key: 2010-attacking-online-banking
type: techreport
title: Forgotten your responsibilities? How password recovery threatens banking security
authors:
  - Ben Smyth
year: 2010
month: 4
number: CSR-10-13
institution: School of Computer Science
address: University of Birmingham
listed: false
description: >-
  This article demonstrates how online banking systems offered by the Lloyds Banking Group and the
  Royal Bank of Scotland Group can be exploited for fraud.
keywords: >-
  Lloyds Banking Group, Royal Bank of Scotland Group, Bank of Scotland, Halifax, Natwest, Royal Bank
  of Scotland, Ulster bank, online banking, usability, financial fraud, financial privacy, security,
  credential recovery mechanisms, software engineering failure, attack, exploit, online banking
  security
abstract: >-
  The online banking systems offered by the Lloyds Banking Group (including Bank of Scotland &
  Halifax) and the Royal Bank of Scotland Group (including Natwest, Royal Bank of Scotland &
  Ulster bank) are vulnerable to a remote attack which allows an adversary to commit financial
  fraud. The vulnerability has arisen as a result of poor software engineering practice which
  neglected security in favour of usability. More precisely, authentication systems are coupled with
  credential recovery mechanisms to permit the authentication of customers whom have forgotten their
  credentials; these secondary authentication mechanisms are insecure due to their reliance on
  publicly available information. In addition, the attack allows the financial privacy of customers
  to be compromised. These failures are particularly interesting to the design of online banking
  systems and legal cases in which customers are found liable for fraud. In these cases banks may
  refuse refunds and assert negligence, or blame the customer for fraud. The attacks presented in
  this paper may help explain false accusations of liability and help introduce public policy
  changes which force banks to be held accountable for systems which they have designed.
video:
  youtube: BHmv_0p_Nqo
  text: Video demonstration
extra: >
  <h2>Media coverage</h2>

  <p>

  This article has been discussed by <a
  href="http://www.dailymail.co.uk/money/article-1296326/How-safe-current-account.html">The Daily
  Mail</a> (<a href="/files/Smyth10-attacking-online-banking-Daily-Mail-coverage.pdf">local
  cache</a>).

  </p>
links:
  - file: Smyth10-attacking-online-banking.pdf
    text: Technical Report
  - url: http://www.youtube.com/watch?v=BHmv_0p_Nqo
    text: YouTube video
  - url: /2010-iTunes-podcast/
    text: "Podcast: Five ways to stay safe when using iTunes"