Major Banking Applications were Found Vulnerable to Hackers

Security experts discovered a critical vulnerability in major mobile banking applications that left banking credentials vulnerable to hackers.

A group of security researchers has discovered a critical vulnerability in major mobile banking applications that left banking credentials vulnerable to hackers.

The vulnerability was discovered by researchers of the Security and Privacy Group at the University of Birmingham, who analyzed hundreds of iOS and Android banking apps.

The experts discovered that several of them were vulnerable to man-in-the-middle attacks.

The list of affected banking apps includes Allied Irish bank, Co-op, HSBC, NatWest, and Santander.

An attacker sharing the same network segment of the victim could intercept SSL connection and retrieve the user’s banking credentials even if the apps are using SSL pinning feature.

The SSL pinning provides an additional level of protection against man-in-the-middle attacks, the certificate pinning is implemented to avoid detection of security solutions that use their own certificates to inspect the traffic.

“If a single CA acted maliciously or were compromised, which has happened before (see e.g. DigiNotar in 2011 [15]), valid certificates for any domain could be generated allowing an attacker to Man-in-the-Middle all apps trusting that CA certificate.” states the research paper.

Researchers found that due to the wrong implementation of the authentication process the apps were vulnerable to MITM attacks. The lack of hostname verification left many banking applications open to attacks because they were not able to check if they connected to a trusted source.

The apps fail to check that they connect to a URL having the hostname that matches the hostname in the digital certificate that the server exposes.

“Automated tools do exist to test a variety of TLS flaws. Lack of certificate signature verification can be tested for by serving the client a self-signed certificate, lack of hostname verification by serving a valid certificate for a different hostname, and lack of certificate pinning can be checked for by adding a custom CA to the device’s trust store. ” continues the paper.

“These tests have been shown to be effective at finding vulnerabilities in apps [10] and poor TLS certificate validation [5]. However, none of these tools can detect the possibility that an app will pin to the root or intermediate certificate used but fail to validate the hostname”

The experts created a new automated tool, dubbed Spinner, to test hundreds of banking apps quickly and without requiring purchasing certificates.

The tool leverages Censys IoT search engine for finding certificate chains for alternate hosts that only differ in the leaf certificate.

“Given the certificate for a target domain, the tool queries for certificate chains for alternate hosts that only differ in the leaf certificate. The tool then redirects the traffic from the app under test to a website which has a certificate signed by the same CA certificate, but of course a different hostname (Common Name),” continues the paper.

“If the connection fails during the establishment phase then we know the app detected the wrong hostname. Whereas, if the connection is established and encrypted application data is transferred by the client before the connection fails then we know the app has accepted the hostname and is vulnerable.”

The security experts with the help of the National Cyber Security Centre (NCSC) notified all affected banks that addressed the issues before they publicly disclosed their findings.

Use TeamViewer? Fix this Dangerous Permissions Bug with an Update

TeamViewer, the remote control/web conference program used to share files and desktops,  is suffering from a case of “patch it now.” Issued yesterday, the fix addresses an issue where one user can gain control of another’s PC without permission. Windows, Mac, and LinuxOS are all apparently affected by this bug, which was first revealed over on Reddit. According to TeamViewer, the Windows patch is already out, with Mac and Linux to follow on soon. It’s definitely worth updating, as there are shenanigans to be had whether acting as client or server:

As the Server: Enables extra menu item options on the right side pop-up menu. Most useful so far to enable the “switch sides” feature, which is normally only active after you have already authenticated control with the client, and initiated a change of control/sides.

As the Client: Allows for control of mouse with disregard to server’s current control settings and permissions.

This is all done via an injectible C++ DLL. The file, injected into TeamViewer.exe, then allows the presenter or the viewer to take full control.

It’s worth noting that even if you have automatic updates set, it might take between three to seven days for the patch to be applied.

Many tech support scammers make use of programs such as TeamViewer, but with this new technique they wouldn’t have to first trick the victim into handing over control. While in theory a victim should know immediately if a scammer has gained unauthorised control over their system and kill off the session straight away, in practice it doesn’t always pan out like that.

TeamViewer has had other problems in the past, including being used as a way to distribute ransomware, denying being hacked after bank accounts were drained, and even being temporarily blocked by a UK ISP. Controversies aside, you should perhaps consider uninstalling the program until the relevant patch for your operating system is ready to install. This could prove to be a major headache for the unwary until the problem is fully solved.

More than $60 Million Worth of Bitcoin Potentially Stolen after Hack on Cryptocurrency Site

Nearly $64m in bitcoin has been stolen by hackers who broke into Slovenian-based bitcoin mining marketplace NiceHash. The marketplace suspended operations on Thursday while it investigated the breach, saying it was working with law enforcement as “a matter of urgency” while urging users to change their passwords.

The hack was “a highly professional attack with sophisticated social engineering” that resulted in approximately 4,700 bitcoin being stolen, worth about $63.92m at current prices, said NiceHash head of marketing Andrej P Škraba.

NiceHash is a digital currency marketplace that matches people looking to sell processing time on their computers for so called miners to verify bitcoin users’ transactions in exchange for the bitcoin.

Troubles with the website over the past day or so drew alarm and complaints, with many bitcoin owners posting panicked comments on NiceHash’s social media accounts.

NiceHash said in a statement: “We understand that you will have a lot of questions, and we ask for patience and understanding while we investigate the causes and find the appropriate solutions for the future of the service.”

The price of bitcoin has surged to more than $14,668, gaining around $2,000 (£1,494) of value in a day according to bitcoin monitor CoinDesk. That compares with a value below $1,000 at the beginning of the year.

Online security is a vital concern for cryptocurrency marketplaces and exchanges, with bitcoins contained within digital wallets that have increasingly become a target for hackers as the number of bitcoins stored and their value has skyrocketed over the last year.

In Japan, following the failure of bitcoin exchange Mt Gox, new laws were enacted to regulate bitcoins and other cryptocurrencies. Mt. Gox shut down in February 2014 having lost approximately 850,000 bitcoins, potentially to hackers. Mark Karpelès, head of Mt Gox, went on trial in Japan in July, facing up to five years in jail under charges of embezzlement and the loss of $28m of user funds.

Breach at PayPal Subsidiary Affects 1.6 Million Customers

PayPal informed customers on Friday that personal information for 1.6 million individuals may have been obtained by hackers who breached the systems of its subsidiary TIO Networks. TIO is a publicly traded bill payment processor that PayPal acquired in July 2017 for roughly $230 million. The company is based in Canada and it serves some of the largest telecom and utility network operators in North America. TIO has more than 10,000 supported billers and it serves 16 million consumer bill pay accounts.

On November 10, PayPal announced that TIO had suspended operations in an effort to protect customers following the discovery of security vulnerabilities on the subsidiary's platform. PayPal said it had found issues with TIO’s data security program that did not adhere to its own standards.

An investigation conducted in collaboration with third-party cybersecurity experts revealed that TIO’s network had been breached, including servers that stored the information of TIO clients and customers of TIO billers. PayPal said the attackers may have obtained personally identifiable information (PII) for roughly 1.6 million customers.

Affected companies and individuals will be contacted via mail and email, and offered free credit monitoring services via Experian.

While it’s unclear exactly what type of data the hackers have gained access to, the information shared by PayPal and TIO suggests that payment card data and in some cases even social security numbers (SSNs) may have been compromised.

PayPal has highlighted that TIO’s systems have not been integrated into its own platform. “The PayPal platform is not impacted in any way, as the TIO systems are completely separate from the PayPal network, and PayPal’s customers’ data remains secure,” the company said.

The New York State Department of Financial Services (DFS), an agency responsible for regulating financial services and products, has also issued a statement on the incident.

“DFS is working with our regulated entity, PayPal, to investigate and address issues related to cybersecurity vulnerabilities identified at PayPal’s subsidiary, TIO Networks,” the DFS said. “We applaud PayPal’s rapid response to the matter, which put consumers and business clients first, and we appreciate their efforts to inform DFS, as required, in a timely manner. Events like these illustrate the necessity of DFS’s landmark cybersecurity regulation and underscore the strength and effectiveness of our strong state-based financial services regulatory framework, including for the fintech industry.”

TIO said services will not be fully restored until it’s confident that its systems and network are secure.

The Rising Dangers of Unsecured IoT Technology

As government regulation looms, the security industry must take a leading role in determining whether the convenience of the Internet of Things is worth the risk and compromise of unsecured devices.

Earlier this year, the Food and Drug Administration (FDA) recalled 450,000 pacemakers that are currently in use by patients out of fear that these devices could be compromised. Although the agency said there is not any reported patient harm related to the devices, the FDA is rightly concerned that attackers will exploit pacemaker vulnerabilities and have the ability to affect how a medical device works.

While this is perhaps one of the most potentially life-threatening examples of unsecured Internet of Things (IoT) security, it drives home the point that manufacturers are not building these devices with security as a priority. As IoT devices grow in popularity, seemingly endless security- and privacy-related concerns are surfacing.

IoT Malware: Alive and Well With more than 20 billion devices expected to be connected to the Internet over the next few years, it comes as no surprise that attackers are increasingly looking to exploit them. Large-scale events like last October's distributed denial-of-service attack targeting systems operated by Dyn, and warnings from security experts should have security professionals paying attention. But are they?

According to a recent Gartner report, by 2020, IoT technology will be in 95% of new electronic product designs. While this statistic demonstrates the success of IoT, it is also a precursor for alarm. As the adoption of IoT devices rises, manufacturers are competing to stay ahead. Creating cheap products quickly often means overlooking security and privacy measures.

In general, consumers need to have more control over privacy and how they use IoT devices (think of the pacemaker). Watches and other wearables, for instance, are good examples of devices that give consumers control. Users can turn them off, take them off, and customize them. However, other devices, such as your personal home assistant can, theoretically, always be listening, as when, according to a CNET report, a hostage victim was able to contact law enforcement through their Amazon Alexa device, despite the fact that Amazon says the technology doesn't support "wake-up" action calls to outside phone lines.

National Security Issue? The IoT Cybersecurity Act was introduced recently as an initiative designed to set security standards for the US government's purchase of IoT devices. In order to steer clear of stifling innovation, the government doesn't often insert itself into private sector manufacturing decisions. However, the proposed legislation signals that, at least in some quarters, IoT security is becoming a matter of national security. And, although this bill does not pertain to consumers, it is a step in the right direction by challenging manufacturers to prioritize IoT security and privacy in their engineering designs, and consumers, in their purchasing decisions.

At the end of the day, as consumers continue to embrace IoT technology, they should not have to sacrifice security and privacy for the convenience and enjoyment of a product and service. Instead, they should be able to decide how they use "things" and how they can control them. Until security and privacy measures are embedded in all devices, those of us in the security industry need to challenge ourselves by questioning whether the convenience is worth the risk and compromise of unsecured devices.