July 24, 2008
U. of Michigan Researchers: Bank Web Sites Open to Cyberthieves
More than three-quarters of bank Web sites are insecure, leaving their customers vulnerable to having their money stolen online or their identities compromised, according to a report by researchers at the University of Michigan at Ann Arbor. The report, to be released Friday at a computer-security and -privacy conference at Carnegie Mellon University, is based on an examination of 214 bank Web sites in 2006.
Among the problems the researchers identified were the following:
° Secure login boxes on insecure Web pages. A hacker could reroute data entered in the boxes or create a spoof copy of the page to harvest financial information.
° Putting contact data and security advice on insecure pages. An attacker could change an address or phone number and set up his own call center to gather private data from customers.
° Easily guessed user IDs and passwords. Some sites used Social Security numbers or e-mail addresses as user IDs.
“To our surprise, design flaws that could compromise security were widespread and included some of the largest banks in the country,” Atul Prakash, a professor of electrical engineering and computer science at Michigan, said in a prepared statement.—-Andrea L. Foster
Posted on Thursday July 24, 2008 | Permalink |Comments
Commenting is closed for this article.
Previous: U. of Illinois to Set Tuition for New Online Programs
Next: Cellphones May Endanger Your Health, Pitt Cancer Center Director Warns His Staff
Leslie Charteris got it right: “The castle with the most imposing drawbridge is usually guarded at the back door by a small sign reading ‘No admittance.’”
— Dan Jul 25, 08:26 AM #
What questions should I be asking my bank in order to ascertain if the banks I use have secure or insecure web pages?
— RJG Jul 31, 08:58 PM #