paulcam123
Active Member
- Joined
- Oct 19, 2005
- Messages
- 45
- Reaction score
- 0
Customers of Standard Bank and FNB (and possibly others) should take note that the Internet Banking at these banks is vulnerable to "man-in-the-middle" attacks.
In the case of Standard Bank, most Personal Internet banking is at risk. Such an attack would be almost completely invisible to the user. The attacker (your network/firewall administrator, ISP, etc) could easily access your accounts once you log on. You would still receive SMS notifications if payments were made from your accounts, but not if he just looked at your statements, etc.
In the case of FNB, it would be slightly more complicated. A man-in-the-middle could probably access your account in 30% of the cases without any visible effects, or 60% with a slightly visible effect. It all depends exactly where you click, etc. As with Standard Bank, all your banking details would be visible without receiving any notification.
This vulnerability does not involve loading viruses on your computer, loading certificates, etc. The user would not have to accept any email or change any security settings. Everything looks legitimate - even the certificates are correct. It is a case of bad coding on the Banking Site. The only requirement is that he is a "man-in-the-middle".
Both banks were informed of this and have done nothing or very little to resolve the issue over the past few months.
The exploit took me under an hour to setup and demonstrate on Standard Bank, and another 30 minutes to convert for FNB.
Standard bank claim that "KPMG and Deloitte and Touche have audited our service and secure encryption infrastructure". Makes you wonder exactly what they audited.
I have tested various banks, but not all of them. I have not tested Investec or Nedbank, so I dont know how secure these 2 are. I havent tested business banking products either.
Hopefully now that the public knows about this, the banks will employ network security experts to secure their systems, rather than auditors. I will create an archive of the exploits and post that as well, but I want to "encourage" the banks to fix the problems first.
If anyone doesnt believe me, I have working demonstrations on a computer somewhere in Centurion (no, its not connected to the internet), and would be happy to demonstrate it to any nonbelievers out there.
Until the banks get their act together, I would encourage you not to use internet banking unless you are 100% sure that you trust everyone between your computer and the bank.
In the case of Standard Bank, most Personal Internet banking is at risk. Such an attack would be almost completely invisible to the user. The attacker (your network/firewall administrator, ISP, etc) could easily access your accounts once you log on. You would still receive SMS notifications if payments were made from your accounts, but not if he just looked at your statements, etc.
In the case of FNB, it would be slightly more complicated. A man-in-the-middle could probably access your account in 30% of the cases without any visible effects, or 60% with a slightly visible effect. It all depends exactly where you click, etc. As with Standard Bank, all your banking details would be visible without receiving any notification.
This vulnerability does not involve loading viruses on your computer, loading certificates, etc. The user would not have to accept any email or change any security settings. Everything looks legitimate - even the certificates are correct. It is a case of bad coding on the Banking Site. The only requirement is that he is a "man-in-the-middle".
Both banks were informed of this and have done nothing or very little to resolve the issue over the past few months.
The exploit took me under an hour to setup and demonstrate on Standard Bank, and another 30 minutes to convert for FNB.
Standard bank claim that "KPMG and Deloitte and Touche have audited our service and secure encryption infrastructure". Makes you wonder exactly what they audited.
I have tested various banks, but not all of them. I have not tested Investec or Nedbank, so I dont know how secure these 2 are. I havent tested business banking products either.
Hopefully now that the public knows about this, the banks will employ network security experts to secure their systems, rather than auditors. I will create an archive of the exploits and post that as well, but I want to "encourage" the banks to fix the problems first.
If anyone doesnt believe me, I have working demonstrations on a computer somewhere in Centurion (no, its not connected to the internet), and would be happy to demonstrate it to any nonbelievers out there.
Until the banks get their act together, I would encourage you not to use internet banking unless you are 100% sure that you trust everyone between your computer and the bank.
Last edited:
