Memory Gaffe Leaves Aussie Bank Accounts Open To Theft 69
mask.of.sanity writes "A researcher has found flaws in the way major Australian banks handle customer login credentials which could allow the details to be siphoned off by malware. He built proof of concept malware to pull unencrypted passwords, account numbers and access credentials from volatile memory of popular web browsers every two hours."
Careful Reporting These (Score:5, Informative)
In the 80s, my comp sci partner and I discovered a similar case at Acadia University. We reported it to the head of the computer center. He told us it wouldn't work, it couldn't be done. I left that meeting feeling betrayed. My partner decided to write a proof of concept. He was successful and to prove it logged in as the main admin account. Days later he decided to try it again to see if they still hadn't fixed it or changed the password. They were waiting. He was expelled from Acadia. He was a brilliant honors student.
It's worse these days. They will charge you for cybercrimes, or treason, and sentence you to decades in prison. Or hold you without trial. Be careful when you do the right thing and report these. Just report them, don't "proof of concept" or you could be charged. It's unfair and immoral but it's what they'll do to you, mostly out of their own shame and embarrassment.
Re: (Score:1, Insightful)
This is why whenever I expose security flaws I do so anonymously. If it isn't fixed within the first couple days I just make it public knowledge and instigate the first attack myself. They had their fair warning, and now they get the shit storm they deserve.
Re:Careful Reporting These (Score:5, Insightful)
I hear about these kinds of things all the time. It's utter bullshit; they're literally making it more appealing for people to anonymously sell these exploits on the black market. "No, we don't want to know if our software has an exploit. If you've found one, go ahead and sell it to whoever you want, as long as we don't know, it's cool, we can keep deluding ourselves, thanks."
It reminds me of, among other counterproductive measures, media conglomerates pushing oppressive DRM on consumers as if to drive them toward piracy or forcing drug addicts to carry their criminal status with them as if to force them back toward poverty and drug abuse. If an alien race were to monitor us, they'd probably assume we're running some sort of elaborate self-extermination campaign.
Re: (Score:2)
Re: (Score:2)
The fact that he did it for a noble cause is irrelevant. What matters is "criminal intent" - whether he intentionally broke the law.
The expelled student intended to gain unauthorized access to the computer system. He knew that the malware he wrote would harvest credentials of other users, and he knew that he wasn't allowed to log in as someone else. Yet he did so anyway. That certainly seems intentional to me, and that's what matters to prosecutors (and college judiciaries).
Re: (Score:2)
Yes, but that's not even good enough. You and I both know how these arrogant pinheads work. They have a social status and nothing more. If some damned kid can just show them up, what would that mean about them? Sure we can call the kid a "genius" or a "wiz" and dress him up in other terms to attempt to shield the pinhead's social status, but at the end of the day the fact remains that the pinhead got shown up by a damned kid barely out of diapers.
It seems the only correct answer is to either do nothing
Re: (Score:2)
and now he be researching the side of jail down un (Score:3)
and now he can be researching the in side of jail down under hands on.
Re:and now he be researching the side of jail down (Score:5, Insightful)
Sadly, he probably will.
Financial institutions want to keep their vulnerabilities quiet. People who shout them to the world face lawsuits
If you are smart enough to discover a major exploit, also be smart in how you notify them. There are many great security companies who work as middle-men to help submit the bugs to the corporations and at an appropriate time make the information public so it gets fixed.
Going through a security company is free, and means you won't get the big splash on news sites or all the public attention, but it also means you can generally avoid hiring a lawyer, or worse, having he cops knock at your door with warrants.
Re: (Score:2)
Re:and now he be researching the side of jail down (Score:5, Insightful)
Not really a banks fault though - why is the browser hanging on to post'd data after it's been post'd??
So that when you hit refresh on the page, the browser can pop up its usual "you'll need to repost to refresh this page, are you sure?" and do the repost if you tell it to.
Re: (Score:2)
Already running? (Score:5, Insightful)
You have to be infected first for your credentials to be stolen? Couldn't the hacker just have installed a key logger?
If you can't trust the machine, don't put your sensitive data on the thing.
Re: (Score:3)
Re:Already running? (Score:5, Insightful)
Congratulations for feeling all warm and fuzzy from your bank's security measures whilst gaining very little actual security against real threats - that's what they were hoping you'd feel, you're a good customer.
*One time* passwords are the *only* thing that *can't* be re-used. By definition. If your bank does not use them, get a new bank.
Re: (Score:1)
However, it's one that has been mostly solved. Never bank with a bank that logs you in over anything but HTTPS POSTs. Do not accept certificates by default. Do not accept CA certificates by default (apart from Honest Achmed - I bought a scooter from him, he's trustworthy). Verify new certificates - check the identities of both parties (site + CA). Do not run javascript or other scripts from arbitrary sites. For paranoia, use NoScript's additional protections for XSRF, etc.
You
Re: (Score:1)
Based on how this works, I've hashed out a method to spy on the president:
1. Sneak into the White House
2. Hide under the oval office desk.
3. Now the tricky part -- listen to conversations.
Re: (Score:2)
You have to be infected first for your credentials to be stolen? Couldn't the hacker just have installed a key logger?
If you can't trust the machine, don't put your sensitive data on the thing.
well, it sort of matters if you can log back into the bank again with those credentials after you've signed out. that means you're note really signed out.
that is a big deal, actually.
How bloody embarrassing! (Score:5, Informative)
Aussie IT is a bit Mickey Mouse all around, sadly -- especially in the banks, oddly (you'd expect a higher standard where billions of dollars are concerned, but no...)
As for the researcher, they didn't actually 'hack' into anything, merely scraped their own computer for data, so I wouldn't expect them to face any problems over revealing the exploit. Probably hasn't won them any friends in the banking sector though...
Re:How bloody embarrassing! (Score:5, Insightful)
Re: (Score:1)
Re: (Score:2)
But I presume you only get 3 attempts before the account is locked-out. Even 10 attempts would be safe.
Wait, so your machine is already compromised? (Score:4, Insightful)
Re: (Score:1)
so keyboard logging AND screenscraping? Now enough info for the bad guy to get money?
Re: (Score:1)
It's so fucking simple even a US senator could understand it. If someone has control of your machine then of course they can scrape it's memory, but a run of the mill keylogger woul
My bank doesn't seem vulnerable (Score:5, Interesting)
My bank uses POST in the login form which means that sniffing memory for URLs (which is what this malware seems to do) wont get you a login.
Plus, in order to actually transfer money to someone you haven't transferred money to before you have to input a second password.
The biggest failing of the bank in question is that it has a 10 char maximum on passwords for some stupid reason.
Re: (Score:3)
The biggest failing of the bank in question is that it has a 10 char maximum on passwords for some stupid reason.
I've always assumed that anyone that limits the password to an arbitrarily small number, or limits what characters you can use, does so because of incompetence. And so it makes me wonder what other security vulnerabilities there are.
Re: (Score:3)
I agree its major red flag. Yes there needs to some limit; you don't ever want to take user input of undefined maximum length, but in the case of passwords a sane max is like 255 bytes, which might be a bit shorter than 255 chars if you are running utf8, and is probably still enough if you need to use a two byte character encoding.
When you lengths like 8 or 10 it leads one to assume passwords probably are being stored insecurely; after all if they were hashing passwords like they should be the final storag
Limited password length (Score:2)
But one of the common vulnerabilities is buffer overrun. So they want to limit the read to some fixed number instead of looking for the trailing null, in an unlimited loop. So the right thing to do is set the limit to some moderately large number, like 128, allocate space, write nulls into it and then read the data into that buffer. Why it can't be really big like 1K or 2K? We
Re: (Score:3)
You're joking, right? Please tell me that you don't think you're protected from banking malware because your bank uses POST instead of GET.
horses and barns (Score:4, Informative)
If malware has access to the RAM of another process, the horse has left the barn.
Re: horses and barns (Score:2)
Umm - all banks worldwide? (Score:1)
This would probably affect every single Internet site in existence. And there is no solution, nor can there be
There is a company in Australia selling JavaScript that encrypts form field - I assume this guy is associated to that company & trying to drum up a sale, while hiding the fact they are selling snake oil.
Re: (Score:1)
Re: (Score:1)
I actually do this as well on a site I'm about to release. I use Javascript RSA library from some students at standford (http://www-cs-students.stanford.edu/~tjw/jsbn/). What I do is, hide the signup & login forms if the user has javascript disabled. I create an SSH Private/Public key pair for the user server side and pass the rsa_e & rsa_n modulus (public key) to the Javascript library. When the user exits a particular field such as a password field or more importantly an credit card related field,
I'm starting to be sick (Score:5, Insightful)
I am really starting to be sick of these "security researchers" who don't know that the 1st law of the computer security is:
If malware is running on your computer, it is not your computer anymore.
It follows that no matter what you do, malware will win. Discovering that malware can "siphon" memory is really... uh, groundbreaking.
What makes me even more sick is the incredibly amount of various BlackHat "security conferences" and supposedly geek-oriented media like Slashdot that let those people present this kind of "discoveries" as legitimate, notable, noteworthy, important and new.
I am really, really, sick of you.
This article lacks key information (Score:2)
Re: (Score:2)
Government will steal it anyway (Score:2)
Re: (Score:2)
Three years? I wonder how long one must be missing to be declared dead. Seems to me the bank account should wait for probate or the equivalent.
Could I get a copy. (Score:1)
Focus on the Solution, not the Problem. (Score:2)
It would be great if financial companies were required to make a publicly accessible testing site, in order to qualify for benefits from government, like insurance. The testing site would be a mock-up of the current system. Just copy the code over keep a separate database, it wouldn't have to be large because it won't do the same volume and we don't all need unique accounts. I mean, there is testing and production systems already, right? So, after pushing to production you also push to public testing.
Put your claws back in, Fix the problem, Move on (Score:1)
What about me... (Score:2)