Daily cyber threats and internet security news: network security, online safety and latest security alerts
July 26th, 2008

Security Research Shows 75 Percent Of US Bank Websites Have Flaws

Researchers from the University of Michigan found 75 percent of bank sites surveyed had at least one security flaw. The report was presented Friday at the Symposium on Usable Privacy and Security meeting at Carnegie Mellon University. According to the research, vast majority of US bank websites jeopardize the security of their online customers by including design flaws that expose passwords and are susceptible to tampering by attackers.

In a paper titled “Analyzing Web sites for user-visible security design flaws,” researchers describe design flaws that could compromise security of some of the largest banks in the country. The flaws aren’t bugs, but rather features built into the design of the sites. They include:

Placing secure login boxes on insecure pages, i.e. pages that aren’t protected by secure sockets layer. That allows passwords to be intercepted through man-in-the-middle attacks.

Putting contact information and security notices on insecure pages. This makes it easy for scammers to change addresses and phone numbers listed on the page.

Not making it clear when the website is redirecting customers to a page outside the bank’s domain. As a result, customers don’t know whether to trust the site.

Allowing inadequate user IDs and passwords. Sites frequently allowed email addresses as user IDs and didn’t require strong passwords.

Emailing sensitive information. This included passwords and statements.

The report was based on the examination of websites for 214 financial institutions. The study was conducted in 2006, so it’s possible the designs have been cleaned up. It is also possible that between 2006 and 2008, a lot more security flaws has been added but yet discovered.

Share this item with others:

More on CyberInsecure:
  • Phishing Attacks Doubled In UK
  • Microsoft’s Report Shows Vista More Secure Than XP
  • Google Helps Most Phishing Sites
  • Credit Cards Data Stolen In 1st Source Bank Intrusion
  • Storm Botnet Is Behind 20 Percent Of Internet Spam

  • If you found this information useful, consider linking to it from your own website.
    Just copy and paste the code below into your website (Ctrl+C to copy)
    It will look like this: Security Research Shows 75 Percent Of US Bank Websites Have Flaws

    Leave a Reply

    Comments with unsolicited links to other resources will be marked as spam. DO NOT leave links in comments. Please leave your real email, it wont be published.

    To prove you’re a person (not a spam script), type the security word shown in the picture. Click on the picture to hear an audio file of the word.