5 ms·

If banks could secure their web portals to the same degree as their mobile apps, they absolutely would. “Portal A (web) cant be as secure as Portal B (mobile),

If banks could secure their web portals to the same degree as their mobile apps, they absolutely would. “Portal A (web) cant be as secure as Portal B (mobile), so don’t bother securing Portal B” isn’t an acceptable security model. The banks are naturally going to reduce their vectors of attack to the greatest degree possible, and that naturally means that some access points will be more secure than others.

cookiengineer 6y ago
I am not sure where you come from, but around Europe banks are the worst when it comes to security audits, and they don’t give a damn about it. From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty. Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way. PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment. I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] https://tools.ietf.org/html/ https://tools.ietf.org/html/ [3] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238
- iknowstuff 6y ago
  Europe's banking is pretty diverse. Some countries have very competitive, modern and innovative banking markets.
- est31 6y ago
  > I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? TOTP (RFC 6238) or HOTP (RFC 4226) are less secure than photoTAN/chipTAN because they are phishable, as in you can think you authorize a 30€ transfer for an internet purchase while in reality it's a 30000€ transfer to some bad people. photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming.
  - cookiengineer 6y ago
    > photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming. Actually, this statement is not true, as those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2]. Attackers or malicious activities on Android can easily modify the payload and still have a valid transaction for the end-user; showing up the wrong IBAN, wrong amount and wrong recipient. This applies to both the official banking apps and the photoTAN generator devices that Cronto is (re-)selling. Note that the research was made public and reposted/printed in a _lot_ of newspapers in 2016. And of course, nothing got improved. If you search the web for Uni Erlangen (FAU) and the "crypto" analysis, you'll find out that Cronto / CrontoSign is the software supplier for pretty much every major bank. And yes, it's patented, and yes, other frameworks got taken down on GitHub for copyright infringements when they tried to reverse engineer it. The only open implementation of the HBCI 2.2 / FinTS 3 [3] standard that I personally know of that hasn't been taken down already is libfintx [4]. [1] (German) https://www.fau.de/2016/10/header/phototan-banking-nicht-sicher/ https://www.fau.de/2016/10/header/phototan-banking-nicht-sic... [2] https://faui1-files.cs.fau.de/filepool/projects/matrix-code/appauth.pdf https://faui1-files.cs.fau.de/filepool/projects/matrix-code/... [3] https://www.hbci-zka.de/ https://www.hbci-zka.de/ [4] https://github.com/mrklintscher/libfintx https://github.com/mrklintscher/libfintx
    - est31 6y ago
      > those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2] Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]: > Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN. But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.
- user5994461 6y ago
  Banks are usually following the currently "supported" versions. At least the big ones that are all compliance based nowadays. Windows XP and IE6 have been out of support for quite a while. They've long been dropped in favor of windows 7 (LTS support until 2023) and 10 more recently, which comes with internet explorer 10 or 11. SSL would be quite easier to keep up-to-date if Microsoft actually upgraded their operating system and applications to support TLS 1.2 by default, which they don't for retro compatibility reasons. For reference, working at JP Morgan, I can tell you that the company has dropped support for Internet Explorer entirely. Half of the existing internal apps don't even load on IE. Would be nice of vendors to stop wasting their time praising IE support as a feature.
  - roblabla 6y ago
    > They've long been dropped in favor of windows 7 (LTS support until 2023) Windows 8.1 has support until 2023. Windows 7 support is over since January 14, 2020. https://support.microsoft.com/en-au/help/13853/windows-lifecycle-fact-sheet https://support.microsoft.com/en-au/help/13853/windows-lifec...
    - gruez 6y ago
      There’s extended support to 2023 through a paid support program.
AnthonyMouse 6y ago
> “Portal A (web) cant be as secure as Portal B (mobile), so don’t bother securing Portal B” isn’t an acceptable security model. Which isn't the case here. A device controlled by the owner isn't less secure than one that isn't. It's only a device controlled by an attacker that is. But "jailbreak detection" only detects the former (when it even detects that) and not the latter. The fact that you can do banking on the web only proves that banks admit that you don't need a device the owner doesn't control in order to do banking.
- untog 6y ago
  “A device controlled by the owner” is one way of putting it. “A device capable of installing unverified software with an increased potential to introduce security vulnerabilities into the OS” is another.
  - ValentineC 6y ago
    > “A device capable of installing unverified software with an increased potential to introduce security vulnerabilities into the OS” is another. The jailbreak community is usually quick in introducing patches for security vulnerabilities. The most recent Mail bug [1] had a patch released 29 days ago [2]. Apple only introduced a fix in a 13.4.5 beta, and it's unsure if the same fix was put into 13.5 [3]. Admittedly, it'll be even better if the community strongly encouraged the installation of such tweaks in Cydia et al. [1] https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/ https://blog.zecops.com/vulnerabilities/youve-got-0-click-ma... [2] https://www.reddit.com/r/jailbreak/comments/g7eujh/release_mailpatch_patch_the_vulnerabilities_found/ https://www.reddit.com/r/jailbreak/comments/g7eujh/release_m... [3] https://support.apple.com/en-us/HT210393#135 https://support.apple.com/en-us/HT210393#135
  - saagarjha 6y ago
    Clearly the fact that you can jailbreak a device really means that the non-jailbroken one wasn’t really preventing the installation of software that abuses vulnerabilities in the OS…
lgats 6y ago
related: bank fraud detection might be port-scanning your local network. https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/ https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_...

cookiengineer 6y ago

I am not sure where you come from, but around Europe banks are the worst when it comes to security audits, and they don’t give a damn about it. From trying to roll their own crypto, to still using legacy ssl to support ie6...everything is shitty. Even when they are forced by law [1] to integrate modern 2FA, they find ways to implement it in a shitty, proprietary way. PSD2 is required since September 2019 and every single bank rolled it out in August and waited until the very last moment. I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? [1] https://ec.europa.eu/info/law/payment-services-psd-2-directive-eu-2015-2366_en https://ec.europa.eu/info/law/payment-services-psd-2-directi... [2] https://tools.ietf.org/html/ https://tools.ietf.org/html/ [3] https://tools.ietf.org/html/rfc6238 https://tools.ietf.org/html/rfc6238

iknowstuff 6y ago
Europe's banking is pretty diverse. Some countries have very competitive, modern and innovative banking markets.
est31 6y ago
> I mean, a photoTAN device with a 120x120 camera resolution? Seriously, what is this? 1999? Why not use RFC 4226 or RFC 6238 [2] [3]? TOTP (RFC 6238) or HOTP (RFC 4226) are less secure than photoTAN/chipTAN because they are phishable, as in you can think you authorize a 30€ transfer for an internet purchase while in reality it's a 30000€ transfer to some bad people. photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming.
- cookiengineer 6y ago
  > photoTAN/chipTAN on the other hand are challenge-response based and send data about the transaction to the second factor device so that you can verify it before confirming. Actually, this statement is not true, as those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2]. Attackers or malicious activities on Android can easily modify the payload and still have a valid transaction for the end-user; showing up the wrong IBAN, wrong amount and wrong recipient. This applies to both the official banking apps and the photoTAN generator devices that Cronto is (re-)selling. Note that the research was made public and reposted/printed in a _lot_ of newspapers in 2016. And of course, nothing got improved. If you search the web for Uni Erlangen (FAU) and the "crypto" analysis, you'll find out that Cronto / CrontoSign is the software supplier for pretty much every major bank. And yes, it's patented, and yes, other frameworks got taken down on GitHub for copyright infringements when they tried to reverse engineer it. The only open implementation of the HBCI 2.2 / FinTS 3 [3] standard that I personally know of that hasn't been taken down already is libfintx [4]. [1] (German) https://www.fau.de/2016/10/header/phototan-banking-nicht-sicher/ https://www.fau.de/2016/10/header/phototan-banking-nicht-sic... [2] https://faui1-files.cs.fau.de/filepool/projects/matrix-code/appauth.pdf https://faui1-files.cs.fau.de/filepool/projects/matrix-code/... [3] https://www.hbci-zka.de/ https://www.hbci-zka.de/ [4] https://github.com/mrklintscher/libfintx https://github.com/mrklintscher/libfintx
  - est31 6y ago
    > those transactions and their payloads are not cryptographically signed and neither are they verified anyhow [1] [2] Your linked sources [1] and [2] don't really cover that topic. They mainly cover the use of Android apps and highlight the danger that the Android devices might be hacked, recommending use of dedicated devices. From [2]: > Last but not least, please note that the photoTAN procedure is not only available as a smartphone app but also as dedicated hardware (Cronto, 2011). Naturally, our statements about the security features of app-based authentication cannot be transferred to thephotoTAN hardware device. Quite the contrary, a dedicated photoTAN device — available for all three analyzed banks — offers excellent security properties largely similar to those of chipTAN. But this wasn't your point. It might very well be that the transaction data is not verified by the generator devices and only displayed, but your sources don't state it.
user5994461 6y ago
Banks are usually following the currently "supported" versions. At least the big ones that are all compliance based nowadays. Windows XP and IE6 have been out of support for quite a while. They've long been dropped in favor of windows 7 (LTS support until 2023) and 10 more recently, which comes with internet explorer 10 or 11. SSL would be quite easier to keep up-to-date if Microsoft actually upgraded their operating system and applications to support TLS 1.2 by default, which they don't for retro compatibility reasons. For reference, working at JP Morgan, I can tell you that the company has dropped support for Internet Explorer entirely. Half of the existing internal apps don't even load on IE. Would be nice of vendors to stop wasting their time praising IE support as a feature.
- roblabla 6y ago
  > They've long been dropped in favor of windows 7 (LTS support until 2023) Windows 8.1 has support until 2023. Windows 7 support is over since January 14, 2020. https://support.microsoft.com/en-au/help/13853/windows-lifecycle-fact-sheet https://support.microsoft.com/en-au/help/13853/windows-lifec...
  - gruez 6y ago
    There’s extended support to 2023 through a paid support program.

AnthonyMouse 6y ago

> “Portal A (web) cant be as secure as Portal B (mobile), so don’t bother securing Portal B” isn’t an acceptable security model. Which isn't the case here. A device controlled by the owner isn't less secure than one that isn't. It's only a device controlled by an attacker that is. But "jailbreak detection" only detects the former (when it even detects that) and not the latter. The fact that you can do banking on the web only proves that banks admit that you don't need a device the owner doesn't control in order to do banking.

untog 6y ago
“A device controlled by the owner” is one way of putting it. “A device capable of installing unverified software with an increased potential to introduce security vulnerabilities into the OS” is another.
- ValentineC 6y ago
  > “A device capable of installing unverified software with an increased potential to introduce security vulnerabilities into the OS” is another. The jailbreak community is usually quick in introducing patches for security vulnerabilities. The most recent Mail bug [1] had a patch released 29 days ago [2]. Apple only introduced a fix in a 13.4.5 beta, and it's unsure if the same fix was put into 13.5 [3]. Admittedly, it'll be even better if the community strongly encouraged the installation of such tweaks in Cydia et al. [1] https://blog.zecops.com/vulnerabilities/youve-got-0-click-mail/ https://blog.zecops.com/vulnerabilities/youve-got-0-click-ma... [2] https://www.reddit.com/r/jailbreak/comments/g7eujh/release_mailpatch_patch_the_vulnerabilities_found/ https://www.reddit.com/r/jailbreak/comments/g7eujh/release_m... [3] https://support.apple.com/en-us/HT210393#135 https://support.apple.com/en-us/HT210393#135
- saagarjha 6y ago
  Clearly the fact that you can jailbreak a device really means that the non-jailbroken one wasn’t really preventing the installation of software that abuses vulnerabilities in the OS…

lgats 6y ago

related: bank fraud detection might be port-scanning your local network. https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_scans/ https://www.theregister.co.uk/2018/08/07/halifax_bank_ports_...