Dr. Erdal Ozkaya
Search
  • Home
  • About Me
  • Home
  • About Me
  • Home
  • Cybersecurity, Reviews, Financial Sector
  • Australian Banking Security (We need to improve as of 2012 )

Australian Banking Security (We need to improve as of 2012 )

Banking Security
Erdal2022-01-21T15:24:28-04:00

Australian Banking Security

Online Security is getting every day more and more important. It’s so common these days to implement secure password policies, which is at least 8 characters, with minimum 1 special character like @$# …. More and more cooperation’s taking care of Passwords  as nearly every day a new “hack incidents “ happens…

We all expect at least banks take care of secure password policies, beside SSL logins or Virtual keyboards. As I said “we expect” but its sad too see some of the banks are not meeting the minimum security requirements or at least our expectations or even the  ISO 27001 or PCI standards in terms of passwords.

This post is a  proof on how weak passwords polices are used in some of the Australian Online banking web sites. Yes , they do have SSL but knowing that these days SSL hacking is not “rocket science” , some of the PKI were compromised few times…

Sad smile

I have done a simple Pen testing via login to the SSL protected sites and entered manual passwords, and the result was shocking, at least for me 

My first example  is National Australia Bank (NAB)

1) Only 8 characters of Password is allowed

2) No special characters are allowed

image

Here is one more example from Westpac

They force users to use the “virtual Keyboard” but only 6 character’s of password is allowed!

image

My recommendation is do not trust your SSL too much and encourage your customers to use complex passwords, please

A special thanks for the Commonwealth and ANZ banks who has not just SSL, virtual keyboard but also 15 characters password selection choice.

This test will be continued, keep an eye more to come…

 weak passwords polices

The weak password policy finding is typically an indicator of one of two conditions during a test:

  • A password could be easily guessed using standard authentication mechanisms.
  • A password could be easily recovered after capturing crackable password hashes.

Password strength is a topic of serious contention within most of the organizations that we test.  There is a constant struggle between information security staff who want to protect the organization and the people who have to do the business that keeps it viable.

As IT and security personnel, when we ask employees to construct complex passwords, we usually end up with something like the following. As expected, we also get a similar response.

RHpntp6oIpPSRS vimvbFUd4meieMB1OUZoWuTpWXJ2DnPzxNPPUrczdAj 0gYquDYa8h9IaZyVLolmwQeSRedGIG3ZzbtpdFM9IOoY0rrIpRlQb2 PnzeUlKdCgOQ aoP58H FZ

Easily Guessable Passwords

Creating password policies like this will rarely work because users identify ways to create weak passwords that comply with the implemented policy. Take, for instance, a password policy that requires an upper case character, a lowercase character, a number, and a symbol which must be eight characters in length. Some of the weak passwords that we commonly observe include things like:

  • Spring2018!
  • February18!
  • Password1!

This isn’t nearly exhaustive because we often find company names, slogans, and other region specific root words exhibiting the same pattern.

Users select these passwords because they are easy to remember, easy to create, and conforms with the policy. The following XKCD comic illustrates this issue.

6zTxIvo a3e2cSuZURJlT5yrveX4DbgFz5natijmqdGOLtlde6WijvGF82np N2tG5Qgh9jHlTLho XyQc7Vf1uVDdXORwrPZ7Yhk8XJ9keyGXBqowNOFV 7CGETbwchHOVhlse1

Attackers often engage in password guessing attacks like password spraying in an attempt to expand their access to other users in the environment. Having easily guessed passwords makes this expansion possible.

Easily Cracked Passwords

In addition to the ability to guess passwords, attackers often have the opportunity to crack passwords within an environment.  When an attacker engages in password cracking, they typically need password hashes to crack.

Often, hashes can be obtained without any special permissions in an environment. Abuse of protocols like Kerberos, Link-Local Multicast Name Resolution, and NetBIOS Name Service are typical attack vectors. However, they are not exclusive. Careless application of share permissions can expose backup files that contain hashes as well.

If passwords are short, then the attacker typically has an advantage. As an example, the BHIS dedicated password cracker can exhaust the entire 8-character password keyspace, cracking NTLM hashes, in a matter of a few hours.

For this reason, BHIS urges its customers to consider a password policy that focuses on greater length than character set complexity. We recommend the following:

  • The minimum passphrase length should be 15 characters.
  • Multiple dictionary words constituting a phrase should be permitted and encouraged.
  • Encourage title case in phrases and allow digit substitution for words.

The length of a password has much greater influence on the attacker’s ability to crack that password in a reasonable amount of time (before your next password change) using brute force techniques. Another XKCD comic illustrates this concept.

Other Considerations

Having a strong password policy keeps attackers from guessing weak passwords and cracking hashes collected through various means. In addition to strengthening your password policy, measures should be taken to minimize or eliminate opportunities that assist attackers in collecting hashes.

In addition, users should be encouraged NOT to reuse passwords across multiple accounts. This is especially true when those accounts operate at different privilege levels.  An attacker who gains access to a single account may suddenly find instant access to many resources. If users maintain a large number of passwords and have trouble remembering them, the organization should consider the use of a reputable password manager application.

s7KzvWoTiZA1qjKvS iK9GSVnzeidliZ CIOY8S 0FDOyfXiGh6gA4QZr7e5Y4glOfhnWN GxPNUnsc4JH1BvXJuCmpHb6J yn P1o0rSw po 5VY2 F0XuiK86dmXtZFwHK6clQ

Where and how elevated privilege credentials are used should be carefully architected. Memory analysis with tools like Mimikatz can reveal plain text credentials of any complexity on certain systems. If possible, protective measures should be placed on these systems (like Credential Guard) to prevent disclosure. For ultimate protection, administrators should operate on administrative-only workstations that lack internet browsing and email capabilities.

Finally, for especially sensitive systems (like Domain Controllers) and internet facing logon interfaces that grant access to internal resources (like email and VPN) multi-factor authentication should be implemented. On internal systems, the technology should be usable with interactive (console logon, Remote Desktop Protocol, etc.) and non-interactive sessions (enter-pssession, psexec, etc).

GGk oH3McZFP9J1CQP5YjBZHtG05cHosBz9DJgJAKICXO2DtJGpUHtjKgQR98n2zGwYUX9NbMhcDXt8zWlW3hQEvLNQ6w3X7k79Sm eGcXXj mB5yoP1 ZLciAVVLBAjBgAssktr

Conclusion

A strong password policy should be one of the cornerstones of your security program. Users are constantly under attack using vectors like social engineering, phishing, and drive-by downloads. Without a strong password policy, the success of just one of these attacks could result in systemic compromise of an environment.

Banking Security

Banking Security
Banking Security

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *


Related Posts

Cybersecurity for FSI Standard Chartered Regional CISO Erdal Ozkaya

Cybersecurity for FSI Asia 2021 – Free Pass

Cybersecurity for FSI Asia 2021  ,Driving Cyber Resilience In Today’s Digital Economy The COVID-19 pandemic impacted all industries globally, and the... read more
Free Cybersecurity Training

Free Cybersecurity Training

Free Cybersecurity Training If you are student or someone with a limited budget, finding the extra money for training can be... read more
Dr Erdal Ozkaya

Windows Authentication Attacks and Forensics – Learn 4 Free

Windows Authentication Attacks and Forensics See demonstrations of how attackers use credential dependencies to gain elevated access to systems and... read more
DevSecOPs

4 Benefits of Development Security Operations

Benefits of Development Security Operations DevSecOps , short for development, security, and operations —automates the integration of security at every phase... read more
Implementing Zero Trust

Implementing Zero Trust : A CISO’s Journey – Free Video Training 2

Implementing Zero Trust The biggest challenge for practitioners today is to enable greater flexibility for a remote workforce while being fully... read more
How to Decipher Zero Trust for Your Business

How to Decipher Zero Trust for Your Business – A research from Gartner – Free

How to Decipher Zero Trust for Your Business Xcitium , A Research from Gartner  Security and risk management leaders are asking for... read more
Hacking Countermeasures Erdal

Google Hacking – Highly Effective searching skills 7

Google Hacking Video If you wonder what Google Hacking is , this is the right tutorial to learn Google Hacking and... read more
Chris Jackson & Erdal Ozkaya Feedback Microsoft

Azure Security – Watch and learn 4 Free

Azure Security Azure service that helps you prevent, detect and respond to threats with increased visibility and control over the security... read more
Incident Response in the age of cloudIncident Response in the age of cloud

New Book : Incident Response in the Age of Cloud

After many months of very hard work , finally my new book " Incident Response in the age of Cloud"... read more
Cybersecurity Metrics

Cybersecurity Metrics To Report To The Board – With 2 great examples

Cybersecurity Metrics to Report to the Board Information Technology (IT) is all about metrics. Each and every system creates logs, and... read more

Categories

  • About Dr Erdal Ozkaya (298)
    • Awards (96)
    • Erdal in the news (118)
    • Feedback (90)
    • My Books (54)
    • Who is Dr Erdal Ozkaya ? (2)
  • Announcemets (302)
  • Artificial Intelligence AI (11)
  • Certification (52)
  • Cloud Computing (72)
  • Cybersecurity (322)
  • Cybersecurity Leadership (52)
  • Financial Sector (31)
  • Forensics (17)
  • Free Events (156)
  • General (133)
  • How to …? (63)
  • ISO 2700x (12)
  • News (38)
  • Reviews (77)
    • Book Reviews (33)
    • Free E-Books (13)
    • Hardware Review (9)
    • Security Review / Reports (10)
    • Software Review (8)
  • Video Tutorials (101)
  • What is new? (27)
  • Windows (30)

Recent Comments

  • Erdal on Free EDR Certification Training
  • SANDEEP SHRIVASTAV on Free EDR Certification Training
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Alicia Harlow on Core isolation Memory Integrity not available – (Get it fixed)
  • Erdal on Siber Güvenlik Saldiri ve Savunma Stratejileri – NEW B00K

Archives

Dr. Erdal Ozkaya © Copyright 2023. All Rights Reserved.