3

I follow a few infosec-related Twitter personalities: Paul Moore, Taylor Swift, Troy Hunt are the main 3. Paul Moore is currently in the process of switching banks, frequently tweeting and retweeting about how insecure these banks are:

  1. crazy low password requirements (no symbols allowed, low max length are the biggest 2);
  2. buggy TLS implementations (article from Troy Hunt: http://www.troyhunt.com/2015/05/do-you-really-want-bank-grade-security.html), with many banks failing on stuff like Forward Secrecy, SHA-1, RC4 and TLS 1.2;
  3. weird password verification methods that usually prove that they're not hashing passwords (like asking for 2 specific characters from a password);
  4. weird ways to transfer account credentials (like asking a DM on Twitter, or support people giving your new credentials over the phone).

I realize that not all banks have these issues (for example, Belgian banks don't use passwords at all, instead requiring you to access E-banking through a card reader with your debit card, and most of them have appropriate TLS), but it does look like quite a few banks have at least 2 of these issues, and when called out on them, they act like it's not a problem. Meanwhile, we trust these companies with our money.

Why do so many banks have one or more of the above issues? I realize some of it is due to legacy requirements, but it can't all be because of outdated interfaces?

  • "like asking a DM on Twitter" What is a DM? – Jacques Jun 19 '15 at 19:57
  • @Jacques Direct Message: about.twitter.com/directmessages – schroeder Jun 19 '15 at 19:59
  • 1
    Taylor Swift is an infosec-related Twitter personality? – Justin Lardinois Jun 22 '15 at 3:20
  • @JustinLardinois There is an infosec-related Twitter account called [at]SwiftOnSecurity. It's obviously not the singer herself, but the account owner uses the fame of the pop star to create something you can call a parody. – Nzall Jun 22 '15 at 12:00
  • @NateKerkhofs you learn something new every day. – Justin Lardinois Jun 22 '15 at 17:28
10

The basic reason is because despite all these issues they don't regularly suffer breaches or theft enough for it to be a market differentiator.

Weakened passwords still fend off most online attacks against customer accounts when paired with their system lockouts, multi-factor authentication, and other intrusion controls. Most banking customer passwords are stolen through trojans on their systems, which work regardless of password strength.

Similarly with weak SSL/TLS implementations there are only a limited number of attackers in a position (e.g. network access and computational resources) to take advantage of it to steal customer accounts or money.

At the end of the day banks are in business to make money. They aim to implement enough security to avoid losses and regulatory punishment. In some cases they are limited by what they can do by legacy systems, but most would never be on the cutting edge of security practices regardless because it doesn't add much value.

This isn't to say every bank's security is where it needs to be, just that they tend to secure areas that cause them problems and may wait until those problem actually emerge to fix them.

1

They have little incentive to do so.

  • They have insurance policies covering the frauds. If the cost of fixing X hole is bigger than the fraud loses, they may not be too motivated in fixing it.

  • There's no legislation forcing them to support those technologies (Forward Secrecy, TLS 1.2, etc)

  • There's no pressure from the users to better ways, and so they can ignore a few voices quite easily.

Luckily, not all banks are like that, but I think it explains quite well why some act that way.

Plus, it's possible that their experts don't know/care about X or hold a different opinion (in the security field there are differences on how to consider some features).

About the points you mention:

crazy low password requirements (no symbols allowed, low max length are the biggest 2);

This is not justifiable IMHO.

buggy TLS implementations (article from Troy Hunt: http://www.troyhunt.com/2015/05/do-you-really-want-bank-grade-security.html), with many banks failing on stuff like Forward Secrecy, SHA-1, RC4 and TLS 1.2;

Updating anything is really hard on institutions like banks. They use old versions, and supporting newer protocols (ie. updating) is hard to do. (Lots of testing and preparation)

weird password verification methods that usually prove that they're not hashing passwords (like asking for 2 specific characters from a password);

This is not necessarily bad if well-designed. It allows an attacker that managed to rob the request (through a phishing, usually) not to obtain the full credentials. I wouldn't recommend it for your CMS, though.

weird ways to transfer account credentials (like asking a DM on Twitter, or support people giving your new credentials over the phone).

That's weird, indeed.

1

Banks are not places where creativity is rewarded, or where change is part of the culture. In addition, the financial industry isn't well known for treating employees well, so talent tends to leave.

For these reasons, banks operate like dinosaurs. They don't have to innovate, so they don't.

I wouldn't be too sure that breaches don't occur, since the banking industry is also known for extreme secrecy as well.

Not the answer you're looking for? Browse other questions tagged or ask your own question.