Online Banking Security

First a little story:

I work in a computer repair shop in the UK, and recently we had a computer come in that had the windows hosts file infected. I immediately noticed the all the major banking websites were in the hosts file and set to be diverted to another IP address. Immediately I contacted the police (who didn't care), then I contacted the customer... but it was too late, they had several thousand GBP taken from the bank. Fortunately for the customer the bank refunded every penny. Then the bank contacted the police at which point they took it seriously, and the fraudsters have been caught and that is all I have heard. The police's argument when I rang them said nothing could be done since the customer would have agreed to some terms and conditions to install some software, free smileys etc. However like I said the bank took it much more seriously.


Anyway I was just saw some TV program about this kind of thing... and they had a security expert in from symantec, that said "He would never use online banking, and that you could ask anyone who knows anything about computer security and they would all say the same" so I thought I would put that to the test.


I personally do use online banking with Barclays who also say they will refund any money lost from result of being hacked. However I take certain precautions, I never use online banking wirelessly or at public computers/public internet connections. I also check the hosts file, running proccesses, BHO's, LSP's, etc... just to be a little more sure that no-ones spying on me.



Anyway I kinda wrote this post in a hurry so please leave me any thoughts and anything I have got wrong or needs adding.... hopefully this should raise awareness too.

Well, IMO, if you feel it's worth taking the risk and take what precautions are available, then I see no reason not to... I will probably start using online banking once I have more bills that I have to pay on my own... The important thing is to keep your own records, so if something happens to the banks servers, you know what you're supposed to have...

I would not use online banking on a public machine (cybercafe or something). However, I'd be entirely confident about using it on a wireless LAN (as long as I was on my own machine).

The reason is, I trust SSL to encrypt the session and authenticate my bank's site. If I don't see the padlock, I won't enter my details. If the SSL certificate is not accepted by my browser, again, I won't enter my details.

And I am aware of at least one case where my bank was hacked into - their web site was defaced, but I am confident that that particular web site was just an online brochure and had nothing to do with banking.

Slarty

There are 3 machines I will bank online from:-

1. My home workstation.
2. My sweety's wireless XP Laptop.
3. My work workstation.

.... because I manage the security on all three. Also, I only connect to them from a shortcut I created.... Why? It only contains the IP address of the bank's site not it's domain name - they stay pretty fixed so it's not a big deal when they change it. Much of the sneaky spyware looks for the domain name of banks too so that they can capture the authentication - they don't recognize the IP address. Lastly, I _never_ allow them to remember my password.

The other bright side is that I leave very little money in my current account.... I pay all the bills and spend the rest on beer... :D ... so if anyone succeeds in robbing me they are going to be in for a surprise... :p

Would I recommend it to everyone? Nope.... No chance.... Most people are not capable of determining their "security state" and I don't want some moron coming to me six months down the road and blaming me for their children's questionable surfing habits and their inability to recognize them.... :rolleyes:

I have enough confidence in my skills to keep my computer from being infected that I personally use online banking, although I won't use it on public wireless and won't use it on anyone's computer except for my own. Once I get my DSL connection up and running in a few weeks, I will probably begin using a Knoppix Live CD to do banking as I'll be able to know without doubt that it is not compromised.

- X

Thanks for your feedback, interesting results... so far that bloke from symantec has been mostly wrong... has anyone noticed that symantec's main office place thingy is in a ex-nuclear bunker in the middle of no-where, what a waste. Symantec is not one of my best friends, where I work 1in5 computers are in because "I have just installed Symantec internet security and now I can't access the internet/send emails/receive emails/do anything" although alot of the time it is what we call UIAI at work... short for "user is an idiot" :-)

PS never thought of using a live CD... although again wouldn't do it wireless/public to avoid sniffers

I know a bit about computer security and i would not use online banking because it just makes me feel a little uneasy, But i think that what makes me feel so uneasy about it is not as much as the risk of a hacker but the fact that i dont see the transaction happening like if i go to the bank i give them paper and i get some back but with online banking their is no paper its all electronic and i think that that will be one of the biggest hurtles for getting people to switch to online banking. Even tho I said i would neavor use it in the poll i think that i might be switching over to it.

Quote:

---

if i go to the bank i give them paper and i get some back

---

How do you _know_ the transaction was carried out in the fashion you expected it to be? Because you got a peice of paper? Does paper give you a warm, fuzzy feeling? There are lot's of people that have been defrauded by tellers that are less than honest.... But they still got their little piece of paper....

You still can't trust it...

just dont use a bank. Keep all your money in cash in a giant room upstairs.....with a big lock....

Till your house catches on fire...

Quote:

---

Anyway I was just saw some TV program about this kind of thing... and they had a security expert in from symantec, that said "He would never use online banking, and that you could ask anyone who knows anything about computer security and they would all say the same" so I thought I would put that to the test.

---

Now i know why Symantec is deploying a lot of crap lately.... This guy is smart as a door...he is the kind that doesnt make online transactions, but give his credit card to the waiter in the restaurant to pay the bill.... :)
There is not such thing as a "total secure financial transaction". Every kind of transaction poses a risk, including doing that with cash.... If you take precautions, you can mitigate the risks of each kind.

The idea of using a liveCD is great..... anyone got any suggestions on which one to use... something that I can give away free with PC repairs that we do.... so it needs to be dead easy to use, with a windows like GUI (did I just say that)... and good support for older PC's...... in other words idiots/customers need to be able to use it easily.

I don't have a CC, and probably never will. Sure they are great, but I am a little too paranoid to use or even own one. I will not use online banking because there are enough 0-day browser exploit (read 0-day spyware) that I will not bank online. Sure, adware/spybot/spyware blaster/hijack this are all great programs, but there will always be that chance that you picked up some spyware that isn't protected against/detected. No matter how many patches you have, there is still that chance...

No, I don't send my resume with SSN over the internet (e-mail) without encryption (and even then, I need to know that it is computationaly secure), yes I do check my credit report (face-to-face, check credentals)

Maybe I am overboard, but I won't use the internet for my finances.

I'm sure the guy from symantec is going to want to seem paranoid to the public, making it look necessary to buy the latest and best anti-virus/security software! Even if this has nothing to do with online transactions through SSL.

I just signed up for online banking with national city. I was more worried about my information being stored at yet another location more than the threat of a compromise or money getting stolen.

Quote:

---

No, I don't send my resume with SSN over the internet

---

There's NO reason for your SSN to be on you resume at all in the first place!.

The ironi is, not using a credit card or online banking still won't protect you from identity theives, who will the gladly get cards, loans, etc in your name....

The way I see it, I'd rather at least enjoy the commodity of these.


Ammo

Quote:

---

How do you _know_ the transaction was carried out in the fashion you expected it to be? Because you got a peice of paper? Does paper give you a warm, fuzzy feeling? There are lot's of people that have been defrauded by tellers that are less than honest.... But they still got their little piece of paper....

You still can't trust it...

---

I agree but what I meant was that people like to see tangible evidence that their trans action took place. I would trust a computer over a person any day and to think about it i buy items from web sites ofter and have never had a credit card number stolen and tha same goes with my father and the only time he ever had a credit card number stolen was when he was in the hosptial from one of the nurses.

Quote:

---

hosptial from one of the nurses

---

OUCH!!!! That had to hurt.....

Many years ago a had a good friend that, nice and fun as he was, turned out to have a little mental problem. He started in a bank and after 18 months had a nervous breakdown. Quite soon after it was dicovered that he had been "re-directing" other peoples fund's into his own accounts via a somewhat devious means.... He had ripped off the bank's customers for almost GBP 30,000.... At a time when he and I were being payed about GBP 20/week.... :eek:

I lost contact with him after he went for treatment but I heard that the bank had been all very nice about it and when he had completed his treatment they re-hired him..... Though I'm sure they had a manager watching his every move.....

In the last 5 years I have seen bank tellers allow money to be withdrawn from a Savngs account in my fathers name on 3 differnt ocassions buy a guy with the same first and last name, but different middle initial/ssn/address/signature/ and who opened his account at a different branch.

I have had them "lose" some of my money (different bank)
I have had them deduct the money twice from my account for the same thing (took 4 days to clear up)

I have had them add several hundred dollars to my account (which lead me into panic thinking one of my bills didnt get paid, lol) then take it out about a week later (which again freaked me out for about a second till I remebered it was theres anyway)

and a few other "minor" things. Yet with online banking I have had not a single problem. infact becasue of the hours I work it makes my life a hell of a lot easier.

Quote:

---

Originally posted here by Tiger Shark
How do you _know_ the transaction was carried out in the fashion you expected it to be? Because you got a peice of paper? Does paper give you a warm, fuzzy feeling? There are lot's of people that have been defrauded by tellers that are less than honest.... But they still got their little piece of paper....

You still can't trust it...

---

Funny you mention that. I had a former co-worker whose wife was a teller at a bank. When they got busted, she had helped cash close to USD$5,000 in phony checks, and he had ripped off our employer for insurance costs to repair his personal vehicle (had to use it for work, got into a wreck, the employer paid for the damages, then he filed a personal auto-insurance claim as well...referred to as 'double dipping'.)

They both got into a world of ****.

The worst part; we both worked for a law enforcement agency at the time. Talk about destroying any notions of warm-fuzzy feelings.

yea You cant really trust people it sucks to say but their are so many stores of people getting busted for riping people off or of people getting riped off, Like my sister and her boyfriend wear in a really bad accident about 5-6 weeks ago bolth had to be taked to the regional traumma center my sis had to have her skull put back to geather and her boyfriend all most died but their supposed friend who was in the back seat who didn't get hurt stole about $500 from them when they wear lying in the car waiting for the ambulance so you neavor really can trust most people.

"someone" (we are actually 95% sure of who did it, a coke head) stole 80 bucks from the cash drawer at Dairy Queen sunday night... the rest of us who were also on that drawer are quite peeved as part comes out of our checks for it... I hate druggies who steal...

In some ways, as mentioned indirectly, online banking is safer. YOU initiate the transaction over a secure link, YOU can immediately see the result and YOU can look at your account anytime. No minimum wage, bad attitude teller necessary. Or course if you store your password on the machine and operate poor judgement, going to the bank won't save your butt from idiocy anyway. Like this joker from symantec. I would also consider online credit transaction much more secure that one's conducted in person.

Quote:

---

Originally posted here by c0br4
Anyway I was just saw some TV program about this kind of thing... and they had a security expert in from symantec, that said "He would never use online banking, and that you could ask anyone who knows anything about computer security and they would all say the same" so I thought I would put that to the test.

---

hrm, I find it interesting that a Symantec representative would say that when several of their largest clients are banks that have an online division. Maybe that attitude is why they lost our business ;)

I work in that industry and I would trust my information going across the wire, as long as it wasn't a "public" machine (from say a library) and it was a machine that I had secured locally. We, and the FDIC, take security very seriously. The fricken audits we go through are unreal and are more than anything I have seen in the past. VISA CISP is no joke either.

I have seen the cusomters computer as our weak point from day one. I have locked this network down pretty tight, and I'm constantly tinkering with it to make it more difficult to get in to and a harder target so that cyber criminals stay away from us. The problem is the client computers that aren't secured but still connect to us are riddled with spyware, adware, malware, viruses, etc. They are a gateway for mischief but fortunately that mischief can only happen on a single account and not everyone on our networks.

I happen to have a creditcard which I use for online transactions, but I have also made sure that I have a very low limit on this card so I can't pay for extremely expensive stuff with it. I need it anyways because I live in the Netherlands but like to order DVD's, software and books from the USA and UK. (Especially some good computer science/programming books are hard to get here.) However, I do these purchases only with amazon.com and not many other online businesses. (And if I do want to pay on another site, I make darned sure that this is a reliable company!)
Of course, I won't even enter my creditcard data on any site that has an invalid certificate or if it doesn't use SSL to keep my data safe. And I don't use any wireless/public connection either.

For normal banking, I use an application called Girotel for the Postbank. It's a pretty old application and it doesn't connect to the bank over the Internet but uses a direct dial-up connection to a local phonenumber. Okay, so I have to pay for a few phoneticks when I update my bank data but hey, I consider this pretty reliable.

And about Symantec... Well, it's a security company. They profit only as long as people live in fear because they sell stuff so people can calm down their fears. Symantec is actually making a profit from all those viruses, worms and hacker attacks, so you can seriously doubt their motives. It has even be suggested many times that these security companies are actually spreading around viruses themselves to scare people into buying their products.
Then again, it is also rumoured that the people behind RIAA are spreading around those worms that infect all those P2P networks, in an attempt to take them down and stop the spread of MP3 files through these channels.
There could be a valid point in all this too. A large company like Symantec or a large organisation like the RIAA could easily transfer a large sum of money to some Eastern European country and use it there to pay some hacker to develop some of these nasties for them.

And I am wondering why Windows seems to be the only target for all these security leaks. Well, okay. The Unix/Linux/BSD/Mac systems do also have their share of security problems but they are almost nothing compared to Windows. Is Windows targetted simply because it's such a big target or because there's so much profit to be made from it by selling security measures to all those users?

The LiveCD isnt a new idea, In australia a bank (sorry can't remember which one) started mailing out LiveCDs with the intention that all customers use them to do there online banking, this must of been at least a year ago.

Im not sure how well this technique would work with dialup users, as the majority will have winmodems incompatible with linux, however i suppose the people that at technically savvy will be the ones with DSL so there will be less compatability issues, Or maybe broadband is more widely used over there.

Check out Knoppix, or damn small linux, Im in the process of creating my own - although ive got my plans just havent started them yet!

i2c

I'v got a funky RSA gizmo that when ensures security, atleast from password snoops, since the password is always different. However, I belive the connection is only 128bit RSA or DES (not exactly sure), which is kinda disapointing. Was hoping for atleast 2048 RSA :D

First off, about putting your SSN on your resume, I once applied for a job at the Dept. of Defense, I could only submit my resume electronically and the firsth thing they required was your SSN be at the top of each page.


About online banking: It is kind of silly for people to think that because they do not bank online that their financial security is indeed more secure. More and bank move their operations online, and just because you do not personally log into the site, your info is still bounced around out there whether you like it or not.

As was said in many other posts, if you are not stupid about online banking, ie easy password, public terminals, etc. You should be ok, or as safe as the bank's security

I use online banking. IMO the security levels are about the same as if you don't use online banking i.e. you could be so unlucky, but usually you aren't.

In fact, my parents were defrauded through a computer leak and they don't use online banking. The reason - an insider job on a list of names, addresses and card pin nos.

The other problem is the ol' hole in the wall jobbie where the machine is rigged up (if you are really 'good' you also carry out a DOS on any other ATMs in the neighbourhood) to read card details. But then the same thing can be accomplished via shoulder surfing.

Finally, someone can good old fashioned nick your card and do a cash back on it. Chip and pin doesn't stop it as you simple dunder the card and then the details are entered manually (no shop will willingly turn away a customer).

and good old fashioned dumpster diving still works in some stores who haven't updated their card systems to **** out card numbers. Though the ****ing doesn't work so well if you know the calculation method (i.e. it reduces the number of possibilities).

as does mugging.

The best thing is to take some key precautions. Here are some suggestions. Pick out two or three that fit depending on the appropriate threats

1. Carry as few cards as possible around (mugging)
2. Choose a company which gives insurance against identity theft (if you do all your business online)
3. Agree with your bank that you have to physically sign to any direct debit agreements (if you get lots of spam mail and phone calls)
4. Check your accounts and question any oddities (everyone)
5. If you think anything is wrong at all, cancel the cards and transactions instanter. A good reason for banking online as you can cancel 24 by 7. (everyone)
6. Be prepared to forego $100 worth of liability (banks won't accept all the blame even if it is all their fault). (everyone by default)
7. Don't buy online from sources that don't check out (ebayers watch out)
8. Check out which restaurants/stores have updated their card systems (if you buy a lot on credit)

I am sure there are more.

Quote:

---

Originally posted here by Noia
I'v got a funky RSA gizmo that when ensures security, atleast from password snoops, since the password is always different. However, I belive the connection is only 128bit RSA or DES (not exactly sure), which is kinda disapointing. Was hoping for atleast 2048 RSA :D

---

Eventhough you were semingly kidding, you're confusing the key exchange and data exchange encryption phases:
- the key exchange phase uses public key (aka asymetric) crypto (RSA, DH, DSA, Forezza) which require at least 1024bits to be considered secure*.
- the data exchange phase (ie: the encrypted http conversation for example) uses symetric crypto (RC2, RC4, IDEA, DES, 3DES, AES ciphers) which require a lesser bit length, 128bits being generaly considered secure*...


*For now!


FYI: http://en.wikipedia.org/wiki/Key_length


Ammo

I wasn't confusing anything, all I stated was that I used an electronic device to produce my password, this device is syncronized with the bank and always yealds different passwords, making it useless to catch the key exchange. On another note, I belive it is acctualy a triple DES implementation that is used, althought I can't be certain, will have to look into that when I log on again.

Quote:

---

Originally posted here by ammo
Eventhough you were semingly kidding, you're confusing the key exchange and data exchange encryption phases:
- the key exchange phase uses public key (aka asymetric) crypto (RSA, DH, DSA, Forezza) which require at least 1024bits to be considered secure*.
- the data exchange phase (ie: the encrypted http conversation for example) uses symetric crypto (RC2, RC4, IDEA, DES, 3DES, AES ciphers) which require a lesser bit length, 128bits being generaly considered secure*...


*For now!


FYI: http://en.wikipedia.org/wiki/Key_length


Ammo

---

I wasn't refering to your SecureID token (I co-manage ours at work so I know what they are) but only to the key sizes / ciphers you mentionned were used for the connection...

If your browser showed 128bit encryption being used (padlock icon mousover), it was most likely an RC4 cipher or AES-128. But that's only for the data exchange phase which implies a symetric cipher. It doesn't tell you what key exchange asymetric cipher/length was used; for that you have to check the certificate's key. Most of the time, a 1024bit RSA key is used (with SHA-1 for signing).


Ammo

I'm a big fan of online banking myself. I do everything online nowadays -- banking, credit card, cell phone account management -- I feel more secure because it allows me to keep a constant vigil on exactly what's going on. Nothing can happen on my account without me seeing it. And I advise that if you do do it online, do it at least daily so that you'll catch any possible discrepancy that can occur. You better watch it like a hawk.

However, I only check my accounts from one of two places -- My main home computer or my office computer, both of which I keep locked up tight and secure (though I haven't thought about keeping an eye on the hosts file -- thanks TigerShark). I also make sure I use complex passwords.

However, I have to air one complaint: Most websites don't allow for complicated enough passwords yet. You have the "please keep it within 6-8 characters" rule, which is bad news in my eyes. What does that mean? No passphrases. We'd be much better off with nice, long passphrases, especially since most password crackers can handle anything under 10 characters nowadays. When's the rest of the world gonna catch up?

AngelicKnight....

Government regulations on password length are a bit behind and spending a shirt load of money to modify existing systems to support 15 characters may take a while. Not to mention increasing comlexity increases calls to telephone centers with pissed off customers who cannot access their accounts so you run the risk of mis-identifying someone in the essence of time to restore versus complex verfication that may take an hour or two to verify. ;)