Memory Gaffe Leaves Aussie Bank Accounts Open To Theft

mask.of.sanity writes "A researcher has found flaws in the way major Australian banks handle customer login credentials which could allow the details to be siphoned off by malware. He built proof of concept malware to pull unencrypted passwords, account numbers and access credentials from volatile memory of popular web browsers every two hours."

Already running?

[Anonymous Coward]

You have to be infected first for your credentials to be stolen? Couldn't the hacker just have installed a key logger?

If you can't trust the machine, don't put your sensitive data on the thing.

Wait, so your machine is already compromised?

[complete loony]

So he's running malware that's sniffing your browsers memory? If your machine is already compromised, there are easier ways to get access to login credentials.

Re:and now he be researching the side of jail down

[Frobnicator]

Sadly, he probably will.

Financial institutions want to keep their vulnerabilities quiet. People who shout them to the world face lawsuits

If you are smart enough to discover a major exploit, also be smart in how you notify them. There are many great security companies who work as middle-men to help submit the bugs to the corporations and at an appropriate time make the information public so it gets fixed.

Going through a security company is free, and means you won't get the big splash on news sites or all the public attention, but it also means you can generally avoid hiring a lawyer, or worse, having he cops knock at your door with warrants.

Re:Already running?

[You're All Wrong]

So you're saying that if you log in from a new infected machine, your bank obliges you to leak sensitive security information to the keylogger that's been installed there?

Congratulations for feeling all warm and fuzzy from your bank's security measures whilst gaining very little actual security against real threats - that's what they were hoping you'd feel, you're a good customer.

*One time* passwords are the *only* thing that *can't* be re-used. By definition. If your bank does not use them, get a new bank.

Re:Careful Reporting These

[Anonymous Coward]

This is why whenever I expose security flaws I do so anonymously. If it isn't fixed within the first couple days I just make it public knowledge and instigate the first attack myself. They had their fair warning, and now they get the shit storm they deserve.

I'm starting to be sick

[trifish]

I am really starting to be sick of these "security researchers" who don't know that the 1st law of the computer security is:

If malware is running on your computer, it is not your computer anymore.

It follows that no matter what you do, malware will win. Discovering that malware can "siphon" memory is really... uh, groundbreaking.

What makes me even more sick is the incredibly amount of various BlackHat "security conferences" and supposedly geek-oriented media like Slashdot that let those people present this kind of "discoveries" as legitimate, notable, noteworthy, important and new.

I am really, really, sick of you.

Re:and now he be researching the side of jail down

[FireFury03]

Not really a banks fault though - why is the browser hanging on to post'd data after it's been post'd??

So that when you hit refresh on the page, the browser can pop up its usual "you'll need to repost to refresh this page, are you sure?" and do the repost if you tell it to.

Re:How bloody embarrassing!

[bloodhawk]

While this isn't exactly shining a pleasant light on the quality of the banks code. It is still very much a storm in a teacup, if you have access to scrape the memory of the computer then you could have gotten access to credentials in a far simpler means such as keylogging. The simple fact is if you can't trust the machine you are using you're already boned and no amount of secure coding from the bank is going to save you. Besides which I believe most of those banks (if not all) do 2 factor auth to transfer funds to accounts you haven't previously transferred too. (at least the 2 of them I use do).

Re:Careful Reporting These

[darkfeline]

I hear about these kinds of things all the time. It's utter bullshit; they're literally making it more appealing for people to anonymously sell these exploits on the black market. "No, we don't want to know if our software has an exploit. If you've found one, go ahead and sell it to whoever you want, as long as we don't know, it's cool, we can keep deluding ourselves, thanks."

It reminds me of, among other counterproductive measures, media conglomerates pushing oppressive DRM on consumers as if to drive them toward piracy or forcing drug addicts to carry their criminal status with them as if to force them back toward poverty and drug abuse. If an alien race were to monitor us, they'd probably assume we're running some sort of elaborate self-extermination campaign.