Security "online" bank account management system.

[parbaude]

Security of the "online" bank account management system and the computer network of the bank
(system check).

In this article, we will consider the question - how to check the security of the "online" bank account management system and the computer network of the bank , in the same way you can check the security of the business site and the computer network of your business. The issue at the moment is very relevant, since almost every bank owns its website and its “online” bank account management system, which are usually located on the server of the bank's computer network.
Both the bank’s website, together with the “online” account management system, and the bank’s computer system itself arouse interest in all kinds of hackers and persons who engage in unauthorized entry and illegal collection of various kinds of information with its further illegal use.
As practice shows, almost all banks sin in the field of security and information protection of the "online" account management system or computer system, deceiving their customers with the assertion that both of these systems ... are safe and information theft, as well as theft of finances, using " online "bank account management system and the computer network of the bank is not possible. But this is not always the case, and very often the bank deliberately hides the facts of illegal entry into the server, the account management system and the bank's computer system itself, as this can affect the bank’s rating, its profit or cause customers to transfer to another ... more reliable bank.
It must be clarified that in the event of illegal entry into the system and theft of funds or information, and not reporting this to injured and law enforcement agencies, the bank directly violates its direct obligations to safeguard the client’s financial resources and the secrets of the client’s banking information, which are fixed both by law and and an agreement between the bank and the client.
For clarity of the algorithm and software used in the verification, we will conduct a security check of the Raiffeisenbank website and computer network.

First:
Checking the site for vulnerabilities . Determining the IP address of the site and entering the "online" system. For this, the Access Driver program is used, with the help of which we determine that the IP address of the site is 193.28.44.146 and the IP address of the entrance to the "online" system is 193.28.44.148.
Scanning the site with this program, we establish that the site has 60 vulnerabilities . This means that there is the possibility of using exploits to infiltrate and steal information on the site. When checking the entrance to the "online" system with this program, no ulcers were found.
Using the security scanner XSpider when scanning the IP address of the site 193.28.44.146, we establish that 3 ports 21, 80, 443 are open and using the TRACE method in the HTTP protocol is possible cross site scripting attack . This shows that it is possible, using sniffing programs, to listen to and intercept important information (including client identification data) necessary for illegal entry. Also, listening to these ports, it becomes possible to establish an IP address client computers that use the "online" account management system of this bank, and using a spoofer program (a program that replaces a real IP address with any other IP address) use these IP addresses when illegally entering the site bank or into the computer network of the bank. The last thing to note is the site itself was subjected to a phishing attack.
Second:
In the WHOIS service, we check who owns these IP addresses 193.28.44.146 and 193.28.44.148 that we set.
We see that both IP addresses belong to the computer network of Raiffeisenbank:

inetnum 193.28.44.0 - 193.28.44.255 - the interval of IP addresses belongs to the organization.
netname RBA
descr ZAO "RAIFFEISENBANK AUSTRIA" - host name of the IP addresses.
country RU
admin-c ST1206-RIPE
tech-c ST1206-RIPE
status ASSIGNED PI
mnt-by RIPE-NCC-HM-PI-MNT
mnt-lower RIPE-NCC-HM-PI-MNT
mnt-by ROSNIIROS-MNT
mnt-routes RAIFFEISENBANK-MNT
mnt-routes ROSNIIROS-MNT
source RIPE # Filtered
person Sergey Tretyakov - responsible person and contact details in the host organization
IP addresses.
address Troitskaya 17/1, Moscow, Russia
remarks phone: +7 (095)775-5240
phone +7 (495)775-5240
remarks fax-no: +7 (095)721-9901
fax-no +7 (495)721-9901
e-mail stretyakov@raiffeisen.ru
With this we have established that the bank has its own network of IP addresses and the site itself, as well as the "online" bank account management system, are located on the servers of the bank's computer network.

Third:
Checking the computer network of the bank itself.
This takes longer because the verification is performed by several programs.
Using the program Essential NetTools , we check if the computer network has “shared” IP addresses (addresses with free access of any other computer to them). Check showed that there are no such IP addresses.
We can carry out the same operation using the program LanSpy , this program will also indicate whether the Troyanov ports are open on the computers that are used or used by persons illegally entering the computer network of the bank. The program did not record such a fact.
We will perform the same operation to find the open Troyan ports on computers using the NetTools - Trojan Hunter program and also establish that there are no IP addresses with open ports for the Troyan.
The last program that scans the entire computer network of the bank, the security scanner XSpider , determines the general and specific state of the security system of the computer network. During the verification, it was established that out of all the networks , the open IP addresses were 23 and all had 21 ports open in all modes. When checking the vulnerability and weaknesses were not found.
The program has the ability to check non-responding network IP addresses as well, but we did not perform such a thorough check, since our goal is to show the principle of operation when checking security.

Fourth:
Analysis and evaluation of the information received.
Analysis and evaluation of the information received shows that the bank’s computer network itself is conditionally safe, in addition to the security of the site itself and the “online” bank account management system, since with the presence of certain software and skills illegal entry into the network is possible, as well as listening to and intercepting the identification data of bank customers, which in the future can lead to illegal entry into the "online" bank account management system and theft of funds, as well as to illegal information about the bank's customers and their financial transactions. And this is already a direct violation by the bank of the obligation to keep banking information from third parties secret.

 

[Матушкин Андрей Николаевич]

Thank!