Security and Usability Gap in Online Banking

NSPW Presentation - Sep 19, 2007

Security and Usability: The Gap in Real-WorldOnline Banking
Mohammad Mannan and P. C. van Oorschot
Carleton University

Mohammad Mannan

Sep 19, 20071

Security and Usability Gap in Online Banking

Large Canadian banks➠ RBC Royal Bank
➠ Canadian Imperial Bank of Commerce (CIBC)➠ TD Canada Trust➠ Scotiabank➠ Bank of Montreal (BMO)➠ President’s Choice (PC) Financial

Mohammad Mannan

Sep 19, 20072

Security and Usability Gap in Online Banking

Why bank online?

58% of Internet-connected Canadians used online banking in 2005(Statcan, 2006)

Mohammad Mannan

Sep 19, 20073

Security and Usability Gap in Online Banking

Mohammad Mannan

Sep 19, 20074

Security and Usability Gap in Online Banking

100% reimbursement guarantee➠ There are risks – but most banks give a 100% reimbursement
guarantee on any money lost due to online banking

Mohammad Mannan

Sep 19, 20075

Security and Usability Gap in Online Banking

So, why worry?

1. The guarantee is conditional
2. Security is a ‘shared responsibility’Can users realistically meet online banking requirements?

Mohammad Mannan

Sep 19, 2007

6Security and Usability Gap in Online Banking

Overview➠ Example requirements➠ Bank site authentication➠ Misleading information➠ User survey➠ Concluding remarks

Mohammad Mannan

Sep 19, 20077

Security and Usability Gap in Online Banking

Example requirements: RBC
1. Electronic Access Agreement(a) Sign out, log off, disconnect, close browser(b) Use up-to-date anti-virus, firewall
2. “How you can protect yourself”(a) Install all security updates(b) Test your computer for security vulnerabilities(c) Stay aware of the latest security-related issuesMohammad Mannan

Sep 19, 20078

Security and Usability Gap in Online Banking

Anti-malware
1. Cost: 71.45 USD, per computer, per year for CIBC customers
2. Proper installation and maintenance is difficult
3. Effectiveness is questionable(a) may give a false sense of security(b) targeted by malware

Mohammad Mannan

Sep 19, 20079

Security and Usability Gap in Online Banking

Anti-malware user study
1. 95% users knew the term ‘spyware’
2. 70% use online banking
3. Some believed spyware was ‘protecting’ their computers

Mohammad Mannan

Sep 19, 2007

10Security and Usability Gap in Online Banking

Check the URL?
1. https://www.txn.banking.pcfinancial.ca/a/authentication/preSignOn.
ams?referid=loginBox banking go

2. One user study reports➠ 45% users did not look at URLs
➠ 35% noticed https, but many didn’t know its significance

Mohammad Mannan

Sep 19, 200711

Security and Usability Gap in Online Banking

wwwcibc.com

Mohammad Mannan

Sep 19, 200712

Security and Usability Gap in Online Banking

wwwcibc.com with a twist

Mohammad Mannan

Sep 19, 200713

Security and Usability Gap in Online Banking

Check the lock?
Look for the SSL lock icon on the lower-right corner

Mohammad Mannan

Sep 19, 200714

Security and Usability Gap in Online Banking

IE7 – where is the lock?

Mohammad Mannan

Sep 19, 200715

Security and Usability Gap in Online Banking

Embedded SSL lock

Mohammad Mannan

Sep 19, 200716

Security and Usability Gap in Online Banking

Not big enough?

Mohammad Mannan

Sep 19, 200717

Security and Usability Gap in Online Banking

Summarizing SSL certs
1. “This certificate has failed to verify for all of its intended purposes”– known bug, the site is actually ‘secure’
2. SSL comments(a) users: a ‘formality’ like an ‘elevator certificate’(b) researchers: ‘indistinguishable from placebo’(c) banks: ‘electronic passport’“People being too dumb/lazy, though, is the hard problem. Fortunately
this is evolution at work.”

Mohammad Mannan

Sep 19, 200718

Security and Usability Gap in Online Banking

Misleading information
1. Password advice(a) ‘Rock solid’ password examples: iwthyh or iw2hyh (Beatles’ “I want to hold your hand”)(b) ‘111111’, ‘123456’ are not disallowed
2. Safe as in-branch banking?
3. Firewalls “will only allow in the connections that are known andtrusted”
4. “... will not undertake to provide a service that compromises thesecurity and confidentiality of customer information”

Mohammad Mannan

Sep 19, 200719

Security and Usability Gap in Online Banking

User survey➠ 123 users: CS undergrad (3rd , 4th year) and grad students, postdocs, profs, net admins, security researcher and professionals– gives us a best-case scenario

Mohammad Mannan

Sep 19, 200720

Security and Usability Gap in Online Banking

Result summary

Mohammad Mannan

Sep 19, 200721

Security and Usability Gap in Online Banking

Concluding remarks/questions
1. Apparently users can hardly meet their ‘shared’ responsibilities
2. What can users do in the face of ‘session hijacking’ attacks?
3. Who bears the responsibility for security?

“To err is human, to forgive is not bank policy”

Mohammad Mannan

Sep 19, 200722