Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

HSBC Online Banking Security Flaw Analyzed 178

Posted by timothy from the roight-guv'nor-jes-sign-roight-here dept.
greenechidna writes "The BBC is reporting that a vulnerability has been found in the online banking service of HSBC by researchers at Cardiff University. According to the story the attack would allow an attacker to log on to an account within 9 attempts. The attack relies on a keylogger being installed on the victim's machine. The article doesn't have any further technical details." David Nicholson adds links to coverage at CNN and at the Guardian, writing "The attack revolves around the order that customers are requested to enter random security numbers on the site. The main news stories fail to detail the vulnerability but I have provided an analysis of it here."
This discussion has been archived. No new comments can be posted.

HSBC Online Banking Security Flaw Analyzed More

HSBC Online Banking Security Flaw Analyzed

Comments Filter:

  • Nine attempts? (Score:5, Interesting)

    by Kerr ( 889580 ) * on Thursday August 10, 2006 @11:35AM (#15881343)
    As a HSBC internet banking user, I can safely say you'd be locked out long before your ninth attempt, hell; four locked me out when I last forgot my IB code. Being locked out is something you can only fix by visiting your local branch and using your password to unlock the account again.
    The number of attempts is not given, but the automatic lockout is at least covered at their security page [hsbc.com]
    Sorry Cardiff University, no bank hax for you today.

    • Re:Nine attempts? (Score:4, Informative)

      by BabyDave ( 575083 ) on Thursday August 10, 2006 @11:45AM (#15881466)
      I think it means that after the victim has had 9 successful logins, the h4x0r has enough info to successfully login themselves.
    • Nine attempts is not a minimum; in fact, according to the researchers, it's a maximum. Since keyloggers are involved, I would guess that in most cases the login/password can be determined in well under four attempts.

      A lockout system is good policy, but I don't think it's going to be enough on its own to plug this hole.

      • Re:Nine attempts? (Score:3, Informative)

        by baadger ( 764884 )
        The problem is the way the random digits from your security code are selected. I would guess that the digit indexes are indeed selected randomly and then sorted by their index for convenient input by the user, probably to lower tha number of mis-types (think of the user sliding their finger across some paper to mask digits as they go) and reduce call in's from user's who have been locked out. Whoever designed the system obviously missed the fact that this in sorting causes the user to unwittingly provide mo

    • Re:Nine attempts? (Score:5, Informative)

      by LiquidCoooled ( 634315 ) on Thursday August 10, 2006 @11:48AM (#15881489) Homepage Journal
      This is not a problem of trying 9 times to break in, this is a problem of somebody RECORDING whilst you enter your correct details into the account.

      As you know, with HSBC, you are asked to specify 3 digits from your security key (which is 6-8 characters long)

      This is fine and stops people shoulder surfing to get it once, but if someone keeps recording you they will have all they need.

      I actually had more of a shock in the past when I managed to man in the middle the HSBC login, but after speaking to them (they called me back literally within seconds of me mailing them) it was cleared up and my worries were put to rest (there is a ~2 minute timeout where if you steal the cookies from someones machine who has logged in but not logged out where you can technically get at the information - this might have changed since, but it used to be the case)
    • If it takes up to 9 attempts to crack the system, then on average you're going to get in after 4 or 5. So all the criminals have to do is to attack more than one account: some will get locked out but they will be lucky almost 50% of the time.

    • Re:Nine attempts? (Score:3, Insightful)

      by Malc ( 1751 )
      That IB code's stupid. I have to keep a copy around for copying and pasting. What's the point of making it so awkward? HSBC Canada just uses the last 10 digits of my bank card. Maybe I use it so much more than my HSBC UK IB number that I've managed to memorise it, but really it's no less secure in my case. At least I can call HSBC's telephone banking this side of the Atlantic when the account is locked out for web access.

      I'd be interested to hear people's suggestions for a system that will remain secur

      • Re:Nine attempts? (Score:3, Informative)

        by vhogemann ( 797994 )
        I have an account at this Brazilian bank called Itau, they have a pretty smart way to avoid keyloggers.

        When you login on the website, you're propted with a DHTML panel, with five buttons like this:

        [3 5] [9 6] [0 1] [2 7] [4 8]

        And then you have to type your password using the mouse, so if your password is 12345 you'll have to enter the 3rd, 4th, 1st, 5th and 1st buttons. Each time you enter the site they present the numbers at a different order, so hackers can't use a mouse-logger either.

        Pretty smart, works
      • "suggestions for a system that will remain secure when there's a keylogger on the client's system"

        Two things spring to mind.
        1) involve the mouse.
        2) insert decoy keys, eg, instead of "Enter 2nd, 4th and last digits of your PIN", it could have "Press 1 random number, then the 2nd digit of your PIN, then 3 random numbers, then the 4th" etc. Unless this keylogger has screen capture too, you could even tell them exactly what to type, eg: "37*218*0*644" (substitute * for 3rd, 4th, and 6th digits).

        Yes, I know, thi
        • HSBC already does 2. Maybe that's where the 9 attemts comes from.
        • Well I have an account with all the major banks in the UK (yeah, opening is a bitch so i keep a dummy account with them in case i feel like switching properly at some time).

          LloydsTSB requires you to enter a userID (randomish 8 char string), a password, and 3 random characters from some 'memorable information' (an ASCII word i think); the memorable information characters are entered using HTML form SELECT/OPTION tags, so you're generally encouraged to enter it using the mouse.

          Barclays requires you to enter a
      • INGdirect's banking system sets you up with a 4-digit PIN. However, you don't actually enter that number; they have a numeric keypad image that you click on, and a Javascript applet enters letters which correspond to the number on each key. (If Javascript doesn't work for you, you have the option of just manually typing in the letters that correspond to the digits as shown by the image.) These letters change each time that you log in, so unless the keylogger can intercept that image too, it would be usel

      • funny you should ask that... look what Lloyds bank are trialling [bbc.co.uk]

        Lloyds TSB recently began trialling keyring-sized security devices, or "tokens", which generate a six-digit code to be used alongside usernames and passwords.

        The system uses a code which changes every 30 seconds.

        and Barclays will be going a bit further when their system comes out [early-warning.org]...

        Barclays to increase security with card readers for online customers
        Barclays is to offer its banking customers an interoperable card reader by the end of this

    • Well I'm glad that there is a lock out security measure. When I saw this new system implemented I immediately could see that it was mathematicaly easier to brute force it by about 6 orders of magnitude. This is discounting the personal identification question which I figured could be obtained by some social engineering or dumpster diving.

  • Why pick on HSBC? (Score:4, Insightful)

    by Anonymous Coward on Thursday August 10, 2006 @11:39AM (#15881391)
    So IF my computer has a keylogger and IF my logins are recorded as few as 9 times, THEN the dishonest individual has my security code and can access my account. Whereas, at another bank which asks for a username and passcode, the dishonest individual with the keylogger only needs me to log in ONCE to have the run of my account. So why is this news?

  • uhhh... (Score:4, Insightful)

    by nFriedly ( 628261 ) <nathan@friedly+shashdot.gmail@com> on Thursday August 10, 2006 @11:40AM (#15881402) Homepage Journal
    The attack relies on a keylogger being installed on the victim's machine.
    Uhm.. yea. That attack will get you into about any bank website.. ever.
    • Short of a site that requires you to draw a picture with your mouse, scan your retina, and submit a sample for blood-dna comparison, a keylogger would in fact be capable of getting into 99% of any online password-entered systems, anywhere.
    • I love ING's simply brilliant solution to this: they display a number pad and ask for your PIN, but you can't type it in numbers. You have to type the letters which are mapped onto the number pad, or click the buttons. The mapping of numbers to letters changes with every login, so you can intercept me typing my password 10,000 times and never get anything useful unless you can also screengrab me while I'm typing the password.

  • Keylogger required (Score:5, Insightful)

    by aminal ( 122974 ) on Thursday August 10, 2006 @11:40AM (#15881404)
    So if i have a keylogger on my machine and i log into my online bank, it will log the details i put in and comprimise my online banking?

    no shit sherlock.
    • ..it turns out people who watch you type in your password can then use your password.

      O RLY?

      YA RLY!
    • Actually, just logging one session isn't enough to get into HSBC, they only ask for a part of your special key.

      Please enter the 1st, 4th and last digits of your Slashdot ID to login to the system:

    • Re:Keylogger required (Score:5, Insightful)

      by z0idberg ( 888892 ) on Thursday August 10, 2006 @12:09PM (#15881713)
      The point isn't that a keylogger can capture your password. It's that they have tryed to implement a method of entering your 6 digit pin in a way that would stop a keylogger from revealing it, but the way they have done it actually allows a keylogger to figure it after relatively few times of logging in, hence creating a false sense of security.

      The PIN is 6 digits, they ask for three of these six digits at any one login (e.g. type the 1st, 3rd and 4th digits of your pin). Because they always ask in ascending order (i.e. never 4th, 2nd and 1st) then after 9 login events the keylogger can figure out the number. All they had to do (and all they have to do now) is ask for the digits in any order and this problem goes away. The keylogger would eventually know which numbers are in your 6 digit pin but never what order, and as there is a 3 (or 4 ?) tries lockout then they wont be able to get in unless they are very lucky guessers.

      I have HSBC internet banking and it never actually dawned on me how obvious this problem is, I don't think I ever noticed that they only ever ask in ascending order, but thats the beauty of it I guess.

  • The majority of online systems (Score:4, Insightful)

    by Timesprout ( 579035 ) on Thursday August 10, 2006 @11:41AM (#15881408)
    will be 'flawed' if you get a keylogger on my pc since the majority rely on me supposedly knowing something you dont, until the logger records it for you that is.

  • Keylogger? (Score:2, Insightful)

    by Petskull ( 650178 )
    [quote]The attack relies on a keylogger being installed on the victim's machine.[/quote]

    Isn't this a vulnerability in *any* user/pass interface on any computer in the world?
  • A spokesperson for HSBC is quoted in the article as having said:

    "The reality is that it would be more profitable for that fraudster to concentrate his or her efforts elsewhere."

    A single compromised user could mean a payoff of tens of thousands of dollars for a determined "fraudster." Particularly if that fraudster resides in a third-world country, that could be enough to live for years. Moreover, having to concentrate efforts on only one attack minimizes a fraudster's exposure to risk--a single instance i
    • No, HSBC, this is a problem.

      Since when are banks required to protect themselves against people who have keyloggers on their computers? Not really much one can do IMHO if there's a keylogger present...

      I guess the only way around it is to have a pin pad and use the mouse to enter in your pin code as well as your pass code.

      W00t. Three tiered logins. Fun stuff.
      • Banks would need to protect themselves against this sort of thing,
        because any sudden transfers away for a customer's account would
        lead to them having a stern word with their bank. An investigation could
        also show the huge transfer to have happened while logged in from an
        IP address elsewhere in the world (unless the keylogger also contains
        a proxy, of course).

        Some banks (like mine) might have "stupidity insurance", like Visa,
        where they cover losses up to a certain amount.

        A while ago, I discovered my bank's rid

      • Since when are banks required to protect themselves against people who have keyloggers on their computers?

        Its not a requirement, but it is a competitive advantage. The combination of convenience and security is a key selling feature for banking services. And as other people have pointed out, its actually quite possible to frustrate a keylogger by a method similar to what HSBC uses, only adding in permutations. Of course, if they had a way of reading your screen and associating the results with a keylog

      • Since when are banks required to protect themselves against people who have keyloggers on their computers? Not really much one can do IMHO if there's a keylogger present...

        On Oct. 12, 2005 the FFIEC issued regulations that must be met by end of year 2006 that banks must use a 2 level authentication that includes a method that cannot be logged by a keylogger (ie, entering the numbers on virtual scramble pad).
  • I am not surprised they are this clueless - they also bounce spams to the nominal "From" address after accepting the message - so if a spammer forges a "From: joe@example.com", guess where they send the spam bounce message to?

    I've repeatedly tried to contact them to tell them to stop that, but they continue. If they cannot clear up a simple problem like this when they are told about it, do you really expect them to correct a DESIGN FLAW like TFA quickly?
    • What are you whittering on about? I can also forge the from field in the message envelope. Perhaps they shouldn't bounce any messages. Most popular MUA's have been setting both the envelope and header from fields to the same value for years... I remember people complaining about Netscape doing that last decade. If you want to bounce messages, you have to assume one of them is correct. So pick one - makes sense to me to pick the one that people generally see in the UI (header from field).
  • Ok, so we have a keylogger on the victim's machine, ostensibly to lift the login name and password. Then, we have an "attacker" who tries 9 times to type it in?

    Is it just me, or are we dealing with a fundamentally stupid attacker?

    If I use a keylogger to lift a login/pw, it shouldn't take more than 3 or 4 attempts to get it right.... perhaps I'm just a smarter attacker than most?
    • True, and it probably doesn't take more than 3 or 4 most times. Then again, we might be talking about an automated attacker (TFA wasn't clear on this point), in which case, yeah, a stupid one.
    • the password is a supposed to be a completion of 'random' number which is not all that random and can be guessed withing 9 attempts.
    • This isn't a security flaw. If you have a key logger, you have everything for any bank site, or any other site for that matter. I wonder who disclosed this? Perhaps a competitor? Cause it's the stupidest thing I've ever heard.
      • HSBC had a virtual keyboard feature. A keylogger would not work with that. You use the mouse to enter letters on it. Maybe the virtual keyboard only has 9 positions, and maybe they are recording mouse movements?
        • HSBC had a virtual keyboard feature. A keylogger would not work with that. You use the mouse to enter letters on it. Maybe the virtual keyboard only has 9 positions, and maybe they are recording mouse movements?

          Gotcha. Well that makes it a heck of a lot more interesting. Does it say that in the article? Huh. Is it an optional feature, or are you required to use it?

          • HSBC has two points of authentication. The first is a normal username/password which allows you to view your accounts. The second requires typing a password on a virtual keyboard before you can do anything with your money. Online bill-pay, bank transfers, etc. are all behind this second password.

            When I saw it, I immediately started thinking about how you could narrow the possibilities if you could record mouse movements. However, that still requires that you can get past the first login as well as reco

    • HSBC uses a double-password system, but only prompts for random characters from the second password. This makes it "impossible" for a keylogger to grab your complete password. I assume that the security flaw is that your complete password can be inferred after 9 logins.

  • So what's the best real solution to the problem? (Score:4, Interesting)

    by mcrbids ( 148650 ) on Thursday August 10, 2006 @11:51AM (#15881511) Journal
    Ok, so I replied with a joke a few minutes ago... but I think this warrants more intelligent discussion.

    As a vendor of a web-based, access-restricted product, keyloggers are a real issue. I've been considering setting up client-side SSL certificates in order to restrict access to only machines that have been "set up" in order to deal with the problem of keyloggers. Are there better solutions?

    Does this bank have something that's: A) Easy to use, B) doesn't require painful machine-by-machine setup, and C) significantly improves security?

    If so, I just might be interested!
    • My ingdirect.com.au savings account has a login method that would stop any keyloggers.

      You type in your account id (keylogger can pick this up obviously), then you are presented with an on screen keypad where you enter your pin number with the mouse. 4 digit pin number ( easy to remember), the numbers are in a different location on the on screen keypad every time. The only way any spyware can capture this would be with screen captures on every mouse click. I am not sure there are many spywares that go to the
    • The only good way to beat keyloggers is some sort of per-machine file. One of the best things I've seen is where you have to pick a certain file off your computer and upload it every time you log in (e.g. a picture of your kids) in addition to a password. So even having the PW is useless without this extra file. This does require some setup - during account establishment the user has to go and select this file (and make sure its on read-only so no one can edit it and destroy account access).

      Thats the best m
      • The "extra file" could also be an external device where you type in a PIN
        or insert your card to get a number required to enter (I have both, and
        the old PIN 'calculator' is still valid). This number is generated from a
        seed only your device and your bank has, and is valid for about a minute.
        A crook would have to be real fast to use a logged passnumber.

    • As a vendor of a web-based, access-restricted product, keyloggers are a real issue. I've been considering setting up client-side SSL certificates in order to restrict access to only machines that have been "set up" in order to deal with the problem of keyloggers. Are there better solutions?

      I don't know if there are better solutions, but please don't rely on two-factor ID. There are at least two downsides there:

      1. If you have multiple accounts at various institutions, you wind up having a half-dozen or more
    • Here in Indonesia, the largest bank (BCA) gives you a small gadget that generates a different password (8 digit IIRC) everytime which you then enter into your web browser. The gadget is tied to your account only.

      I personally think it's a hassle, but it might work in this case.

  • How to trick key loggers (Score:4, Funny)

    by Rik Sweeney ( 471717 ) on Thursday August 10, 2006 @11:52AM (#15881519) Homepage
    I'm quite worried about key loggers so I always enter my password incorrectly the first two times and then input it successfully the final time. This ensures that my password is as secure as possible.

    More so if I screw up the last attempt and have to request a new password.

    Another simple solution is to keep your password in a text file and copy / paste it in.

    Or your password could just be ******* that would work a treat...
    • <Cthon98> hey, if you type in your pw, it will show as stars
      <Cthon98> ********* see!
      <AzureDiamond> hunter2
      <AzureDiamond> doesnt look like stars to me
      <Cthon98> <AzureDiamond> *******
      <Cthon98> thats what I see
      <AzureDiamond> oh, really?
      <Cthon98> Absolutely
      <AzureDiamond> you can go hunter2 my hunter2-ing hunter2
      <AzureDiamond> haha, does that look funny to you?
      <Cthon98> lol, yes. See, when YOU type hunter2, it shows to us as *******
      <Azure

  • Comment removed (Score:4, Informative)

    by account_deleted ( 4530225 ) on Thursday August 10, 2006 @12:03PM (#15881649)
    Comment removed based on user account deletion

  • A similar problem exists in meatspace (Score:4, Interesting)

    by Bigboote66 ( 166717 ) on Thursday August 10, 2006 @12:16PM (#15881766)
    In the U.S., most places have taken to just displaying the last 4 digits of your credit card number on the receipts they give back to you. However, on a recent trip to Europe (Finland & Russia, actually), I noticed that the receipts there seem to favor a scheme where a random set of digits appear each time (e.g. XXXX-XXX1-234X-XXXX). If you're like me, you often accumulate a bunch of these receipts in your pockets as you travel; some people may just dump the days wad of receipts in a trash can. A fortunate dumpster diver may stumble onto a wad of receipts that allow him to reconstruct the credit card number. I'm not sure why the people that implemented that latter scheme thought it was preferable.

    -BbT
  • As a US HSBC customer, the security that I see is different than the article describes.

    The login process is fairly typical (username, password only), but in mid-July 2006, they changed the process so that they are entered on separate pages. I do not understand how this improves security, because the username is echoed back on the password-entry page. There are no additional interactive anti-replay attack features--the username/password form seems to have been simply split to two pages.

    The biggest security f

  • HSBC Security Flaw, 1 login attempt (Score:3, Funny)

    by neonprimetime ( 528653 ) on Thursday August 10, 2006 @12:28PM (#15881883)
    This just in...
    Another HSBC Security Flaw has been found. If you are logging into your account, and somebody is looking over your shoulder while you're doing it, odds are they can determine your username & password after only 1 successful login attempt.

  • How to fix this (Score:3, Interesting)

    by Bryansix ( 761547 ) on Thursday August 10, 2006 @12:33PM (#15881940) Homepage
    Keyloggers would defeat the security at most online banking websites. I know it would defeat www.wamu.com which uses only a username and password. And yes, HSBC has taken better measures on some of their websites but this still does not protect against keyloggers.

    So who should we look to for an answer? ING Direct [ingdirect.com]! They use a two step process to log in. The first is a non-descript customer number. This step would be defeated by a keylogger or if someone had some mail stolen. Step two is to ask you to answer a pair of personal questions only you know the answer to. Still this could be defeated by a keylogger. The third step is pure genius though. First of all the page displays an image and phrase that you pre-selected. While a keylogger might pick up this phrease during account setup it would not pick up the image. If the image is not present, you are instructed not to enter your PIN number. Then the entering of the PIN number is via a keypad that you click with your mouse. Each number corresponds to a random letter that changes everytime you log in. If you choose you can type in the letter that corresponds to each number for that log in. In this case the data a keylogger might capture would be useless. This is the best security feature on the website and ensures almost nobody except the account owner can ever log in. Of course if the PIN is compromised then the whole system breaks down but a smart user will never have a compromised PIN.

    • Re:How to fix this (Score:3, Interesting)

      by LordKronos ( 470910 )
      The third step is pure genius though. First of all the page displays an image and phrase that you pre-selected.

      For my account, I set my secret phrase to be "false sense of security". However, I was disappointed that for the image they didn't seem to have any pictures that looked like a man in the middle of anything.

      What are the image and phrase really supposed to do for you? They are supposed to let you know "hey, this really is the ING site, so it's safe now to login". If you go to a fake ING site (either
      • You are correct that a man in the middle attack would still work. There are ways to protect against that but there is not much a banking website can do for you on that front.

  • Wierd... (Score:3, Funny)

    by Random Utinni ( 208410 ) on Thursday August 10, 2006 @12:48PM (#15882097)
    Anyone else see the irony in the following ads Google inserted following this story?

    HSBCDirect Online Savings
    Earn 5.05% APY* at HSBC! You Don't Need to Switch Banks
    HSBCdirect.com

    HSBC Safe Online Banking
    Free Digital Security Code Device with all HSBC Account. Get it Now!
    www.hsbc.co.in


    Google's out to hijack my machine! ; )
  • Emigrant Direct recently implemented a two-step logon process, where you first supply your username, followed by your password and answeres to two random security questions. Unfortunately, you're supposed to type the two answers into regular textboxes instead of masked password boxes, exposing your information to any shoulder surfers.

  • The moment a keylogger is in your system, you lost (Score:3, Insightful)

    by Opportunist ( 166417 ) on Thursday August 10, 2006 @01:06PM (#15882258)
    No matter what kind of security mechanism you have, the moment a keylogger is acting as a man in the middle, the security is flushed down the tubes (I bet someone will find a witty joke... I'm waiting).

    Banks here are using one time pads, quite sophisticated ones that are complicated enough to puzzle quite a few of honest users simply wanting to use their online banking service. And that's still no increased security. As long as the midm attack is possible, and that will be the case as long as there are not black box machines that can do NOTHING but actually communicate with the bank, without the possibility to install anything on them, this won't change. No matter what kind of security you implement.
    • if you have a side-channel to the bank, such as SMS to your mobile, there is a tool you can use to defeat MITM authentication attacks.

      Of course, if you can't trust the PC you're using at the moment, you have no idea what it might be doing to your bank account for the duration of your authenticated session.

      And that's the long-and-short of it. Have you ever seen a shady character loitering around in front of the post office offering to go stand in line for you and deposit your paycheck, for just a few coins?
      • The side channel can work, but not in the current implementations. Currently, you just send a text message and you get back a code that's valid for a few minutes. Piece a' cake to create a trojan that manipulates the target address and amount. So yes, you sign and it's transfered when you want, but the trojan calls the shots when it comes to amount and direction.

        What WOULD work is a hash that's calc'ed out of target address, amount and timestamp. Which would result either in a ridiculously long key to punch

  • Security checks, and requirements (Score:3, Interesting)

    by TheRealBurKaZoiD ( 920500 ) on Thursday August 10, 2006 @02:05PM (#15882896)
    I find this all pretty funny, especially the requirement of the keylogger, because it hits home pretty close. A web application I wrote and deployed to production about a year ago and now support was finally put through a third-party security check a few weeks ago. The results were fine for the most part. The application is more or less rock-solid since it is secured through Kerberos, hardened against sql injection, and invulnerable to cross-site scripting attacks.

    What the company did list as issues (and severe issues mind you) was the fact the application displayed signs of being vulnerable to cookie stealing, and session hijacking through man-in-the-middle attacks, that the server type was sent in the http headers, and that ports 110 and 25 were open on the web server. Well, my complaint is that the security report listed the application problems first, and give them a higher score of criticality, which made everything else, including the open ports 1) seem less sever, and 2) seem as though they were application problems and not network problems, which is what they really are. The business people flipped out and thought the sky was going to fall, since there is some sensitive information stored in this system. Rather than breaking out champagne and celebrating the fact the system was secure against 99.9% of the attacks that would possibly be thrown at it, they lamented issues that weren't application issues. Now understand, I don't manage the servers this application runs on. I merely wrote the application. I don't know what all kind of shit the people who do manage it might have changed.

    The funniest thing is, in order to successfully run any cookie stealing, or session hijacking, you (the hacker) had to already have access to not one, but two windows accounts on the domain! The only way to get those was to either work there and have an account, brute-force the username/password, or social-engineer someone out of theirs. And, in order to successfully run the man-in-the-middle attack, you would have to have penetrated the LAN, or hacked someone's computer at their home.

    I began to run damage control, explaining how these exploits were possible, why they weren't application issues but network issues, and explaining lots of terms like ARP spoofing, cache poisoning, and how to avoid those things. I remarked that the open ports issue should be rated more highly than the MITM issues, and I also detailed how virtually every web application ever written was similarly vulnerable to these attacks in one way or the other, only to wind up being told that can't possible be true, how I'm extremely arrogant, and how I think I know everything! One person even threatened to have me removed from the project, the cocksucker.

    At any rate, the requirement of the keylogger reminded me of the extenuating circumstances needed to exploit this application here: network penetration, not one but two valid accounts, and specialized knowledge of the application.

    It's weird. You try to help people and do your job, and they hate you for it. I think I've been doing this for just too damn long.
    • It's weird. You try to help people and do your job, and they hate you for it. I think I've been doing this for just too damn long.
      Ha! It's time for you to become a consultant. You still do your job, people still hate you for it, but you get to switch to a new group of people now and then.
  • It's possible to get EVERYONE'S login details! All you have to do is crack into their database and reverse any hashes! OH SH!! STOP THE PRESSES!
  • Since I'm using HSBC online banking, I froze when I saw the headline.

    Now I am laughing.

    Will we also see headline saying "All online banking system have flaws" (without adding '...assuming you have keylogger on your machine')?
  • i am an hsbc customer and have access to internet banking. though i am not uk based, aside from the regular username and password, you will have to enter a six digit number generated by a token given.

    this is a different method from the one mentioned and will probably have no effect against key loggers. although i read somewhere that phishing sites are now able to mimick a bank website and instantly login to the account as it is phished. however, the main feature that the bad guys forget is that account t

Slashdot Top Deals

Two can Live as Cheaply as One for Half as Long. -- Howard Kandel

Close