Boarding Pass Hacker Targets Bank of America

Concerned Customer writes "The fake boarding pass guy is at it again. His blog shows a demonstration phishing website that is able to bypass the SiteKey authentication system used by Bank of America, Fidelity, and Yahoo. Users will be shown their security image, even though they're not visiting the authentic websites." This hack compounds the study showing that users don't pay attention to the SiteKey pictures anyway.

Crux

[Billosaur]

Why does BoA allow users to get access to their SiteKey image after answering her security questions? The reason is simple. Normally, BoA knows to present the right SiteKey image to a user because it recognizes the computer that user logs in from as belonging to the user in question. This is done using secure cookies. But what happens if there are no cookies? Say that the user wants to log in to her BoA account from a computer that she has not successfully used to connect to BoA's website with before. Before sending the SiteKey image to the user, BoA will require the user to provide some evidence of her identity - the answers to the security questions. Once BoA receives these, and has verified that they are correct, then it will send the user's SiteKey image to the user. That allows the user to verify that it is really communicating with BoA, and not an impostor, which in turn, provides the user with the security to enter her password.

This is the loophole that we use in our demonstration. Through deceit, we convince the user to enter her security question, and thus get the SiteKey image.

No matter what kind of security system you devise, you cannot take out the human element. The Internet seems like magic to people - it knows them, it knows things about them, people can find them from all over the planet. The average user is not curious enough to learn how this is accomplished, paranoid enough to distrust anything at first glance, or savvy enough to protect themselves. Bank of America is kidding itself if it thinks the SiteKey is any kind of deterrent to a hacker.

"Two-factor" authentication lame implementations

[mutterc]

All of my financial websites (bank, credit cards, etc.) have all gone to "two-factor" authentication.

Most often, the second factor is "security questions", like "what city were you born in?" and "what's your favorite restaurant?" I always answer these with random passwords, which I put in my password safe along with the real password. Unless you do that, these are actually less secure than just having a secondary password, because others can find out that stuff.

I know every business wants to do this cheaply and half-assed; it's the American Business Way. To do it "right" would probably take SecurID's or somesuch other token, which would get ugly for the customer after accumulating a couple of dozen different ones.

I've heard in comments here about banks that send you a list of code numbers, one-time-use, in the postal mail, and you use them up as you log in. That would be a good, cheap way to do two-factor that actually increases security.

The real problem of online banking

[Opportunist]

The core problem of online banking is that the bank has to implicitly trust an untrustworthy system, using insecure protocols. The bank has no way to verify that the system used at the other end has not been tampered with and they cannot verify that the data sent to them is identical with the data entered by the user.

You can implement a billion "security features", it won't mean jack as long as the only channel between bank and user is the computer. If that channel has been corrupted, the corrupter will be able to alter, delete or forge any kind of information either side should (in his opinion) get about the other end. There is no way to remove this problem unless you open a second, secure channel which is independent of the machine used for bank transfers.

Better, but still false security

[aicrules]

I think the BoA sitekey is definitely one step above username/password on the front page. However, I agree that while it provides an added SENSE of security, it can make people trust something more that they really can't trust any more. When it was released, I did almost exactly what this guy did just to see if it would work. I was not terribly surprised that I could create a wrapper to retrieve the sitekey picture and words while still intercepting the passcode. It was actually pretty easy. Unlike the study about the people who ignored their sitekey, I do pay attention to it. However, I also pay attention to whether I'm really on BoA. I never go there from a link in an email. While someone could still redirect my request for BoA to somewhere else, I also practice safe browsing practices that at least limit that potential issue on MY computer. The convenience of online banking is just too high for me to NOT use it.

Re:Crux

[Anonymous Coward]

Rather, I think the insightful thing to say here is that you don't gain security by adding arbitrary hoops for your consumers to jump through, but by implementing a real authentication protocol.

Dear me!

[Etherwalk]

He's pointing out that most of the psychological reassurances (the security blankets, we might ball them) that are presented to customers/consumers/flyers/etc... are just that--psychological reassurances.

We'd better be careful. This kid is dangerous. He could dismantle our entire society! Wait to see what happens when he points out that money is fictitious.

A bit less than it appears

[jfengel]

The summary is not quite correct. It's not so much that the SiteKey is being bypassed, as that the attacker is able to get their hands on the user's SiteKey. They can only do this by getting the user's password and security code, which they do with a conventional man-in-the-middle attack. Once they've got that, getting the SiteKey seems the least of their worries.

The obvious problem with SiteKey is the chicken-and-egg problem of getting the image to the server in the first place. There's some step where you're communicating in a fashion where you trust the server enough to give them your SiteKey, which they later show back to you. It's tied to a single computer, via a cookie, so if you log in from a different computer you need to send a new SiteKey or get them to send yours back to you, on the new computer.

So this attack only works if you can get the user to give up not only the password but also the "security question" (one of the dumbest bits of security I've ever seen; it's like a password only you can look it up.) Easy enough, if the user isn't alert (and they usually aren't.)

SiteKey depends on users to expect the key image, but the absence of the image doesn't usually trigger warning bells because they're not very common. You need some sort of phishing detector which says, "Hey, this site is known to require a SiteKey and isn't sending it to you."

Re:"Two-factor" authentication lame implementation

[CastrTroy]

I wish banks would offer something like SecurID for authenticating with their site. They seem to be in the process of adding on layers and layers of crap, without adding any actual security. I'd rather have a couple dozen secure IDs over having to carry around half a dozen one-time-pads around. Ideally, you'd only need one securID for each account. Which for most people is probably 3. Chequing, Savings, Credit Card. If you have more accounts than that, you're probably in the minority. I guess i'm not of the crowd that has 7 credit cards though. I have 1, and It's accepted just about everywhere. So I don't have a need for more than 1. I'd rather have a couple extra dongles hanging from my keychain than having to worry about someone hacking my account. I'd happily pay for the SecurID if only the option were available.

Re:Crux

[mypalmike]

Rather, I think the insightful thing to say here is that you don't gain security by adding arbitrary hoops for your consumers to jump through, but by implementing a real authentication protocol.

Exactly. The deceit here is the same as before, there are just more hoops (for the customer, not the phisher). The problem with authentication here is that the banks want their customers to be able to log in from anywhere in the world. You simply can't properly authenticate a computer out in the wild without some additional device, like secureid.

Why not use referrer?

[nospmiS remoH]

Why don't the banks just require that the referrer to a login page be blank. Yes, this would mean that the login page would have to be either on the main page or very simple to type since the only way a (normal) user will have a blank referrer will be to type the url in.

Essentially this means that banks would be requiring everyone to physically type (or bookmark) their banks login page and that would be the ONLY way to get there. I suppose it could be modified to accept a referrer of the banks own domain so you could click a "Login Here" button.

I know power users can spoof their referrer using a browser setting and malware could do the same, but at least that would be another layer. What am I missing here?

Re:Crux

[hackstraw]

The deceit here is the same as before, there are just more hoops (for the customer, not the phisher). The problem with authentication here is that the banks want their customers to be able to log in from anywhere in the world. You simply can't properly authenticate a computer out in the wild without some additional device, like secureid.

The deceit is simply a man in the middle attack, and we all know this is not a new thing.

I'm a BOA customer, and I've been upset with their security for years, but it keeps getting better, which is kindof a problem in itself.

Some history here. BOA's main website: http://www.bankofamerica.com/ [bankofamerica.com] was only recently redirected to a https server. In fact, until recently if you even typed https://www.bankofamerica.com/ [bankofamerica.com] you got an error message. Before doing the basic thing like moving the http server to a https server, they introduced this site key junk.

OK, here are the problems. How am I supposed to trust a website to be the site I am intending to go to when a) its not on a https site, and its asking for my username/password, and I cannot verify via the certificate or anything that I did not type http://bankfoamerica.com/ [bankfoamerica.com] by accident? b) how am I supposed to trust a website that is different almost every time I interface with it.

When I go to a supposedly real BOA branch on say Main Street in YourTown, USA, there are a number of things that makes me believe its real. There are other people in there, many of which are wearing BOA nametags, and the BOA logos and stuff are all over the outside and inside of the place. Also, its expensive and difficult to put up a fake BOA storefront, and the liklihood that a fake one will generate any profit w/o getting caught is about zero (otherwise they would exist!)

Now, how much would it cost me to put up a bankfoamerica.com site? How about 15-20 of them with different typos? How much easier is it being that they can exist anywhere in the world or even outside of the world on a sattelite in space even? How hard is it to generate all of these things that look exactly like the real site w/o a secure certificate behind them to boot? Now, being that BOA changes the website all the time, AND its not on a secure server, how am I supposed to know that I'm even dealing with the same people each time?

My problem is not with BOA identifying me, its with me identifying them. So, they add site-key and all of this crap, which puts the burdon of identifying them on me, which is backwards, especially when they keep changing the rules.

When I worked in a hospital, they talked repeatedly about "universal precautions" with respect to things like AIDS and whatnot. There needs to be a set of universal precautions for doing secure transactions on the internet, and there are none.

Re:Crux

[fishbowl]

>OK, here are the problems. How am I supposed to trust a website to be the site I am intending to go to when a) its not on a https site, and its
>asking for my username/password, and I cannot verify via the certificate or anything that I did not type http://bankfoamerica.com/ [bankfoamerica.com]
>[bankfoamerica.com] by accident? b) how am I supposed to trust a website that is different almost every time I interface with it.

You are not supposed to! You should change banks. I would, (and have). Now I use a credit union whose IT is managed by a Math/CS professor who is well known in cryptography circles. I also use USAA, which I highly recommend to people who are eligible. (It bothers me that people leave the military and don't bother to get grandfathered into USAA; it's one of the best perks they offer.)

Stupid online banking security problems

[slashkitty]

The banks are really just bringing this on themselves. They have marketed the idea of security as being more important than actual security. Making me answer more questions about myself may make it harder to break in, but it leaves me even more vulnerable to identity theft if my answers are compromised.

Looking at what banks can do to improve security:

- Stop putting the "lock" icon on your login form. Users should look for the lock on the toolbar or part of browser frame. (chase.com, others)
- Stop using non secure login pages (not where the login form is being submitted to) (chase.com, usbank.com, wachovia.com)
- Stop using marketing emails from strange marketing addresses. This just gets people used to bank emails from weird places.
- Make a secure bookmarkable banking page. (my bank does not do this, I get an error screen if going to bookmark)
- Simplify navigation and operation and unify systems. (my bank does not do this, if I log out on one part of the site, I'm not logged out from the "very secure" part)

Bank sites driven by marketers [washingtonpost.com]

BoA = smarter than this blogger

[oni]

it is very arrogant for somebody to think that BoA's security team did not think of this problem themselves.

I agree. In fact, I would go further and say that the author of this blog should actually be quite embarassed and ashamed of this post. His "amazing discovery" is actually the whole point of sitekey. Yes, you can be a man in the middle and get the sitekey images yourself. Congratulations. You and everyone else already thought of that.

And guess what, your man-in-the-middle now has to make a sitekey request to bank of american for *every potential victim* and as a result, BoA will easily identify your IP block as running a MITM scheme.

So in other words, this blogger is an idiot. He hasn't defeated sitekey at all. Set up a MITM site, make ten requests, and now you're out of business and the ten accounts that you phished are locked.