Researchers discover online banking security problem

August 10, 2006
A row of Apple computers at a cybercafe

Two researchers working within Cardiff University's School of Computer Science, Professor Antonia J Jones and Joseph R Rabaiotti, together with a third independent researcher Stuart P Goring, have today released details of a problem with HSBC's online banking system. The bank was informed of the issue prior to publication.

The researchers demonstrated (without in any way hacking, or even entering, the system) that the problem they observed, together with the illegal use of a keylogger (a device which records keystrokes and can later play them back), would in principle allow an attacker to gather all the necessary information required to enter any customer account.

HSBC and Cardiff University are now working together to address a number of issues raised by this research.

No illegal access took place during this research. It is generally assumed that to be in a position to prove that a gatekeeper system has a weakness one must have broken the law. However, the researchers were able to demonstrate that this is not the case. In this case they showed that by perfectly proper use of the system (a legal log-in which fails due to a typing error) and by intelligent observation one can logically prove a weakness without even passing the gatekeeper or entering the system. While they were able to do this because of a rather trivial problem, an interesting point of principle has been established and a significant loophole identified.

Professor Jones said: "What is truly amazing about this particular problem is that it apparently has not been illegally exploited for at least two years, during which time all user accounts were in principle open to the access procedure we describe.

"This fact alone raises some serious questions about the wisdom of having any sensitive system online and about online banking in general."

Source: Cardiff University

Explore further: Enhancing our soils' biodiversity can improve human health

Related Stories

Research defines 'sport shopping'

November 23, 2015

The finish line is in sight, the rush of victory just past the cash register, the trophy flung hastily into a shopping cart.

Scientists create malaria-blocking mosquitoes

November 23, 2015

Using a groundbreaking gene editing technique, University of California scientists have created a strain of mosquitoes capable of rapidly introducing malaria-blocking genes into a mosquito population through its progeny, ...

Using data to help police departments police themselves

November 23, 2015

Mark Iris is arming police departments around the country with a novel crime-fighting tool—advanced data analyses and potentially life-saving intelligence derived by a group of Northwestern University undergraduates.

Recommended for you

The ethics of robot love

November 25, 2015

There was to have been a conference in Malaysia last week called Love and Sex with Robots but it was cancelled. Malaysian police branded it "illegal" and "ridiculous". "There is nothing scientific about sex with robots," ...

No lens? No problem for FlatCam

November 23, 2015

How thin can a camera be? Very, say Rice University researchers who have developed patented prototypes of their technological breakthrough.


Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.