4 ms·

As usual with these things: What about app/server security. Simple token verification is prone to abuse (malware) and spoofing is becoming a bigger issue on mob

by consp 11y ago

As usual with these things: What about app/server security. Simple token verification is prone to abuse (malware) and spoofing is becoming a bigger issue on mobile only platforms than ever before. Server abuse is difficult, but not impossible and since getting a banking licence usually does not verify any security measures, I'm wondering what they already did (or didn't) do. (I'm well aware of the state-of-the-art, and the usual less than so, security of banking apps).

raesene4 11y ago
I wonder why you got downvoted for this, for me security is a key concern for the challenger banks. What Mondo is (from my reading) trying to do is very cool but quite ambitious. A new bank in 2016 will be a serious target for quite sophisticated attackers so they're going to have to do app/inf/ops security very well do avoid damage. On the flip-side they have the once in a lifetime golden opportunity of a green-field deployment to actually get security baked into their systems before they're live without a load of legacy cruft holding them back.
- consp 11y ago
  I would really like to get an account but don't live in the UK unfortunately. They talk about the card revocation/freeze in the app in the talk posted earlier, which is a really nice idea (next to the metadata collection). The reason most 'normal' banks have limitations on their apps is that either they will not (or can not) guarantee the safety of their apps or want to place the responsibility at the users end. This means the limits in place (usually ~750/1000 euros max per day/week on mobile platforms) are there to make sure they won't loose too much money if people start saying "I didn't make that transfer". Banks pay out anyway (at least here in the Netherlands) because the customer dissatisfaction is of greater importance than actual tracing the problem of either a hack, an abusive spouse or simply mistyping the IBAN number. Since they collect a huge amount of metadata, this problem gets easier but won't be eliminated and can be managed by good app security and user informing the user. This limitation is the same for card revocation (not freezing, that has other issues; namely concurrency). I do hope they get a group of 'non HN people' to test it out, as they are more likely to get into the 'I didn't make that transfer' problem. The problem with freezing cards is that transfers are not direct: freezing the card on the banks end might work, but some ATMs or other systems might have a sufficient delay to allow (some) abuse while the card was 'frozen' by the user. The question will be who will pay for the delay. I definitely will support these ideas as they stir up a broken market, but please make sure you have you proof-of-possession and concurrency issues well sorted out.
  - raesene4 11y ago
    Yep the customer fraud guarantee is a thing in the UK as well (at the moment), and to an extent that minimizes the loss where it's one customer's app. that gets compromised. Where I was thinking that a lot of their security challenges will lie is things like internal money processing systems. An attacker with access to a bank's internal systems could make a right mess of things...
  - asherkin 11y ago
    > The problem with freezing cards is that transfers are not direct: freezing the card on the banks end might work, but some ATMs or other systems might have a sufficient delay to allow (some) abuse while the card was 'frozen' by the user. The question will be who will pay for the delay. This is part of why their cards are online-only, every* transaction has to be verified with them before it can complete at the reader - so transactions are slower, but there is no grace period after the freeze. * as I understand it, certain merchants are white-listed on-card for offline transactions - namely TfL.
jhuckestein 11y ago
[I work at Mondo] You raise a good point, indeed. Security is something we take very seriously. As others have stated already on this thread, groups that target banks are incredibly sophisticated and well capitalised. All other banks face the same issues, of course, but unlike them we can't afford to simply write off losses to cybercrime. We see Mondo as an opportunity to build a great security culture from the ground up. We're currently hiring a Head of Security role in London: https://getmondo.co.uk/careers https://getmondo.co.uk/careers If you know anyone that - is an excellent communicator - likes to code and does so regularly - can think like a black hat (CVEs and PoCs please!) - doesn't mind writing the occasional policy document please send them my way: jonas@getmondo.co.uk BTW, at the moment we are not holding customer balances or approving transactions so we're not a particularly juicy target, yet. That said, we've already conducted pen tests and invited a number of security firms to come and break our software :)
- raesene4 11y ago
  FWIW, I saw that ad. Looks very interesting, but I think you may have a challenge getting someone who is a Vuln researcher/pen tester type (who most commonly have CVEs, PoCs to their name) who also has a decent knowledge of banking security, policies etc and also is looking to graduate out of technical work into team management... Most of the pentesters/vuln researchers I know aren't huge fans of writing ISO2700x style policies documents (actually thinking about it there aren't many people who are fans of that kind of thing!) if you're looking for non-traditional advertising routes for this you might want to post on /r/netsec's hiring thread https://www.reddit.com/r/netsec/comments/3zfj6v/rnetsecs_q1_2016_information_security_hiring/ https://www.reddit.com/r/netsec/comments/3zfj6v/rnetsecs_q1_...
  - jhuckestein 11y ago
    Thanks a lot for the link :) I'd rather hire a CISO that understands security and teach them how to think like a regulator than vice versa! Heck, I have long hair myself and didn't have any contact with policy documents until just over a year ago. And both our CTO and CEO like to write code. Basically, we're looking for our Alex Stamos. Any more ideas you have how we might find somebody like that and avoid the stigma of the "Bank CISO" job would be much appreciated.

by consp 11y ago

raesene4 11y ago

I wonder why you got downvoted for this, for me security is a key concern for the challenger banks. What Mondo is (from my reading) trying to do is very cool but quite ambitious. A new bank in 2016 will be a serious target for quite sophisticated attackers so they're going to have to do app/inf/ops security very well do avoid damage. On the flip-side they have the once in a lifetime golden opportunity of a green-field deployment to actually get security baked into their systems before they're live without a load of legacy cruft holding them back.

consp 11y ago
I would really like to get an account but don't live in the UK unfortunately. They talk about the card revocation/freeze in the app in the talk posted earlier, which is a really nice idea (next to the metadata collection). The reason most 'normal' banks have limitations on their apps is that either they will not (or can not) guarantee the safety of their apps or want to place the responsibility at the users end. This means the limits in place (usually ~750/1000 euros max per day/week on mobile platforms) are there to make sure they won't loose too much money if people start saying "I didn't make that transfer". Banks pay out anyway (at least here in the Netherlands) because the customer dissatisfaction is of greater importance than actual tracing the problem of either a hack, an abusive spouse or simply mistyping the IBAN number. Since they collect a huge amount of metadata, this problem gets easier but won't be eliminated and can be managed by good app security and user informing the user. This limitation is the same for card revocation (not freezing, that has other issues; namely concurrency). I do hope they get a group of 'non HN people' to test it out, as they are more likely to get into the 'I didn't make that transfer' problem. The problem with freezing cards is that transfers are not direct: freezing the card on the banks end might work, but some ATMs or other systems might have a sufficient delay to allow (some) abuse while the card was 'frozen' by the user. The question will be who will pay for the delay. I definitely will support these ideas as they stir up a broken market, but please make sure you have you proof-of-possession and concurrency issues well sorted out.
- raesene4 11y ago
  Yep the customer fraud guarantee is a thing in the UK as well (at the moment), and to an extent that minimizes the loss where it's one customer's app. that gets compromised. Where I was thinking that a lot of their security challenges will lie is things like internal money processing systems. An attacker with access to a bank's internal systems could make a right mess of things...
- asherkin 11y ago
  > The problem with freezing cards is that transfers are not direct: freezing the card on the banks end might work, but some ATMs or other systems might have a sufficient delay to allow (some) abuse while the card was 'frozen' by the user. The question will be who will pay for the delay. This is part of why their cards are online-only, every* transaction has to be verified with them before it can complete at the reader - so transactions are slower, but there is no grace period after the freeze. * as I understand it, certain merchants are white-listed on-card for offline transactions - namely TfL.

jhuckestein 11y ago

[I work at Mondo] You raise a good point, indeed. Security is something we take very seriously. As others have stated already on this thread, groups that target banks are incredibly sophisticated and well capitalised. All other banks face the same issues, of course, but unlike them we can't afford to simply write off losses to cybercrime. We see Mondo as an opportunity to build a great security culture from the ground up. We're currently hiring a Head of Security role in London: https://getmondo.co.uk/careers https://getmondo.co.uk/careers If you know anyone that - is an excellent communicator - likes to code and does so regularly - can think like a black hat (CVEs and PoCs please!) - doesn't mind writing the occasional policy document please send them my way: jonas@getmondo.co.uk BTW, at the moment we are not holding customer balances or approving transactions so we're not a particularly juicy target, yet. That said, we've already conducted pen tests and invited a number of security firms to come and break our software :)

raesene4 11y ago
FWIW, I saw that ad. Looks very interesting, but I think you may have a challenge getting someone who is a Vuln researcher/pen tester type (who most commonly have CVEs, PoCs to their name) who also has a decent knowledge of banking security, policies etc and also is looking to graduate out of technical work into team management... Most of the pentesters/vuln researchers I know aren't huge fans of writing ISO2700x style policies documents (actually thinking about it there aren't many people who are fans of that kind of thing!) if you're looking for non-traditional advertising routes for this you might want to post on /r/netsec's hiring thread https://www.reddit.com/r/netsec/comments/3zfj6v/rnetsecs_q1_2016_information_security_hiring/ https://www.reddit.com/r/netsec/comments/3zfj6v/rnetsecs_q1_...
- jhuckestein 11y ago
  Thanks a lot for the link :) I'd rather hire a CISO that understands security and teach them how to think like a regulator than vice versa! Heck, I have long hair myself and didn't have any contact with policy documents until just over a year ago. And both our CTO and CEO like to write code. Basically, we're looking for our Alex Stamos. Any more ideas you have how we might find somebody like that and avoid the stigma of the "Bank CISO" job would be much appreciated.