway.
Related Stories
[+]
News: FBI Raids Security Researcher's Home 516 comments
Sparr0 writes, "The FBI has raided the home of Christopher Soghoian, the grad student who created the NWA boarding pass site. Details can be found on his blog including a scanned copy of the warrant. The bad news is that he really did break the law. The good news is that Senator Charles Schumer did it first, 19 months ago, on an official government website no less. The outcome of this trial should be at least academically interesting. At best, it could result in nullifying some portion of the law(s) that the TSA operates under." Read on for Sparr0's take on what laws may apply in this case.
[+]
Study Finds Bank of America SiteKey is Flawed 335 comments
An anonymous reader writes "The NYT reports on a Harvard and MIT study, which finds that the SiteKey authentication system employed by Bank of America is ineffective at prevent phishing attacks. SiteKey requires users to preselect an image and to recognize this image before they login, but users don't comply. 'The idea is that if customers do not see their image, they could be at a fraudulent Web site, dummied up to look like their bank's, and should not enter their passwords.
The Harvard and M.I.T. researchers tested that hypothesis. In October, they brought 67 Bank of America customers in the Boston area into a controlled environment and asked them to conduct routine online banking activities, like looking up account balances. But the researchers had secretly withdrawn the images.
Of 60 participants who got that far into the study and whose results could be verified, 58 entered passwords anyway. Only two chose not to log on, citing security concerns.' The study, aptly entitled "The Emperor's New Security Indicators", is available online."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Crux (Score:5, Insightful)
This is the loophole that we use in our demonstration. Through deceit, we convince the user to enter her security question, and thus get the SiteKey image.
No matter what kind of security system you devise, you cannot take out the human element. The Internet seems like magic to people - it knows them, it knows things about them, people can find them from all over the planet. The average user is not curious enough to learn how this is accomplished, paranoid enough to distrust anything at first glance, or savvy enough to protect themselves. Bank of America is kidding itself if it thinks the SiteKey is any kind of deterrent to a hacker.
Re:Crux (Score:4, Insightful)
Parent
Re:Crux (Score:5, Insightful)
Exactly. The deceit here is the same as before, there are just more hoops (for the customer, not the phisher). The problem with authentication here is that the banks want their customers to be able to log in from anywhere in the world. You simply can't properly authenticate a computer out in the wild without some additional device, like secureid.
Parent
Re:Crux (Score:5, Insightful)
The deceit is simply a man in the middle attack, and we all know this is not a new thing.
I'm a BOA customer, and I've been upset with their security for years, but it keeps getting better, which is kindof a problem in itself.
Some history here. BOA's main website: http://www.bankofamerica.com/ [bankofamerica.com] was only recently redirected to a https server. In fact, until recently if you even typed https://www.bankofamerica.com/ [bankofamerica.com] you got an error message. Before doing the basic thing like moving the http server to a https server, they introduced this site key junk.
OK, here are the problems. How am I supposed to trust a website to be the site I am intending to go to when a) its not on a https site, and its asking for my username/password, and I cannot verify via the certificate or anything that I did not type http://bankfoamerica.com/ [bankfoamerica.com] by accident? b) how am I supposed to trust a website that is different almost every time I interface with it.
When I go to a supposedly real BOA branch on say Main Street in YourTown, USA, there are a number of things that makes me believe its real. There are other people in there, many of which are wearing BOA nametags, and the BOA logos and stuff are all over the outside and inside of the place. Also, its expensive and difficult to put up a fake BOA storefront, and the liklihood that a fake one will generate any profit w/o getting caught is about zero (otherwise they would exist!)
Now, how much would it cost me to put up a bankfoamerica.com site? How about 15-20 of them with different typos? How much easier is it being that they can exist anywhere in the world or even outside of the world on a sattelite in space even? How hard is it to generate all of these things that look exactly like the real site w/o a secure certificate behind them to boot? Now, being that BOA changes the website all the time, AND its not on a secure server, how am I supposed to know that I'm even dealing with the same people each time?
My problem is not with BOA identifying me, its with me identifying them. So, they add site-key and all of this crap, which puts the burdon of identifying them on me, which is backwards, especially when they keep changing the rules.
When I worked in a hospital, they talked repeatedly about "universal precautions" with respect to things like AIDS and whatnot. There needs to be a set of universal precautions for doing secure transactions on the internet, and there are none.
Parent
Re:Crux (Score:4, Informative)
vi C:\windows\system32\drivers\etc\hosts
i 192.168.1.100 www.mybank.com
Parent
Re: (Score:3, Funny)
vi: command not found.
I Can't .. stop .. myself (Score:4, Funny)
Parent
Re:Crux (Score:5, Interesting)
methods should be able to figure out almost immediately how to defeat this system.
At first, I myself was also very critical of BoA's new anti-phishing technique. However, after some more careful consideration, I realized it is very arrogant for somebody to think that BoA's security team did not think of this problem themselves. Unlike security researchers (including moi), which usually try to create bulletproof security systems so they can right interesting papers with indisputable arguments, financial organizations are constrained by the very real issue of cost-efficiency.
Their current two-step authentication does not address the obvious MITM attack discussed here, but it does address the previously seen phishing attacks. BoA's security team must have figured out that it would cost them X amounts of money to defend against classic phishing attacks and by preventing those they would save Y money. They must have also considered solutions like the ones presented in http://people.deas.harvard.edu/~rachna/papers/sec
By using such a solution they could perhaps save Z > Y amounts of money because much less users would fall victims to phishing attacks. It is very likely that they did the math. Because they chose to go with the current solution, it is very likely that Y-X > Z-W
The only thing that BoA should perhaps correct is the statement:
"If you recognize your SiteKey, you'll know for sure that you
are at the valid Bank of America site. Confirming your SiteKey is
also how you'll know that it's safe to enter your Passcode and click the Sign In button."
This is over-claiming and could have a harmful impact by making its web users dropping their defenses against phishing. I am sure however that their marketing dpt told them that they need to advertise this security feature as completely robust, otherwise users would feel that they are going through unnecessary trouble: "if BoA's system is still insecure, why did BoA bother changing it and why do I need to incur the delay to learn it and enter login information twice?"
Disclaimer: I do not work for BoA and I have no vested interest in supporting them. In fact, I hate their guts for their penalty fees policies
Parent
BoA = smarter than this blogger (Score:4, Insightful)
I agree. In fact, I would go further and say that the author of this blog should actually be quite embarassed and ashamed of this post. His "amazing discovery" is actually the whole point of sitekey. Yes, you can be a man in the middle and get the sitekey images yourself. Congratulations. You and everyone else already thought of that.
And guess what, your man-in-the-middle now has to make a sitekey request to bank of american for *every potential victim* and as a result, BoA will easily identify your IP block as running a MITM scheme.
So in other words, this blogger is an idiot. He hasn't defeated sitekey at all. Set up a MITM site, make ten requests, and now you're out of business and the ten accounts that you phished are locked.
Parent
Picture? (Score:2, Funny)
Picture? what picture?
Yawn (Score:2)
How about trojans that change your order, send the bogus order to the bank while displaying the one you entered instead? Or... wait, that's been around for about 6 months now, too.
Re: (Score:2)
As long as the only channel between bank and user is the computer, there is no security.
Good for him! (Score:5, Interesting)
Re: (Score:3, Interesting)
This is one of those occasions where you have to admire someone's pluck... I guess he has an overwhelming desire to be hassled by the US Government. This is important work, but it's definitely going to get the black suit, dark sunglasses crowd in a tizzy.
Re:Good for him! (Score:5, Funny)
*hears a knock on the door, and answers*
Him: "Ahh, Agent Doe! Nice to see you! They sent you out for this one huh? Your standard crew."
AS: "Yep."
Him: "Can I interest you in some coffee, tea or a soda-pop while they are working?"
AS: "Sure, I'll have some coffee"
*He gets the coffee ready as the other agents go to his computer*
Him: "Sit down, sit down! Here's your coffee"
AS: "Thanks. So, everything's going well I take it?"
Him: "Yeah, I'd ask if you heard about my latest trick, but that's probably why you are here."
AS: "Yes, it is."
Him: "So, how's the wife and kids?"
AS: "Not bad. Jane is in basketball now."
Him: "Middle school"
AS: "College"
Him: "Really? I can't believe it's been that long. It seems like just yesterday you were telling me about her being born!"
*more idle chatter, eventually several black suits come down carrying computer equipment.*
AS: "Well, it was nice chatting with you again."
Him: "Likewise. See you next week, same time?"
AS: "Sure, what do you have planned now?"
Him: "C'mon, and spoil the surprise?"
AS: "Alright, see you next week."
Parent
Re: (Score:2)
There was always a little harassment. They always wanted to talk to Henry about this or that. They'd come in with their subpoenas and warrants and make me sign. But mostly they were just looking for a handout, a few bucks to keep things quiet, no matter what they found.
I am thrilled with this guy as I was when he did this with the NWA boarding pass security risk [slashdot.org] before. Again, it's great to have someone out there like this pointing out the insecure methods
Bank of America?!? (Score:5, Informative)
Here's an example on how B of A does business:
This guy just wanted to check to see if a check was good! [sfgate.com]
You can bet B of A will go after this hacker guy.
Re: (Score:3, Funny)
"Two-factor" authentication lame implementations (Score:3, Insightful)
All of my financial websites (bank, credit cards, etc.) have all gone to "two-factor" authentication.
Most often, the second factor is "security questions", like "what city were you born in?" and "what's your favorite restaurant?" I always answer these with random passwords, which I put in my password safe along with the real password. Unless you do that, these are actually less secure than just having a secondary password, because others can find out that stuff.
I know every business wants to do this cheaply and half-assed; it's the American Business Way. To do it "right" would probably take SecurID's or somesuch other token, which would get ugly for the customer after accumulating a couple of dozen different ones.
I've heard in comments here about banks that send you a list of code numbers, one-time-use, in the postal mail, and you use them up as you log in. That would be a good, cheap way to do two-factor that actually increases security.
Re:"Two-factor" authentication lame implementation (Score:3, Insightful)
Re:"Two-factor" authentication lame implementation (Score:2)
That isn't two-factor authentication. That is something you know and something else you know. Two-factor requires something you now, and something you have (a smart card, onetime password, RSA SecurID fob, etc.). (Not blaming you, simply pointing out how lame most businesses are).
The real problem of online banking (Score:4, Insightful)
You can implement a billion "security features", it won't mean jack as long as the only channel between bank and user is the computer. If that channel has been corrupted, the corrupter will be able to alter, delete or forge any kind of information either side should (in his opinion) get about the other end. There is no way to remove this problem unless you open a second, secure channel which is independent of the machine used for bank transfers.
Re: (Score:2)
You can implement a billion "security features", it won't mean jack as long as the only channel between bank and user is the computer. If that channel has been corrupted, the corrupter will be able to alter, delete or forge any kind of information either side should (in his opinion) get about the other end. There is no way to remove this problem unless you open a second, secure channel which is independent of the machine used for bank transfers.
Exactly. I have a phone, can't we use that as the second channel?
Re: (Score:2)
And what about those customers that don't have a cell?
Re: (Score:2)
Re: (Score:2)
Like I said, it's generally a very good idea. The problem is, appearantly the damage done by those attackers isn't high enough to warrant the additional expense to develop something like that.
Re: (Score:2)
We can, and some banks in Germany offer this already. The scheme is called mTAN (mobile transaction number). Postbank [postbank.com], one of the prime target of phishing attacks, was the first to offer it. First, the customer has to register a mobile phone to be associated with the bank account. The registration process is somewhat long-winded but needs to be passed only once; obviously it needs to be secure against manipulation and abuse.
Once a phone has bee
Re: (Score:2)
That move on their side was a good one. A very good one. It's not easy to defeat this security scheme. Without thinking it over, the only security hole I see is the user, who doesn't read the whole text message but only uses the key to sign.
But when you sign something you don't read, you deserve what you get...
Still, pretty much every security feature has been broken so far. I somehow don't fear to
Re: (Score:2)
But generally you're right. Our banks are already switching to "shorter" and abbreviated domain names simply because it's asking for trouble when you force your customer to type in the whole friggin' bank name.
It would already help a lot if you'd get a crash course on basic security when you request your online banking data. At least it would put the "here's your bank, please send us all your info" spamphishers out of biz.
Better, but still false security (Score:3, Insightful)
Re: (Score:2)
There's a very simple way to do online banking that avoids all phishing scams
1)Only log in from 1 computer
2)Use go
Re: (Score:2)
::sigh:: (Score:2)
Someone is bound to do it eventually...I can assure you all if a company does not buy him up soon, the government will.
Re: (Score:2)
I think the days of the mad hacker becoming a security consultant are long passed. Nowadays, they seem to go the criminal prosecution route, and then no cookie for you.
Cheers
A bit less than it appears (Score:5, Insightful)
The obvious problem with SiteKey is the chicken-and-egg problem of getting the image to the server in the first place. There's some step where you're communicating in a fashion where you trust the server enough to give them your SiteKey, which they later show back to you. It's tied to a single computer, via a cookie, so if you log in from a different computer you need to send a new SiteKey or get them to send yours back to you, on the new computer.
So this attack only works if you can get the user to give up not only the password but also the "security question" (one of the dumbest bits of security I've ever seen; it's like a password only you can look it up.) Easy enough, if the user isn't alert (and they usually aren't.)
SiteKey depends on users to expect the key image, but the absence of the image doesn't usually trigger warning bells because they're not very common. You need some sort of phishing detector which says, "Hey, this site is known to require a SiteKey and isn't sending it to you."
Re: (Score:2)
In fact, everyone I've talked to who needs one of these "guess the picture" schemes to login to their bank wishes they would go away. If, one day, they stopped seeing the sitekey thing, most folks would be relieved, not suspicious.
Re: (Score:2)
Re: (Score:2)
This brings up a rather interesting question: Suppose Bank Of America decided to come up with a better way of securing their web transactions than the SiteKey system. When this new thing popped up on my screen instead of t
Who can remember their authentication images? (Score:5, Interesting)
Within the last six months, three banks and two brokerage houses I use have all gone to the use of these authentication images. In each case, the only way to select the image is to go through slow-loading screen after slow-loading screen of apparently random images.
I can choose my own password, but it is virtually impossible to "choose" my image, so they're not very memorable to me. I certainly can't choose the same image at all five sites, which is what I'd like to do. (That's insecure for a password, but I don't think it's insecure for an authentication image; it's not as if one bank were going to try to pretend to be a different bank).
One of them also wants you to give them a little phrase that goes below the picture. Ah, I thought, I'll use my phrase to describe the picture, that way I'll know if the picture is incorrect. Wrong, I couldn't do it. I had to enter the phrase before I got to choose the picture. Well, I thought, OK, I'll just change it. The picture was of (let's say) soccer ball. So I went to the screen that lets you change your passwords and personal information, entered "soccer ball" as my phrase... and was then taken to a screen where I was required to select a picture, again. And the soccer ball wasn't one of the choices. I clicked through about ten screens of five-by-five pictures trying to find the soccer ball and couldn't find it. Was it just because they were randomly selecting from a huge collection of images? Or do they actually enforce changing the image? I don't know. All I know is that I now am supposed to remember my password AND the phrase "soccer ball" AND a picture of a kangaroo.
If the picture were wrong, would I notice? I might have a vague sense of unease, but I wouldn't be sure. Not unless I wrote them all down.
just picture a kangaroo playing soccer .. (Score:2)
original, though? (Score:2, Informative)
I like (Score:2)
That doesn't seem all that secure to me...
Bank of America's security needs improvement (Score:2, Informative)
Why not use referrer? (Score:5, Insightful)
Essentially this means that banks would be requiring everyone to physically type (or bookmark) their banks login page and that would be the ONLY way to get there. I suppose it could be modified to accept a referrer of the banks own domain so you could click a "Login Here" button.
I know power users can spoof their referrer using a browser setting and malware could do the same, but at least that would be another layer. What am I missing here?
MOD parent ill informed! (Score:3, Interesting)
If I were bofa, I would be looking at browser quirks, and using those to authenticate the HTTP_USER_AGENT environment variable. Browser says that they're IE? include a little activeX that only works in IE and examine output, or send some javascript. For each browser, set up a suite of these hacks and serve a few with each page. If the browser doesn't respond with the correct output of the quirk (pipeped
The Weakest Link (Score:5, Interesting)
Wouldn't it be nice if you could give someone (e.g. PayPal, known by some for removing money back out as fast as they put it in) Deposit-Only account numbers. Like the Roach Motel, the money checks in, and it don't check out.
Or Limited Transfer Out numbers. (Allow AOL, and AOL only, to automatically debit monthly payments for amounts not exceeding your monthly bill, and only valid for 6 transactions before you give them a new number.)
Personal Checks, each one of which has a One Time Only account number on it that is worth nothing to a thief who tries to forge a hundred duplicates of the check you just gave him.
The archaic current system could, I believe, be made much more secure by this simple change alone.
Note to IP thieves: This constitutes Prior Art, and you're not allowed to patent it now.
Man in the middle and SecureID (Score:3, Informative)
We realized that SecureID is also vulnerable to a man-in-the-middle attack. Since most people ignore invalid SSL certificates, anyone could put up a fake webpage and intercept the entire SecureID transaction. Once a successful login is permitted, the attacker can process bank transactions as the legitimate user.
SecureID is a nice way to augment passwords with a one-time password, and it does reduce the "attack window" due to the fact that the bad guy can not reuse your login credentials at a later time. SecureID does not eliminate the attack window...the attacker needs to process the fraudulent transactions during the legitimate user's session.
-ted
Stupid online banking security problems (Score:5, Insightful)
Looking at what banks can do to improve security:
- Stop putting the "lock" icon on your login form. Users should look for the lock on the toolbar or part of browser frame. (chase.com, others)
- Stop using non secure login pages (not where the login form is being submitted to) (chase.com, usbank.com, wachovia.com)
- Stop using marketing emails from strange marketing addresses. This just gets people used to bank emails from weird places.
- Make a secure bookmarkable banking page. (my bank does not do this, I get an error screen if going to bookmark)
- Simplify navigation and operation and unify systems. (my bank does not do this, if I log out on one part of the site, I'm not logged out from the "very secure" part)
Bank sites driven by marketers [washingtonpost.com]
Passmark is also mind-bogglingly stupid... (Score:3, Interesting)
All three ask me to pick a common object and give it a name.
Of course I'm going to call it what it is.
Calling it something obtuse makes the whole thing harder to keep track of.
Each one asks me up to 6 security questions.
These are in case my computer gets "unregistered" or if I try to get to an account from not-my-computer.
They're not all the same. The answers are not one-word slam dunks. If they were, they would be no good.
Because they're not easy and obvious, I have to remember up to 18 obtuse answers.
If I get one wrong, even by one character, I'm kicked off until I call someone.
The banks claim this is a government law that makes them do this.
Please don't say "get one bank".
Re: (Score:2)
You might guess that I'm not a gold bug, and that I'm in favor of free banking. Good guess!