HSBC Online Banking Security Flaw Analyzed 178
greenechidna writes "The BBC is reporting that a vulnerability has been found in the online banking service of HSBC by researchers at Cardiff University. According to the story the attack would allow an attacker to log on to an account within 9 attempts. The attack relies on a keylogger being installed on the victim's machine. The article doesn't have any further technical details."
David Nicholson adds links to coverage at CNN and at the Guardian, writing
"The attack revolves around the order that customers are requested to enter random security numbers on the site. The main news stories fail to detail the vulnerability but I have provided an analysis of it here."
Why pick on HSBC? (Score:4, Insightful)
uhhh... (Score:4, Insightful)
Keylogger required (Score:5, Insightful)
no shit sherlock.
The majority of online systems (Score:4, Insightful)
Keylogger? (Score:2, Insightful)
Isn't this a vulnerability in *any* user/pass interface on any computer in the world?
security through obscurity? (Score:2, Insightful)
"The reality is that it would be more profitable for that fraudster to concentrate his or her efforts elsewhere."
A single compromised user could mean a payoff of tens of thousands of dollars for a determined "fraudster." Particularly if that fraudster resides in a third-world country, that could be enough to live for years. Moreover, having to concentrate efforts on only one attack minimizes a fraudster's exposure to risk--a single instance is much harder to identify than a systematic effort.
No, HSBC, this is a problem. With the prevalence of malicious software on today's internet, keyloggers are a very real threat. Alternative systems can eliminate this vulnerability. Use them.
Re:What, they can't type? (Score:3, Insightful)
Re:security through obscurity? (Score:3, Insightful)
Since when are banks required to protect themselves against people who have keyloggers on their computers? Not really much one can do IMHO if there's a keylogger present...
I guess the only way around it is to have a pin pad and use the mouse to enter in your pin code as well as your pass code.
W00t. Three tiered logins. Fun stuff.
Re:Nine attempts? (Score:3, Insightful)
I'd be interested to hear people's suggestions for a system that will remain secure when there's a keylogger on the client's system. It sounds like at that point they've lost control of their computer and they're pretty much screwed.
I have to admit that when travelling recently, I refused to use internet cafes for anything that involved my passwords. Fortunately I had me work laptop with me (great being able to work two weeks on the road, and have two weeks holiday on top of that too for a whole month overseas!). I took that to internet cafes when I needed to and did anything important over VPN & SSL (and tried not to think about possible man-in-the-middle exploits). This is a real problem.
Re:Nine attempts? (Score:5, Insightful)
Re:Why pick on HSBC? (Score:3, Insightful)
Re:Keylogger required (Score:5, Insightful)
The PIN is 6 digits, they ask for three of these six digits at any one login (e.g. type the 1st, 3rd and 4th digits of your pin). Because they always ask in ascending order (i.e. never 4th, 2nd and 1st) then after 9 login events the keylogger can figure out the number. All they had to do (and all they have to do now) is ask for the digits in any order and this problem goes away. The keylogger would eventually know which numbers are in your 6 digit pin but never what order, and as there is a 3 (or 4 ?) tries lockout then they wont be able to get in unless they are very lucky guessers.
I have HSBC internet banking and it never actually dawned on me how obvious this problem is, I don't think I ever noticed that they only ever ask in ascending order, but thats the beauty of it I guess.
Re:Why pick on HSBC? (Score:3, Insightful)
The moment a keylogger is in your system, you lost (Score:3, Insightful)
Banks here are using one time pads, quite sophisticated ones that are complicated enough to puzzle quite a few of honest users simply wanting to use their online banking service. And that's still no increased security. As long as the midm attack is possible, and that will be the case as long as there are not black box machines that can do NOTHING but actually communicate with the bank, without the possibility to install anything on them, this won't change. No matter what kind of security you implement.
Re:So what's the best real solution to the problem (Score:2, Insightful)
I personally think it's a hassle, but it might work in this case.