False security: Is Bank of America lying to its customers?
A bank that guarantees its online users safety and security has direct evidence that its Web-based banking system may not be 100 percent bullet-proof.
Should that bank tell its customers? And if it doesn't, is it misleading, or even worse, lying, to them?
Bank's logo
(Credit: BofA)Bank of America, like many other financial institutions in the U.S., has jumped on the "two-factor" authentication bandwagon. Instead of having its customers log in with just a user name and password, these new schemes require some third bit of information.
Some banks choose to issue their customers a cryptographic hardware token (a keychain with a digital display that spits out a new random number every 60 seconds). Others, especially those banks with less profitable customers, have opted to instead adopt software solutions. The advantage of this, of course, being that they don't have to spend any money to send widgets out to their customers.
BofA's SiteKey two-factor authentication system is essentially a rebadged version of the PassMark system sold by RSA/EMC. Other banks that have licensed the technology include Pentagon Federal Credit Union, Vanguard, and U.K.-based bank Alliance & Leicester. Users of SiteKey and similar systems select a graphical image and phrase, which are then displayed to them every time they login to the Bank of America Web site from "trusted" computer (that is, one that BofA has seen before).
According to Bank of America's own numbers (PDF), over 21 million customers use their online banking system. BofA's Web site promises customers that the SiteKey system will keep them safe, stating: "You know it's really us--when you see your SiteKey, you can be certain you're at the valid Online Banking Web site at Bank of America, and not a fraudulent look-alike site. Only enter your Passcode when you see the SiteKey image and image title you selected."
How SiteKey Works
(Credit: Bank of America)The problem is that all of these schemes--every single one of them--is vulnerable to a form of deception known as a man-in-the-middle (MITM) attack. Russian phishers launched a sophisticated MITM attack against the hardware-token-based, two-factor authentication scheme used by Citibank. Another group of hackers was able to rip off customers of the Dutch bank ABN Amro, which also issued hardware tokens.
On multiple occasions in 2005 and 2006, security researchers raised the alarm regarding the false promises of two-factor authentication, and in particular, Bank of America's SiteKey system. Finally in April 2007, Professor Markus Jakobsson and I announced a working demo of a successful man-in-the-middle attack against SiteKey. Based on advice from lawyers, we did not release an easy-to-use version of the system, nor were we able to provide access to the demo to others online. To provide the factual support for our claims and to demonstrate how relatively easy such an attack would be to perform, we released a screen-captured video of the demo, as well as source code that would allow an advanced user to download the SiteKey image from any remote, untrusted machine.
Our demo got quite a bit of press attention, with mentions in The Register, ZDNet and The Washington Post. One of the main points we tried to make when we put our demo online is that Bank of America is promising its customers something impossible. By telling users that the SiteKey image guarantees they are visiting BofA's Web site--and not a phishing page--Bank of America is giving its users a false sense of security. Were BofA to instead acknowledge the risks of phishing and man-in-the-middle attacks, users might be more cautious when logging into suspect Web sites.
Shortly after we released the demo, Louie Gasparini, chief technology officer for RSA's Site to User Authentication group was interviewed by Brian Krebs at The Washington Post. He said that our attack demo "overlooks a number of back-end technologies that financial institutions use to detect fraudulent transactions."
"What they're critiquing is just the most visible piece to this technology," Gasparini added. "There is a whole bunch of risk management and fraud detection that goes on behind the scenes so that even if a user's account does get compromised, the bank can still protect that person."
Gasparini's comments mirror those of Betty Riess, a spokeswoman for Bank of America with whom I chatted on Tuesday. Reiss made it a point to mention that SiteKey is just one part of BofA's multipronged approach to security. However, she declined to comment further when specifically asked if the text on the SiteKey page is misleading, or if Bank of America has a responsibility to be honest with its users about the risks of man-in-the-middle attacks.
Customers expect some companies to lie to them. Very few people expect cosmetics and skin creams to actually make them look 20 years younger. Likewise, few would be surprised if the salads at fast-food restaurants are actually full of calories and fat. However, when a bank tells its customers that its online banking system is safe and secure, most people would be shocked to find out otherwise. Thus, a major question remains: Is Bank of America lying to its customers when it tells them that they can be "certain (they're) at the valid Online Banking Web site" when they see the SiteKey image? Do banks have a responsibility to acknowledge the risks, and to inform consumers of them?
Watch our video of the man-in-the-middle attack against the SiteKey system, read Bank of America's promises of safety and security on its Web site, and decide for yourself.
Christopher Soghoian delves into the areas of security, privacy, technology policy and cyber-law. He is a student fellow at Harvard University's Berkman Center for Internet and Society , and is a PhD candidate at Indiana University's School of Informatics. His academic work and contact information can be found by visiting www.dubfire.net/chris/. He is a member of the CNET Blog Network, and is not an employee of CNET. Disclosure.
While I was not aware of this vulnerability, I've always thought it wise to verify ssl credentials on every page, every time I do business online - whether on BofA's site or any other commercial site.
And to be aware of what I need to do to take advantage of BoA's $0 liability policy.
http://www.bankofamerica.com/onlinebanking/index.cfm?template=security
Is BofA lying? IMO, that depends on what they do when a customer falls victim to something like this.
The whole idea behind keeping your money in a bank vs. in your mattress is that a bank is secure. The banks are FDIC insured for accounts up to $100,000.00 which is higher now due to the economy. The issue these days is that we are getting our identity stolen right at the bank. Here is an example below of one who had over 200 accounts opened up under his name and a huge amount of cash...yes I said cash taken out of his account without having to verify a valid ID.
What is the answer? Do we keep our money in the mattress? Do we make the courts do something? Tell me your thoughts.....
http://o8justiceforall.wordpress.com
The difference between the face cream and the BOA statement is that in the face cream example, the outcome is wholey objective as to whether or not a person will look 20 years younger. Whereas the out come of the BOA statement is mostly objective. You can prove the opposite. Even if it is 99.9% safe then the assertion is not true, as you may have proved. However the problem for banks is that how much does it cost to get the extra .09999% reliability?. Then again that is what insurance is for.
This isn't a "bandwagon." It's now legally required that banks have two-factor authentication. There are a number of different types, but one of them must be used.
A guarantee is totally different from a marketing claim - it is dependent on the bank's actions in the case of a failure of their OLB security. You didn't provide any links, and maybe B of A does not state it explicitly, but I'm reasonably sure that they would make whole any customer who loses money due to a MITM attack that compromises its SiteKey.
The Government is balling out the banks for 700 Billion without investigating enough. The people who are losing their jobs and home needs the money, not the banks!
CAN SOMEONE PLEASE HELP ME? AS WELL AS OTHER VICTIMS BY THE BANKS.
It all started, in February 2006, with a not reported bonus of 200,000$ to my bookkeeper of 20 years has turned into a missing of hundreds of millions dollars in art, wine and cash by former trusted employees and Bank of America refuse to help me. In search for answers, I have begged my bank, Bank of America which I am client for over 15 years, to provide my complete file, canceled checks, deposits, withdrawals, interest earned, monthly statements, signature cards and corporate resolutions among others, for almost 3 years beginning February 2006 but to this day I have receive almost nothing.
After 5 subpoenas served on Bank of America I still do not have my documents. The officer of the local Bank of America has responded, on three different declarations under oath and penalty of pergery turned over everything but breach these declarations by continuing to produce documents in between each of them which is against the law. IS BANK OF AMERICA ABOVE THE LAW??? They have permitted cash withdraw in millions by others from my accounts and permitted opening of accounts in my name without my knowledge. Over 25 accounts were unknown to me until June 2008. How could Bank of America do this? Is this the consequences of corruption? Or a major cover up?
I am still without answers and the bank continues to withhold my complete files. All my rights are violated and the Government must do justice. There are hundred millions of dollars missing from my accounts. I believe only the Government can force them to comply. For almost three years, I have requested, by writing, the IRS to help me on this matter and to audit me but I have not yet received an answer.
PERHAPS, NOW, SOMEONE WILL FINALLY LISTEN!
IS THIS DONE TO ALL THEIR CLIENTS?
http://o8justiceforall.wordpress.com/2008/12/15/bank-of-america-are-they-above-the-law/
from steven in san francisco
http://blog.wired.com/27bstroke6/2008/02/bank-of-america.html
What I find absolutely disgusting is that they are being bailed out yet again buy us ...the tax payer....not like the media...the government said it is a "government" bail out....who do they think pays for the government?
Do a search on Google for Bank of America identity theft you will find over 600 thousand hits as I did. They are not only pulling the preverbial wool over the consumers eyes they are even suing customers who have had their identity stolen through Bank of America...What judge is allowing this?
http://digg.com/business_finance/Bank_Of_America_Sues_ID_Theft_Victim_For_23_312_04_2
I have another case below where they "Bank of America" has allowed over 200 accounts to be opened under one person without so much as verifying to the real person that this was them through signature card, valid ID or anything....
http://o8justiceforall.wordpress.com/
So what is the customer supposed to do?
IF BANK OF AMERICA STOCK FALLS BELOW $5 PER SHARE, RULES OF INSTITUTIONAL OWNERS MAY REQUIRE THEM TO SELL THEIR BAC HOLDINGS. THE OTHER DAY THE STOCK CLOSED AT $5.10, APPARENTLY REFLECTING THE SCRAMBLING BY SOME TO SUPPORT THE STOCK PRICE.
ACCORDING TO TEH "SHORTSQUEEZE.COM" WEBSITE, 44.10% OF BAC IS HELD BY INSTITUTIONAL LENDS. WHILE SOME DO NOT HAVE THE $5 PER SHARE LIMIT RULE, THE SELL OFF OF BAC COULD BE MASSIVE IF THE STOCK GOES BELOW $5, SENDING BAC PLUNGING TO GREATER LOWS.
BAC HAS TREATED ITS CUSTOMERS IN INAPPROPRIATE WAYS FOR A LONG TIME. FRANKLY, I WAS ONE OF THOSE CUSTOMERS LIKE MANY OTHERS ACROSS THE US. IF BAC FELL, DEPOSITERS WOULD TAKE A LOT OF THEIR MONEY TO LOCAL BANKS, BANKS WHO ARE IN FACT LENDING AND SUPPORTING THE US ECONOMY. IT IS TIME FOR BAC TO GO!!!
SHORT SELL IT NOW. WHILE THE ELECTION IS OVER, YOU CAN VOTE BAC OUT WITH YOUR DOLLARS. EACH ONE OF YOUR DOLLARS IS A VOTE. EVEN IF YOU CAN ONLY AFFORD TO SHORT SELL A FEW DOLLARS OF THE STOCK IT COUNTS.
REMEMBER OBAMA GOT ELECTED BECAUSE MANY OF US SUPPORTED HIM WITH JUST A FEW DOLLARS. VOTE BAC OUT TODAY
tell them, you will not reelect them unless they make these banks stop ripping off the American people. It's
only going to get worse, unless we stop them now. The greedy rich are rotting this country from within. The banks are the tools of the rich to wipe out the middle class. Wake up America
-
by swampmudrock
April 28, 2009 4:17 PM PDT
- I faxed them the last fax I will ever fax them today. I have never seen such unprofessional , heartless , incompitent behavior in my life , We started our refinance with Bank of America on January 15th it is now April 28 , they have changed the rules from the beginning , it cost us 450.00 dollars to begin the refinance knowing that if we refused the loan we would not see it again. They have raised the intrest rate lowered our asking payout we can understand that in these times that acceptable , told us we had to have a reserve of 3000.00 dollars in our account , that was an unexpected ball breaker what the hell if I could sit on 3000.00 I would not even bother to refinance, all this after the fact. We have had 4 different loan processors all of them asking us to fax the same information over and over agains , quick spoken messages for information on our answering machine asking for the same loan onfo , when we call bac k we can never get thru to the loan processor we have told them we can take no more 4 months of this hell is all I can take . If they did not hold all my accounts I would not pleep and tell the exactly what I feel. Its not that we do not qualify my wife and I have exellent credit scores we have a thriving floor buisness with 3 Lowes accounts have never missed one payment in 9 years with our Bof A mortgage. How can they sleep at night I do not know. So I have done my last fax game with them , I only wonder where all that personal loan information we have faxed them has ended up , We plan to pull all our 5 accounts out go to the nearest small town bank we can find and never ever look back. I only hope this letter may save someone the uneeded expense and heatache we went thru.
-
Reply to this comment
-
(15 Comments)