Risk
7/23/2008
03:30 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Most Bank Sites Are Insecure

Security risks caused by basic flaws in Web site design are widespread, according to computer scientists.

More than three-quarters of bank Web sites have design flaws that could expose bank customers to financial loss or identity theft, according to a University of Michigan study that will be presented this week at the Symposium on Usable Security and Privacy.

The study, "Analyzing Web Sites For User-Visible Security Design Flaws," examined 214 bank Web sites in 2006. It was conducted by University of Michigan computer science professor Atul Prakash and doctoral students Laura Falk and Kevin Borders.

The vulnerabilities identified by the authors aren't fixable with a simple patch. Rather, they are issues like login boxes, information submission forms, security information, and contact information placed on insecure pages; redirections outside the bank's domain without warning; allowing insecure user IDs and passwords; and e-mailing sensitive information insecurely.

"To our surprise, design flaws that could compromise security were widespread and included some of the largest banks in the country," Prakash said in a statement. "Our focus was on users who try to be careful, but unfortunately some bank sites make it hard for customers to make the right security decisions when doing online banking."

Prakash said that some of the issues have been addressed since they were discovered, but that more work needs to be done. At the same time, he advises not panicking because exploiting the vulnerabilities that he and his students found is not easy. In general, he said these flaws become an issue on potentially insecure networks, such as a wireless network not under your control or on a hotel's network.

Prakash and his colleagues point to a recent quarterly FDIC Technology Incident Report, which tracks suspicious activity at banks, to show the extent of the bank security shortcomings. The report identifies 536 computer intrusion incidents with an average loss of $30,000, a total loss of $16 million in the second quarter of 2007.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.