The homepages of several banks are available over http. Some have search engines linked to http.
This, it seems to me, makes their users trivially vulnerable to MITM attacks if they visit the bank over e.g. public wifi.
This, it further seems to me, means that bank account security is depending on “I hope they only access their bank accounts from secure home networks” <crosses fingers>.
It looks to me that for an outlay of (1) a wifipineapple or other Evil AP device and (2) a $fewhundred to pay someone to customise SSLStrip with fake versions of 3 or 4 specific bank sites, I can:
- Go sit in a shopping mall for a couple of days with the pineapple
- Collect entire traffic user<->bank
- Take over sessions and start making payments
i.e: easy-to-mitm-public-wifi + easy-to-spoof-http-homepage => easy to hack.
What have I missed—it can't be that easy and cheap to hack bank accounts, can it?
PS I raised a complaint with my bank and they called back to point out that the login page asks me to install https://www.trusteer.com/ProtectYourMoney (an IBM product) which apparently addresses this kind of attack by closing down the browser.
Also that I should not use the search engine to find their website. But I suppose once you've stolen a public AP, DNS poisoning is simple too