7 ms·

Bank of America Telephone Access Security Hole

100 points by rasengan 14y ago

georgeorwell 14y ago
The responsible thing to do in this situation is to keep escalating at the bank until somebody listens. "Bank of America supervisor" implies a manager at a call centre. A few more escalations and you reach some pretty senior people with actual authority to change things. A zero-day involving actual dollars (BoA) is a lot different than a zero-day involving email addresses (AT&T, recently). If this exploit makes withdrawals possible, and it sounds like it does, then you're making it easy to seriously mess up someone's life before it's fixed.
- josh2600 14y ago
  This is a feature... This is basically a lookup which authenticates users based on caller ID (the password is the ssn). This is the same as when your carrier changed your voicemail password to be your phone number (and self-authenticate on inbound calls). The problem everyone is looking at effects 100% of customers but the bank (mistakenly) believes the barriers to entry are high. The important takeaway is this: You cannot have a secure service that is authenticated with a phone number. Phone numbers have been, and will continue to be, an invalid source of identity. In fact, considering a phone number as a signaling agent in a Web of Trust is a terrible decision to make. Time and again we hear of these exploits which wouldn't happen without terrible assumptions. PSA: YOUR PHONE NUMBER IS SPOOFABLE; IT TAKES 10 SECONDS. DO NOT BUILD SYSTEMS THAT TRUST YOUR PHONE NUMBER AS IDENTITY.
  - brown9-2 14y ago
    I am no expert but I think the problem is assuming that the caller ID of the incoming call to the bank is authentic. I'm curious if you could break a similar system that assumed that receipt of an outgoing call made to the customer's phone number was validation of identity.
    - josh2600 14y ago
      Well this depends on delivery medium. If the outbound call is routed to a SIP URI instead of over TDM, you actually have no idea where that calls going. A DID (direct inbound dial) is physically punched down into an exchange somewhere near the actual physical area (415 exchanges are physically punched down in or around San Francisco, for example). If calling a specific DID results in a forward to a carrier like, say, bandwidth.com, then the routing commands applied after that would not be traceable (or at least not easily). In short, only if you know the method of delivery, and I'd argue that it's virtually impossible to know what kind of routing a number you're calling will trigger. Does that help? Inbound caller ID is just Fubarr'd because you can fake it in two seconds.
    - MichaelGG 14y ago
      Outbound call to a number is harder to break. One way is to port the number to another provider, illegally. If you have the person's information and bill, you probably have enough info to get the line transferred. And sometimes, providers will accidentally/idiotically allow a number to be ported even if the information isn't correct; there's plenty of room for mistakes. Another attack is to target the way they place the outbound call. Suppose they place the outbound call with provider X. An attacker might sign up and start a port via provider X. If provider X has poor code, they might activate the number internally, and route all their customers calls to your account, before they find out the port's been rejected. Or you might be able to compromise the provider another way - many providers and VoIP software systems are hilariously weak on security. The first attack will work across the entire phone network; the second requires the authentication call to be made via an insecure provider.
      - josh2600 14y ago
        Right but you're talking about owning the DID, which one may or may not need to do in order to compromise your connection. For example, if I pwn the Asterisk box your call routing runs through, I can mirror the audio or redirect the audio pretty trivially. Going a step further, given how few people aren't buying through a reseller, it's possible to pwn an upstream provider and impact boxes through a man in the middle attack. Even over TDM you're not safe because of physical taps which are difficult to detect (albeit easier than IP). No, Phone numbers are not secure and should never be used as a form of authentication. You don't even need to port a number, you just need to be somewhere in the stream.
  - mibbitier 14y ago
    Wouldn't it be fairly trivial to have an automated system to call the caller back (Verify that they aren't spoofing the caller ID)? eg 1. Caller phones in 2. System looks at caller ID, and says "We will now call you right back to verify you are who you say you are" 3. Caller hangs up and has to wait for call. Surely that system would need a much higher level of hacking to be able to intercept the call.
    - josh2600 14y ago
      This is not implemented for one simple reason: Outbound calls are more expensive than inbound calls.
      - MichaelGG 14y ago
        The usability issues that T-hawk mentions are more of a reason. And anyways, inbound on a toll-free number is often pretty close to your outbound rate, for the US.
        josh2600 14y ago
        That's just not true. The inbound rate on Toll-free is almost always higher than outbound termination. Only in rare, high-volume circumstances is Toll-Free inbound cheaper than outbound. Usability is a huge issue, but I think that it comes back to the bottom line cost figure. The usability is just one of those problems that no one wants to start to deal with because of the cost. If outbound was cheaper someone would've found a way to do it (IMHO).
        MichaelGG 14y ago
        You may want to re-read your comment. If Toll-free inbound is higher than outbound, then why wouldn't they do outbound more often? We're talking about (in many cases) businesses like banks which offer toll free numbers. So obviously cost is not the dominating factor here. Some systems did implement outbound calling for increased security. I'm thinking dial-up (BBS/remote access) scenarios. Windows NT, for instance, allowed you to allow a user-defined or preset callback number. Although, for user-defined, its more likely a cost issue than security.
  - jhull 14y ago
    how does this affect systems in africa and asia where mobile banking is widespread. tons of money transfer is done by sending it via text messages. any idea how they handle this? is spoofing a text message totally different?
- gqwubtx 14y ago
  I just tried this on my account. There's no way to steal money with it. Only view account balance and transactions. Also it looks like BofA has responded to basically the same issue but with credit cards: http://www.msnbc.msn.com/id/44231957/ns/business-consumer_news/t/security-flaw-could-expose-credit-card-data/ http://www.msnbc.msn.com/id/44231957/ns/business-consumer_ne... “Our objective is to balance customers' need for convenience and quick access to general information with industry best protection of their accounts,” wrote Betty Reiss at Bank of America. “In addition to at least two levels of authentication required to access very limited information over our automated system, we have additional security controls in place to detect potential abuse of our automated systems. We understand that there will always be individuals who are trying to beat the system, and we're constantly looking at measures to better protect and service our customers.”
  - MichaelGG 14y ago
    Except some systems, such as PayPal, determine authorization to a bank account by making a couple of small transactions and requiring you to confirm the amount. So read-only access to statements does allow you to get more access to the account via other parties. (I found this out after someone I gave read-only access on my account started making withdrawals via PayPal.)
- driverdan 14y ago
  The responsible thing to do is to close your BoA account and open an account with a bank that puts security before convenience.
  - sillysaurus 14y ago
    You're confusing identities. We're talking about the responsibility of the person who is disclosing the vulnerability, not whether it's responsible for a person to have a BoA account.
- deleted 14y ago
  [deleted]
- mullingitover 14y ago
  > "Bank of America supervisor" implies a manager at a call centre. Hahahaha, yep. And that's as far as you'll get. I've worked at a call center that serviced a lot of big companies. Rest assured you will never, ever speak to an actual manager at a call center (call center managers aren't trained to interact with customers, they mostly do scheduling and deal with attendance policy). You'll get a "Level 2 rep" who's just another rep who has some authority to grant exceptions to policy in certain cases. Also, if you call the corporate HQ and demand to speak to the president of the company, they'll route your call right back to that level 2 rep in the call center. Most companies go out of their way to ensure that the leadership is protected from the inevitable lunatic customers.
  - georgeorwell 14y ago
    I made it to level 5 once with my bank when a merchant was ripping me off. It was the kind of thing where they could only promise a callback within the week because the person was generally busy not answering customer calls and didn't have anything to do with the call centre. That guy fixed the problem when everyone under him said they couldn't. If it wasn't a bank, I would say forget about this approach. But based on my own limited experience, I have this belief that retail banks are nowhere near as atrocious as PayPal or your typical telecom or insurance company. Even if escalation through customer-facing channels didn't pan out, I guess I would like to see more than a public exposé on a blog and YouTube from someone who "is a long-time advocate of privacy and the conservation of the personal realm" and who previously was involved with Mt. Gox. There is no indication that they exhausted all possible avenues before going public with the information, and I'm quite sure there's more to do than simply give up once you reach level 2. It seems like the author, thieves, and a fraction of a percent of BoA customers are the only ones who benefit from this. His actual core business at the moment is based on safeguarding people's privacy; this kind of thing only makes me want to run far far away.
    - mullingitover 14y ago
      > I made it to level 5 once with my bank when a merchant was ripping me off. Eh, in all reality your 'level 5' is likely the other level 2 sitting next to the 'level 4' (who was also a level 2) you spoke to. I know this from experience, there's not a ton of professionalism when everyone is pulling down < $10 an hour. It might've been the one level 2 that knew more than the others. It's really level 2 reps all the way down.
chayesfss 14y ago
Hate to pile on but security & boa don't go together too well http://www.gosecureauth.com/blog/easily-bypass-bank-of-america-2-factor-safepass-authentication/ http://www.gosecureauth.com/blog/easily-bypass-bank-of-ameri...
csmatt 14y ago
It's not just BofA. I know of at least one other popular bank that uses the last four of one's SSN as the default password. They may also require a DOB, but that's simple enough.
bo1024 14y ago
So if this was on a website instead of via phone the authors would presumably be facing criminal charges or years in prison, right?
- JacobAldridge 14y ago
  Well, they used a proxy to log into their own account, so probably not. Had they tried to demonstrate this using someone else's SSN, then yup - lock 'em up!
- driverdan 14y ago
  The laws apply to any electronic access or communications, including phone. In this case they accessed their own account so no laws have been broken.
- smsm42 14y ago
  If they stole data from 100K bank accounts using SSN generator and then sent those to the press - yes, probably. Since they instead accessed their own account to which they were authorized to connect anyway - no, not right.
lcusack 14y ago
On a related note - can anyone give me perspective on the quality of their VPN service?
- gfosco 14y ago
  I use PIA for my VPN and like it very much. Lots of different places to connect to, runs fast enough to do torrents, no complaints here.
BOAsucksdick 14y ago
So this is how the Nigerians are stealing your identity with only your name & address. $4 for an SSN from those shady companies online, and a quick phonecall.... Damn, they went from Name & address to full bank access in no time at all...
BOAsucksdick 14y ago
So this is how the Nigerians are stealing your identity with only your name & address. $4 for an SSN from those shady companies online, and a quick phonecall.... Damn, they went from Name & address to full bank access in no time at all...
badsecurityhole 14y ago
This is more dangerous than it sounds. As the blog post points out you can only get account balance and last transactions. Here's what's really dangerous: the last transactions. Say you have one more piece of information: account # and routing #. This can be obtained from any check the person has written. Now you can link their account to your account from your bank's website. Your bank will make some small deposits into their account that you will have to verify. Now you use the security hole discussed in this post and you can find out what the amount of those small deposits was. You have now successfully linked their account to your account and you can withdraw their entire account balance into your account from your bank's website. Now go to your local bank branch and withdraw your entire account in cash and walk away. So yes, this security hole is bad.
- jrabone 14y ago
  That is very bad. The small deposit + verification is exactly how Paypal used to do account linking - I don't know if they've since added extra steps.
  - mikeash 14y ago
    It's how everything I've ever used for ACH transfers does account linking, from Paypal to other banks. They assume, and mostly rightfully so, that if you can view an account's recent transactions, you control the account.
  - nacs 14y ago
    Google also does this method of verification for their Adsense payments -- just type in the amount deposited and your account can now receive payments from Google.
- ams6110 14y ago
  ...and then prepare for the FBI to show up at your door. You can't open a bank account without producing several pieces of ID bearing you current address. Not discounting the apparent stupidity of BofA relying on caller ID for auhthentication, but it's not quite that easy. Moving money from one account to another leaves a trail. Still a really bad situation though.
Aloha 14y ago
First, its not off CID, its off ANI (ANI is what is passed to the remote endpoint when you call a toll free number), not that you cant spoof ANI - but often it can be a little harder, as its used in billing on the telco side. Second, every bank does something like this, I can access my credit card by phone with just the last four digits of my account number, and by calling in from my phone. I can do the same thing with my BofA account number in lieu of my SSN. Third, again, every bank is like this to some extent - every CC I have, if I call in from my number, and key in the last for digits of my credit card, I can get info. I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have.
- philsnow 14y ago
  "Second, every bank does something like this" I can't tell if your implying that this makes the practice somehow less bad, but I hope not. "I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have." It's a considerable amount of information for a random stranger to have, but _not_ for an attacker.
- georgeorwell 14y ago
  Just because I had no idea what your acronyms meant: CID: Caller ID ANI: Automatic Number Identification http://www.egyed.com/faq/cid.htm http://www.egyed.com/faq/cid.htm If this is a widespread vulnerability, why is it left open? Also, my bank wants a 13-digit access card number and a 4-digit PIN, which is secure enough for me.
- mikeash 14y ago
  Credit cards are a vastly different scenario than bank accounts. To a first approximation, unauthorized credit card access poses zero risk to the cardholder. Bank accounts are vastly different in that respect. Can you access your checking/savings account like this, not just your credit cards?
- ams6110 14y ago
  Since they hacked it via a common CID spoofing site, that would seem to indicate that it is using caller ID.
thechut 14y ago
This is the same sort of exploit used in the "Phone hacking" scandal that News of the World and other newspapers got in trouble for. Except in that case they were hacking voicemail boxes not bank accounts. This is pretty serious and not exactly a novel idea, very surprised that BoA hasn't encountered this problem yet.
shaaaaawn 14y ago
So the worst case scenario that this maybe non-repeatable process might result in someone: 1) accessing more of your data and 2) maybe perform fraudulent transactions that will be detected and/or reported; investigated; and refunded. Uptown problems.
smsm42 14y ago
From what I understand, knowing somebody's name, SSN, address and DOB would allow you to impersonate him/her at 90% of places. In 90% of the rest, they'd require some password but if you sound convincing enough and desperate enough and claim you forgot the password, they'd give you some information they're not supposed to in exchange for the pieces from above. SSN especially is treated like it's super-secret even though practically everybody asks you for it - banks, employers, car dealers, credit cards, lenders, etc. Government loves to ask DOB for some reason like it's a big secret - even though looking for congrats of anybody's facebook page allows to know DOB for like 90% of people. In general, this whole system does not collapse only because overwhelming majority of people are honest and don't even think about cheating it. Which I think is good, but still I am a bit scared when I think about how fragile it is.
- sageikosa 14y ago
  I am both amused and annoyed at now having to enter my US postal ZIP code when using my credit card at some gas stations. If someone stole my wallet, they'd have that information already as it is on my driver's license.
  - sneak 14y ago
    Don't use your license address as your billing address.
- chimeracoder 14y ago
  > SSN especially is treated like it's super-secret even though practically everybody asks you for it - banks, employers, car dealers, credit cards, lenders, etc. Ironically, the IRS doesn't. I know of someone who had to authenticate himself to the IRS (I think when getting a new social security card) and was prepared to give them his SSN, when the agent scolded him, 'Your SSN isn't a means of identification'. If only they knew! > Government loves to ask DOB for some reason like it's a big secret - even though looking for congrats of anybody's facebook page allows to know DOB for like 90% of people. DOB is public record (by one means or another) for almost any US resident.

100 points by rasengan 14y ago

The responsible thing to do in this situation is to keep escalating at the bank until somebody listens. "Bank of America supervisor" implies a manager at a call centre. A few more escalations and you reach some pretty senior people with actual authority to change things. A zero-day involving actual dollars (BoA) is a lot different than a zero-day involving email addresses (AT&T, recently). If this exploit makes withdrawals possible, and it sounds like it does, then you're making it easy to seriously mess up someone's life before it's fixed.

josh2600 14y ago
This is a feature... This is basically a lookup which authenticates users based on caller ID (the password is the ssn). This is the same as when your carrier changed your voicemail password to be your phone number (and self-authenticate on inbound calls). The problem everyone is looking at effects 100% of customers but the bank (mistakenly) believes the barriers to entry are high. The important takeaway is this: You cannot have a secure service that is authenticated with a phone number. Phone numbers have been, and will continue to be, an invalid source of identity. In fact, considering a phone number as a signaling agent in a Web of Trust is a terrible decision to make. Time and again we hear of these exploits which wouldn't happen without terrible assumptions. PSA: YOUR PHONE NUMBER IS SPOOFABLE; IT TAKES 10 SECONDS. DO NOT BUILD SYSTEMS THAT TRUST YOUR PHONE NUMBER AS IDENTITY.
- brown9-2 14y ago
  I am no expert but I think the problem is assuming that the caller ID of the incoming call to the bank is authentic. I'm curious if you could break a similar system that assumed that receipt of an outgoing call made to the customer's phone number was validation of identity.
  - josh2600 14y ago
    Well this depends on delivery medium. If the outbound call is routed to a SIP URI instead of over TDM, you actually have no idea where that calls going. A DID (direct inbound dial) is physically punched down into an exchange somewhere near the actual physical area (415 exchanges are physically punched down in or around San Francisco, for example). If calling a specific DID results in a forward to a carrier like, say, bandwidth.com, then the routing commands applied after that would not be traceable (or at least not easily). In short, only if you know the method of delivery, and I'd argue that it's virtually impossible to know what kind of routing a number you're calling will trigger. Does that help? Inbound caller ID is just Fubarr'd because you can fake it in two seconds.
  - MichaelGG 14y ago
    Outbound call to a number is harder to break. One way is to port the number to another provider, illegally. If you have the person's information and bill, you probably have enough info to get the line transferred. And sometimes, providers will accidentally/idiotically allow a number to be ported even if the information isn't correct; there's plenty of room for mistakes. Another attack is to target the way they place the outbound call. Suppose they place the outbound call with provider X. An attacker might sign up and start a port via provider X. If provider X has poor code, they might activate the number internally, and route all their customers calls to your account, before they find out the port's been rejected. Or you might be able to compromise the provider another way - many providers and VoIP software systems are hilariously weak on security. The first attack will work across the entire phone network; the second requires the authentication call to be made via an insecure provider.
    - josh2600 14y ago
      Right but you're talking about owning the DID, which one may or may not need to do in order to compromise your connection. For example, if I pwn the Asterisk box your call routing runs through, I can mirror the audio or redirect the audio pretty trivially. Going a step further, given how few people aren't buying through a reseller, it's possible to pwn an upstream provider and impact boxes through a man in the middle attack. Even over TDM you're not safe because of physical taps which are difficult to detect (albeit easier than IP). No, Phone numbers are not secure and should never be used as a form of authentication. You don't even need to port a number, you just need to be somewhere in the stream.
- mibbitier 14y ago
  Wouldn't it be fairly trivial to have an automated system to call the caller back (Verify that they aren't spoofing the caller ID)? eg 1. Caller phones in 2. System looks at caller ID, and says "We will now call you right back to verify you are who you say you are" 3. Caller hangs up and has to wait for call. Surely that system would need a much higher level of hacking to be able to intercept the call.
  - josh2600 14y ago
    This is not implemented for one simple reason: Outbound calls are more expensive than inbound calls.
    - MichaelGG 14y ago
      The usability issues that T-hawk mentions are more of a reason. And anyways, inbound on a toll-free number is often pretty close to your outbound rate, for the US.
      - josh2600 14y ago
        That's just not true. The inbound rate on Toll-free is almost always higher than outbound termination. Only in rare, high-volume circumstances is Toll-Free inbound cheaper than outbound. Usability is a huge issue, but I think that it comes back to the bottom line cost figure. The usability is just one of those problems that no one wants to start to deal with because of the cost. If outbound was cheaper someone would've found a way to do it (IMHO).
        MichaelGG 14y ago
        You may want to re-read your comment. If Toll-free inbound is higher than outbound, then why wouldn't they do outbound more often? We're talking about (in many cases) businesses like banks which offer toll free numbers. So obviously cost is not the dominating factor here. Some systems did implement outbound calling for increased security. I'm thinking dial-up (BBS/remote access) scenarios. Windows NT, for instance, allowed you to allow a user-defined or preset callback number. Although, for user-defined, its more likely a cost issue than security.
- jhull 14y ago
  how does this affect systems in africa and asia where mobile banking is widespread. tons of money transfer is done by sending it via text messages. any idea how they handle this? is spoofing a text message totally different?
gqwubtx 14y ago
I just tried this on my account. There's no way to steal money with it. Only view account balance and transactions. Also it looks like BofA has responded to basically the same issue but with credit cards: http://www.msnbc.msn.com/id/44231957/ns/business-consumer_news/t/security-flaw-could-expose-credit-card-data/ http://www.msnbc.msn.com/id/44231957/ns/business-consumer_ne... “Our objective is to balance customers' need for convenience and quick access to general information with industry best protection of their accounts,” wrote Betty Reiss at Bank of America. “In addition to at least two levels of authentication required to access very limited information over our automated system, we have additional security controls in place to detect potential abuse of our automated systems. We understand that there will always be individuals who are trying to beat the system, and we're constantly looking at measures to better protect and service our customers.”
- MichaelGG 14y ago
  Except some systems, such as PayPal, determine authorization to a bank account by making a couple of small transactions and requiring you to confirm the amount. So read-only access to statements does allow you to get more access to the account via other parties. (I found this out after someone I gave read-only access on my account started making withdrawals via PayPal.)
driverdan 14y ago
The responsible thing to do is to close your BoA account and open an account with a bank that puts security before convenience.
- sillysaurus 14y ago
  You're confusing identities. We're talking about the responsibility of the person who is disclosing the vulnerability, not whether it's responsible for a person to have a BoA account.
deleted 14y ago
[deleted]
mullingitover 14y ago
> "Bank of America supervisor" implies a manager at a call centre. Hahahaha, yep. And that's as far as you'll get. I've worked at a call center that serviced a lot of big companies. Rest assured you will never, ever speak to an actual manager at a call center (call center managers aren't trained to interact with customers, they mostly do scheduling and deal with attendance policy). You'll get a "Level 2 rep" who's just another rep who has some authority to grant exceptions to policy in certain cases. Also, if you call the corporate HQ and demand to speak to the president of the company, they'll route your call right back to that level 2 rep in the call center. Most companies go out of their way to ensure that the leadership is protected from the inevitable lunatic customers.
- georgeorwell 14y ago
  I made it to level 5 once with my bank when a merchant was ripping me off. It was the kind of thing where they could only promise a callback within the week because the person was generally busy not answering customer calls and didn't have anything to do with the call centre. That guy fixed the problem when everyone under him said they couldn't. If it wasn't a bank, I would say forget about this approach. But based on my own limited experience, I have this belief that retail banks are nowhere near as atrocious as PayPal or your typical telecom or insurance company. Even if escalation through customer-facing channels didn't pan out, I guess I would like to see more than a public exposé on a blog and YouTube from someone who "is a long-time advocate of privacy and the conservation of the personal realm" and who previously was involved with Mt. Gox. There is no indication that they exhausted all possible avenues before going public with the information, and I'm quite sure there's more to do than simply give up once you reach level 2. It seems like the author, thieves, and a fraction of a percent of BoA customers are the only ones who benefit from this. His actual core business at the moment is based on safeguarding people's privacy; this kind of thing only makes me want to run far far away.
  - mullingitover 14y ago
    > I made it to level 5 once with my bank when a merchant was ripping me off. Eh, in all reality your 'level 5' is likely the other level 2 sitting next to the 'level 4' (who was also a level 2) you spoke to. I know this from experience, there's not a ton of professionalism when everyone is pulling down < $10 an hour. It might've been the one level 2 that knew more than the others. It's really level 2 reps all the way down.

chayesfss 14y ago

Hate to pile on but security & boa don't go together too well http://www.gosecureauth.com/blog/easily-bypass-bank-of-america-2-factor-safepass-authentication/ http://www.gosecureauth.com/blog/easily-bypass-bank-of-ameri...

csmatt 14y ago

It's not just BofA. I know of at least one other popular bank that uses the last four of one's SSN as the default password. They may also require a DOB, but that's simple enough.

bo1024 14y ago

So if this was on a website instead of via phone the authors would presumably be facing criminal charges or years in prison, right?

JacobAldridge 14y ago
Well, they used a proxy to log into their own account, so probably not. Had they tried to demonstrate this using someone else's SSN, then yup - lock 'em up!
driverdan 14y ago
The laws apply to any electronic access or communications, including phone. In this case they accessed their own account so no laws have been broken.
smsm42 14y ago
If they stole data from 100K bank accounts using SSN generator and then sent those to the press - yes, probably. Since they instead accessed their own account to which they were authorized to connect anyway - no, not right.

lcusack 14y ago

On a related note - can anyone give me perspective on the quality of their VPN service?

gfosco 14y ago
I use PIA for my VPN and like it very much. Lots of different places to connect to, runs fast enough to do torrents, no complaints here.

BOAsucksdick 14y ago

So this is how the Nigerians are stealing your identity with only your name & address. $4 for an SSN from those shady companies online, and a quick phonecall.... Damn, they went from Name & address to full bank access in no time at all...

BOAsucksdick 14y ago

badsecurityhole 14y ago

This is more dangerous than it sounds. As the blog post points out you can only get account balance and last transactions. Here's what's really dangerous: the last transactions. Say you have one more piece of information: account # and routing #. This can be obtained from any check the person has written. Now you can link their account to your account from your bank's website. Your bank will make some small deposits into their account that you will have to verify. Now you use the security hole discussed in this post and you can find out what the amount of those small deposits was. You have now successfully linked their account to your account and you can withdraw their entire account balance into your account from your bank's website. Now go to your local bank branch and withdraw your entire account in cash and walk away. So yes, this security hole is bad.

jrabone 14y ago
That is very bad. The small deposit + verification is exactly how Paypal used to do account linking - I don't know if they've since added extra steps.
- mikeash 14y ago
  It's how everything I've ever used for ACH transfers does account linking, from Paypal to other banks. They assume, and mostly rightfully so, that if you can view an account's recent transactions, you control the account.
- nacs 14y ago
  Google also does this method of verification for their Adsense payments -- just type in the amount deposited and your account can now receive payments from Google.
ams6110 14y ago
...and then prepare for the FBI to show up at your door. You can't open a bank account without producing several pieces of ID bearing you current address. Not discounting the apparent stupidity of BofA relying on caller ID for auhthentication, but it's not quite that easy. Moving money from one account to another leaves a trail. Still a really bad situation though.

Aloha 14y ago

First, its not off CID, its off ANI (ANI is what is passed to the remote endpoint when you call a toll free number), not that you cant spoof ANI - but often it can be a little harder, as its used in billing on the telco side. Second, every bank does something like this, I can access my credit card by phone with just the last four digits of my account number, and by calling in from my phone. I can do the same thing with my BofA account number in lieu of my SSN. Third, again, every bank is like this to some extent - every CC I have, if I call in from my number, and key in the last for digits of my credit card, I can get info. I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have.

philsnow 14y ago
"Second, every bank does something like this" I can't tell if your implying that this makes the practice somehow less bad, but I hope not. "I should also point that knowing someones Tel Number, Account Number and/or CC number is a considerable amount of info to have." It's a considerable amount of information for a random stranger to have, but _not_ for an attacker.
georgeorwell 14y ago
Just because I had no idea what your acronyms meant: CID: Caller ID ANI: Automatic Number Identification http://www.egyed.com/faq/cid.htm http://www.egyed.com/faq/cid.htm If this is a widespread vulnerability, why is it left open? Also, my bank wants a 13-digit access card number and a 4-digit PIN, which is secure enough for me.
mikeash 14y ago
Credit cards are a vastly different scenario than bank accounts. To a first approximation, unauthorized credit card access poses zero risk to the cardholder. Bank accounts are vastly different in that respect. Can you access your checking/savings account like this, not just your credit cards?
ams6110 14y ago
Since they hacked it via a common CID spoofing site, that would seem to indicate that it is using caller ID.

thechut 14y ago

This is the same sort of exploit used in the "Phone hacking" scandal that News of the World and other newspapers got in trouble for. Except in that case they were hacking voicemail boxes not bank accounts. This is pretty serious and not exactly a novel idea, very surprised that BoA hasn't encountered this problem yet.

shaaaaawn 14y ago

So the worst case scenario that this maybe non-repeatable process might result in someone: 1) accessing more of your data and 2) maybe perform fraudulent transactions that will be detected and/or reported; investigated; and refunded. Uptown problems.

smsm42 14y ago

From what I understand, knowing somebody's name, SSN, address and DOB would allow you to impersonate him/her at 90% of places. In 90% of the rest, they'd require some password but if you sound convincing enough and desperate enough and claim you forgot the password, they'd give you some information they're not supposed to in exchange for the pieces from above. SSN especially is treated like it's super-secret even though practically everybody asks you for it - banks, employers, car dealers, credit cards, lenders, etc. Government loves to ask DOB for some reason like it's a big secret - even though looking for congrats of anybody's facebook page allows to know DOB for like 90% of people. In general, this whole system does not collapse only because overwhelming majority of people are honest and don't even think about cheating it. Which I think is good, but still I am a bit scared when I think about how fragile it is.

sageikosa 14y ago
I am both amused and annoyed at now having to enter my US postal ZIP code when using my credit card at some gas stations. If someone stole my wallet, they'd have that information already as it is on my driver's license.
- sneak 14y ago
  Don't use your license address as your billing address.
chimeracoder 14y ago
> SSN especially is treated like it's super-secret even though practically everybody asks you for it - banks, employers, car dealers, credit cards, lenders, etc. Ironically, the IRS doesn't. I know of someone who had to authenticate himself to the IRS (I think when getting a new social security card) and was prepared to give them his SSN, when the agent scolded him, 'Your SSN isn't a means of identification'. If only they knew! > Government loves to ask DOB for some reason like it's a big secret - even though looking for congrats of anybody's facebook page allows to know DOB for like 90% of people. DOB is public record (by one means or another) for almost any US resident.