Security Research Shows 75 Percent Of US Bank Websites Have Flaws
Researchers from the University of Michigan found 75 percent of bank sites surveyed had at least one security flaw. The report was presented Friday at the Symposium on Usable Privacy and Security meeting at Carnegie Mellon University. According to the research, vast majority of US bank websites jeopardize the security of their online customers by including design flaws that expose passwords and are susceptible to tampering by attackers.
In a paper titled “Analyzing Web sites for user-visible security design flaws,” researchers describe design flaws that could compromise security of some of the largest banks in the country. The flaws aren’t bugs, but rather features built into the design of the sites. They include:
Placing secure login boxes on insecure pages, i.e. pages that aren’t protected by secure sockets layer. That allows passwords to be intercepted through man-in-the-middle attacks.
Putting contact information and security notices on insecure pages. This makes it easy for scammers to change addresses and phone numbers listed on the page.
Not making it clear when the website is redirecting customers to a page outside the bank’s domain. As a result, customers don’t know whether to trust the site.
Allowing inadequate user IDs and passwords. Sites frequently allowed email addresses as user IDs and didn’t require strong passwords.
Emailing sensitive information. This included passwords and statements.
The report was based on the examination of websites for 214 financial institutions. The study was conducted in 2006, so it’s possible the designs have been cleaned up. It is also possible that between 2006 and 2008, a lot more security flaws has been added but yet discovered.
More on CyberInsecure:
Posts
Leave a Reply
Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.