Consider this my opinion on the latest vulnerability discovered in ICICI's Internet Banking portal that allows anybody to read your bank statement without logging in to your account. Yeah, you read that right, "without" logging in...
OK, A friend of mine pointed out this vulnerability to me... Initially my impression was well it must be another SQL injection as I have always been skeptical about the level of security on the Internet provided by private & public banks.
Discovered by: Ayush Ghosh, BookMyShow
Disclosed by NDTV to ICICI Bank because the bank didn't bother checking that researcher's email as usual. So much for having those abuse / info e-mail addresses on their website. The banks must start to consider working on a middle-ground with security researchers.
Initially the vulnerability seems innocuous but, when you factor in that a vulnerability like this could lead to money being stolen or could lead to internet fraud. Imagine 20 lakhs get stolen from your bank account straight up by a guy who cons you with an internet scam. Then try to look at this vulnerability in this new light with your money on the table... Scary? Yeah I thought so! ;)
New Delhi-based cyber-security consultant Dominic K. spoke to NDTV Gadgets and discussed the multiple layers of security that banks have in place, which include multi-factor authentication, encryption, secure connectivity - SSL and HTTPS and identity management systems. He added, "We have not heard of any serious attacks that were successful. These are industry practices that meet global standards."SSL - Broken many times
HTTPS - Broken - Can be stripped and/or hijacked
Certificates can be spoofed and/or stolen
How multi-factor authentication or secure connectivity will help when there's no user logged in? Authentication is the mechanism where a user logs-in to confirm the his / her identity on the bank's website. This is usually achieved with parameters such as Debit card no, Account no, Debit card PIN or Username / Password issued for Internet banking. The authentication mechanism is NOT part of this vulnerability so, all those global standards don't matter in this case.
Example: A Grifter with very little computer knowledge can write an e-mail with your name (first name, last name), bank account information, your bank balance and a 'mistake' he noticed (a reason to click). Since the dawn of graphical user computing we have always been clicking, you can't get anything done without clicking. You click more than you type and that is a fact, you clicked on this damn page... fact... :D
Mr.Grifter can then systematically make you execute javascript and steal your cookies, pun intended! Cookies here equate to money, but that's just for people who care. If that grifter is savvy and smart, he just might hack your browser and make your life hell. The people who want to sit at home feeling safe, well... good luck, security has always been an illusion.
The original article can be found here
Cheers!
