Here's some more on the recently discovered/secretly addressed/accidentally exposed critical flaw in SSL which is what the online banking community relies on for security. Translation: There is no security when financial transactions are done on the web. From NetSecurity.org:Marsh Ray and Steve Dispensa of PhoneFactor discovered a serious vulnerability in SSL, the most common data security protocol on the Internet for online banking. The SSL Authentication Gap allows an attacker to mount a man-in-the-middle attack, and affects the majority of SSL-protected servers on the Internet.
Specifically, the vulnerability allows the attacker to inject himself into the authenticated SSL communications path and execute commands. Furthermore, both the web server and the web browser generally have no idea their session has been hijacked.
Editor's Note: I've been posting for well over 18 months now that the Web is NOT SAFE for financial transactions. I wrote several months back that SSL was flawed. Extended Validation SSL is also flawed.
Attacks on SSL have made banks worried, Our patented technology takes trust to a whole new level and allows banks to set up secure links directly to the card reader itself, bypassing existing threats and risks completely. We envision that it will dramatically cut down internet crime and allow banks to do much more with their online banking customers.
The vulnerability results from a weakness in the SSL protocol standard (formally known as Transport Layer Security, or TLS). As such, most SSL implementations are vulnerable in one way or another. Affected scenarios include web surfers doing online banking.
“Because this is a protocol vulnerability, and not merely an implementation flaw, the impacts are far-reaching,” said Steve Dispensa, CTO of PhoneFactor. “All SSL libraries will need to be patched, and most client and server applications will, at a minimum, need to include new copies of SSL libraries in their products. Most users will eventually need to update any software that uses SSL.”
Here's come the band-aids!
![Reblog this post [with Zemanta]](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_v41TFBcYylE-HndTTH4XeiK76_L9rIuCI1zXlAxEtyFTUHRIPNtnajc1sOt5jNFCUvrH5KszzZhJzfjvIA9ym8F68WIWk_mINUCTVOv9u-GTWQ0ehmJam1WxT9uhz1fA-7ZjPL5FwRmW7uWt9Yoe7L=s0-d)
0 comments