From every third online bank you can steal money

From every third online bank you can steal money

 

The share of financial applications in which critical vulnerabilities are encountered decreased in 2016, but the overall level of risk of identified vulnerabilities has become much higher. The most common defects were the mechanisms of identification, authentication and authorization.

Such conclusions are contained in the report on the basis of work on the analysis of the security of financial applications, which were conducted by experts of Positive Technologies in 2016.

As noted in the study, the popularity of electronic financial instruments in Russia over the past year has increased significantly due to the development of contactless payment systems: to the already familiar PayPass and payWave NFC-payment technology with the help of smartphones - Apple Pay and Google Wallet. However, the security of publicly available web and mobile applications in the financial sphere still leaves much to be desired, since such applications are characterized by all the vulnerabilities and threats known in the field of application security. In the case of banking applications, the implementation of threats leads to serious consequences - including theft of funds, unauthorized access to personal data and bank secrecy, and reputational losses for business.

In particular, the study showed that in 2016 the share of critical vulnerabilities of financial applications increased by 8%, and the share of vulnerabilities of the average level of risk - by 18%. At the same time in productive systems, there are almost twice as many vulnerabilities as in systems under development. And financial applications developed by vendors, on average, contain twice as many vulnerabilities as those developed by banks independently.

Most online banks (71%) have shortcomings in the implementation of two-factor authentication. 33% of online banking applications contain vulnerabilities that allow them to steal money, and in 27% of applications, an attacker can gain access to information that constitutes bank secrecy.

As for mobile banks, in every third application you can intercept or pick up credentials for access. Banking iOS applications are still safer than their counterparts for Android.At the same time, server parts of mobile banks are protected much worse than client ones: high-risk vulnerabilities are found in each system studied