Man-in-the-Middle Flaw in Major Banking, VPN Apps Exposes Millions

Man-in-the-Middle Flaw in Major Banking, VPN Apps Exposes MillionsNew research from University of Birmingham emphasizes importance of securing high-risk mobile apps.Researchers from the UK have uncovered a serious vulnerability in the way nine banking and VPN apps handle encrypted communication that puts tens of millions of users at risk of man-in-the-middle (MitM) attacks. Among those impacted are two of the largest global banks – Bank of America and HSBC – as well as one of the world’s most popular VPN providers, TunnelBear.
“Our tests find that apps from some of the world’s largest banks contain the flaw, which if exploited, could enable an attacker to decrypt, view and modify traffic – including log-in credentials – from the users of the app,” write Chris Mcmahon Stone, Tom Chothia, and Flavio Garcia of University of Birmingham, who detailed the discovery in a paper released yesterday.
The findings came as part of a study involving a new blackbox automated-testing mechanism the team came up with to find applications that implement TLS certificate-pinning but fail to verify the hostname, leaving them open to MitM attacks. Dubbed Spinner, the tool uses the Censys Internet scanning engine to scale up what has in the past been a costly, manual process to check. As a part of the release of their paper, the researchers also released Spinner under a Creative Commons License.
The initial discovery of the nine applications came by way of a study using Spinner of 400 iOS and Android applications. All of this sample set control a high degree of sensitive data or transactions, including banking, stock trading, cryptocurrency, and VPN apps.
This latest discovery shines new spotlight on the risks posed by insecurely developed and implemented mobile applications. The stakes are growing for mobile apps, as they’re increasingly leveraged for high-risk and high-value transactions in finance, healthcare, manufacturing, and other areas. Unfortunately, the culture and maturity of appsec practices within the mobile app development field has not kept up with the growing risk profile of these apps.
Just last week, High-Tech Bridge released a study that showed among the top 30 cryptocurrency apps on Google Play with 500,000 installations or more, 94% contained at least three medium-risk vulnerabilities and 77% contained at least two high-risk vulnerabilities.

In a good news-bad news analysis of the situation, Ilia Kolochenko, CEO of High-Tech Bridge, explains that vulnerabilities like the one University of Birmingham researchers found and his own team found are still not as alluring as other lower-hanging fruit.
“In most of the cases, exploitation of a mobile app vulnerability requires some pre-existing conditions, such as an already installed malicious app on the same device or attacker’s access to the victim’s data channel” such as public wi-fi, Kolochenko says. “All of this makes mobile apps a not-very attractive target for cybercriminals, who would rather target the mobile backend.”
As he explains, the bad news is that mobile app vulnerabilities are just the tip of the iceberg in terms of mobile risk exposure, as attacks against APIs and Web services are easier for attackers to scale and just as prevalent in the deployment of mobile apps. The firm’s study found that 77% of cryptocurrency applications did not have any hardening or protection of their backend. This isn’t just a cryptocurrency app problem.
It is rampant elsewhere: The sloppy level of care with APIs was in clear evidence with a different report published by researchers with Appthority a few weeks ago. They found a vulnerability where a contingent of developers using the Twilio REST API or SDK were hardcoding credentials in mobile apps: Appthority found 170 apps in official app stores were affected by the vulnerability, with millions of users at risk in that case.
It’s a disconcerting trend given the increase in mobile banking. Take Bank of America, which was one of those affected by this latest vulnerability. Mobile banking is increasingly a lynchpin of its future strategy, with mobile usage among its customers growing 19% year-over-year, and traffic at its financial centers dwindling by 4%. At this point, nearly a quarter of all of its deposits are now made through mobile devices, according to recent reports.
Related Content:
New BankBot Version Avoids Detection in Google Play — Again
要实现完整的云安全,除了加强云计算服务基础架构和应用平台的安全之外,更重要的将安全整合进业务应用链条的各个环节,客户端方面,终端设备的安全和用户的安全意识同样重要,在通讯方面,对敏感数据,需提供端到端的加密。
Samsung Pay Leaks Mobile Device Information
Companies Blindly Believe They’ve Locked Down Users’ Mobile Use
10 Steps for Writing a Secure Mobile App
网络安全公益短片个人信息保护实战
 
 
为了提升工作效率,减少不必要的重复登录,提升账号的安全性,我们部署了单点登录解决方案,让所有Web应用系统共享一个身份认证系统,同时为了防止单点故障,我们使用了多个认证服务器,互相交换或同步用户信息。

猜您喜欢

网络安全概念股快速走强 卫士通涨超3%
网络安全意识动画片展播个人隐私保护及信息安全意识基础
网络安全法实施宣传
辽宁一学生作业一字没写 被老师一脚踢到肾出血
EDUCATION2U CELEBSWITHOUTEYEBROWS
移动金融服务中的信息安全问题实录