Banking application login leaks information

Question

My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:

• User visits the homepage of the bank.
• User enters their username and clicks login.
• If the username exists they are presented with their unique image and phrase, chosen by the user when they sign up to the online banking application. If the image and phrase are as expected, the user enters their password.
• If correct, the user is authenticated and has full access to their account, including viewing statements, paying bills, increasing/decreasing credit limits, etc.

The problem I find here is that if one knows the username of a user, they can enter this into the first stage and immediately be presented with the image/phrase combination for that account. An attacker could then easily use this information in a phishing attack against that user.

My question is:

Isn't this a large security flaw?

Addition: In response to the first answer I should add that upon providing a username which does not exist, the application responds with a "Please check the username provided" message.

Answer 1

Yes, this is flawed in two ways:

1. It allows an attacker to enumerate usernames simply by trying them and checking the response.
2. It allows an attacker to get your "secret" image using a non-secret piece of information. This amounts to absolutely nothing in terms of security, and is simply theatre.

On top of that, I can see another potential hole: the attacker may not even have to download the images. If all you require is a valid username, what's to stop the attacker from creating a phishing page that uses the same mechanism as the real site to retrieve the picture from the real bank's server?

The correct implementation would be to have two authentication tokens, and only show the image after one of them has been correctly entered. This is usually done via a password and "secret word", but you could equally use a strong second factor like a hardware token.

Answer 2

The idea behind this is that it prevents a simple static phishing attack so it does raise the bar to require slightly more complex code to build the phishing site. If done "properly" the image should not be the only image on the page and should have a randomly assigned ID. In theory, this makes it require more effort to phish the page, but doesn't add anything particularly meaningful from the security stand point since it doesn't actually prevent it from being done. In practice however, it makes a phishing site that does go through the effort to pull the image far more believable to users. There is a nice paper on the topic if you want further reading.

The bigger flaw is that such a system requires that a picture be shown for any valid username. They should be presenting a consistent image for any unused username so that information about valid usernames is not leaked. This is the far bigger concern. The image thing isn't really a concern in itself, since it doesn't hurt anything by itself, but the username issue is a huge increase in attack surface since it removes an entire unknown.

Answer 3

From the Wikipedia page that Rory McCune linked to:

A Harvard study found SiteKey 97% ineffective. In practice, real people don't notice, or don't care, when the SiteKey is missing, according to their results.

SiteKey is designed to prevent users from disclosing their login credentials to a phishing site. The rationale is that a phishing site wouldn't have the SiteKey info for a user. The obvious flaw in the design is that a phishing site can get the correct SiteKey info from the genuine site, then serve it to the user, "proving" its legitimacy. SiteKey is thus susceptible to a man-in-the-middle attack.

It also requires users to keep track of more authentication information. Someone associated with N different websites that use SiteKey must remember N different 4-tuples of information: (site, username, phrase, password).

Don't think I could have said it better myself. Bottom line, if your address bar doesn't turn green when you open your banking site's front page (a feature of most current browser versions indicating the site has presented a valid and highly-trusted EV-SSL certificate), then don't enter your credentials. Anything else the site can provide to you personally to prove its validity is way too easily spoofed.

Answer 4

I don't see how this setup would be more vulnerable to phishing attacks than other authentication schemes. This authentication method doesn't make phishing attacks easier, it may make it more technically challenging by forcing the attacker to take the step of visiting the site to get the pictures to display on their fake website, but that's something a skilled attacker would have no problem doing.

This isn't a good method as it doesn't improve the security of a user's banking, but it isn't less secure than simple username/password authentication.

Keep in mind if an attacker with the right skills has a someone's banking username and their email address chances are they have a good chance to orchestrate a successful targeted phishing attack no matter what the bank's countermeasures.

The main flaw here is that the site responds, as @mckiethanks says in comments, "Please check username" to unknown usernames. This allows an attacker a useful piece of information, ie the username in the first place. The smart way for the bank to design it would be to respond to every attempt with a set of pictures whether the username exists or not.