Banking websites pose easy target for malicious WIFI hotspots

Recent studies in the Netherlands showed that consumers who are sending Internet banking transactions through a malicious WIFI hotspot could be easily manipulated if the SSL security is switched off during communication. For only $100 cyber criminals can buy a malicious WIFI router, which will give them access to any data sent through the hotspot in order to intercept passwords and to manipulate payment transactions.

Today every large city has hundreds of WIFI hotspots available, free to access and easy to use but it's very difficult or even impossible to identify whether a WIFI hotspot is malicious or not. To solve the problem of disabling the SSL security, most Dutch banks and web browsers are now supporting the new HTTP Strict Transport Security (HSTS) protocol to ensure that the communication security between the consumer and the bank is guaranteed. The problem however is that not all browsers, like the current Microsoft Internet Explorer version, are supporting the new web security standard.

The security leak is very serious according to SecureLabs, a Dutch security company that has tested the security of Dutch banking websites using a malicious WIFI hotspot. The risk heightens especially when using Microsoft IE or any other outdated Internet browser. As long as all online banking websites and browser vendors are not embracing the new security standard, the SSL web security can be easily bypassed with a cheap and easily assessable WIFI hotspot.

Several Dutch banks have now implemented fraud detection technology from INFORM GmbH to avoid this problem. With RiskShield, INFORM GmbH offers a real-time fraud detection solution that monitors transaction details and web anomalies to identify unusual behavior when payments are processed through hotspots.

The new cyber threat is a good example of how critical it is for banks to be able to quickly react to new types of threats. It allows them to easily adapt the detection rules in a short timeframe and without any IT involvement. Banking websites are not the only targets. Any other online merchants like airlines or web shops are vulnerable to these cyber hacks.

---

---

You may also like