« Normal services resumed | Main | Microsoft pays to hear how secure it is »

March 23, 2005

Bank hacking - it's easy

Something else to think about as you contemplate the convenience of online banking. Jeremy Wagstaff just sat in on a presentation by a man whose job it is to try to hack into banking sites, for the banks.

Says Jeremy: "Of 15 banks’ application assessments he worked on in the past 18 months he found 258 vulnerabilities, 429 beta quality scripts, 339 unnecessary files, averaging 17 vulnerabilities per application."

And the presenter had a chilling quote for you to contemplate: “Nobody will be using Internet banking anymore. If you do just make sure you don’t have much money online.”

Posted by cw at March 23, 2005 10:58 PM

Comments

Interesting, if one goes to the site of the Banking and Financial Services Ombudsman there is almost nothing immediately obvious on internet issues. The case studies listed as a guide to disputes do not include internet fraud and disputes over it. There are examples of unauthorised credit card transactions and disputes over ATM withdrawals but that's the closest it comes.

A site seach for "internet banking" just brings up a series of basic advice statements such as one would receive from any bank. There is nothing regarding rights and responsibilities of banks towards consumers.

The ombudsman's legal status is not clear, but he appears to be more an outgrowth of bank self-regulation than government regulation. In the terms of reference section it is noted that the ombudsman can be overruled by any staturory ombudsman, so we can take it he isn't.

On another tack it could be the banks are reluctant to say much for another, less venal, reason than Charles suggests. Because if it was revealed they would settle most claims of internet fraud this would be another incentive for small time attempts to defraud them by claiming one didn't know one had been compromised. Then again, maybe that's wishful thinking on my part re motives of banks.

Basically it would interesting to know how many disputes a year go to the banking ombudsman over internet banking. The breakdown I got from the site referred only to 22.5% of disputes in 2004 being about "deposit accounts". The annual report for 2004 does note increased interest in the sector by ASIC, hopefully internet banking would be part of this. Someone else who has looked, or has the time to look, might know something about what's on ASIC's agenda. Or it could make a useful story... Something for the AFR perhaps, are you interested Charles or should I have a go?

Posted by: tflip at March 24, 2005 01:47 PM

teach me to hack banks thank you

Posted by: buingoctung at March 18, 2006 12:31 AM

Post a comment




Remember Me?



(you may use HTML tags for style)