Information security company heise Security issued a report a
month ago warning that many banking sites were vulnerable to
phishing attacks. It has just issued a new report saying that four
out of the seven banks analysed in the first report were still
vulnerable and had not changed their sites.
"The original demonstration tests for Cahoot, the Bank of
Scotland and First Direct all work at the time of writing exactly
as they did a month ago, no action has been taken to tighten up
procedures," said a heise statement.
HBOS told OUT-LAW yesterday that it would change its site but
that it did not believe that the heise report uncovered any new
threat. "We have examined the background to this research and do
not believe the issue identified constitutes any immediate risk to
customers," said a spokesman. "However, we have taken steps to
resolve the matter in the interests of maintaining the highest
levels of security. Work on the Bank of Scotland site will be
completed imminently."
Phishing attacks involve producing a website which appears to
belong to a genuine brand, usually a bank. The site is promoted in
spam emails that purport to come from the genuine bank. They
encourage visits, typically to confirm security details. Some
recipients will be customers of the bank and fall for the scam,
visiting the phoney site and entering their log-in details, which a
criminal can use to access an account fraudulently.
Heise's demonstration of the supposed vulnerabilities involved
inserting a fake page into the online banking systems of the
various banks using so-called frame spoofing attacks which exploit
vulnerabilities that can exist in web pages that 'frame' content
within a page.
Since then heise said that The National Westminster has taken
some steps by removing frames. It said that Bank of Ireland has
introduced script code which identifies spoofed frames and The Link
has stopped using frames altogether.
"Of the six banks found to be vulnerable to frame spoofing only
two have been able to implement proper protective measurements
during the last month," said the heise statement. "Four are still
vulnerable to phishing attacks."
A recent report by APACS, the UK payments association, found
that the number of phishing attacks had risen by 800% in the last
year. It also said that its research had discovered that 3.8% of
online banking customers, or half a million people in the UK, said
they would respond to an unsolicited email appearing to be from
their bank asking for their details. The APACS research said that
the number of phishing attacks in the month of August was 1,484, up
from 160 in August 2005.
"The internet has totally changed the way we shop and bank, and
it’s very safe provided you remember two simple rules: use a secure
PC and be wary of unsolicited emails," said Sandra Quinn, director
of corporate communications at APACS. "This new research shows that
some people still aren't doing all they should to protect
themselves which, hand in hand with a large increase in phishing
email attacks at the start of the year, leads us to expect an
increase in online banking fraud losses in the first half of
2006."
