Improve Bank cyber security cybersecurity

Improve Bank cyber security

Financial services
Improve Bank cyber security
Location USA
Branch Financial services
Technologies
PT Security Sniff
Solution
Testing
Terms
3 months full complete

Guardians of the digital world

An international commercial bank with total assets of USD 500 million applied to our team of cybersecurity experts. The bank offers a full range of banking services to private and corporate clients. The team was tasked with assessing the current level of security of web and mobile banking applications for a commercial bank in Europe. Although the scope of work was limited to a black box perspective and assumed an external attack scenario where the attacker only knows the customer's name, we were able to exploit application abnormalities, gain access to critical data, gain full access to the bank's customer accounts, and withdraw money as the ultimate goal.

WHAT WAS DONE

TESTING STAGES

Reconnaissance:

It took us a week to study the client’s systems. We gathered information about the software, OS, browsers, antiviruses, email clients, etc. used by employees. We also focused on the email format and other elements of corporate identity, news and events in the company – everything that could make the email, phishing site, and targeted attack credible.

STAGES OF THE TEST

To conduct high-quality comprehensive testing, we used both manual and automated testing tools and techniques.

OTP compromise:

  • During the testing, we found that access to the account via online banking is protected by two-factor authentication using an OTP code. We were able to find a critical vulnerability in the OTP, which allowed us to capture it using a brute force attack (password guessing attack on the login page). In addition, OTP verification was also used for financial or any other asset transactions. Provided that the attacker knew the user’s credentials, he could access any bank account and make an unwanted money transfer, which would completely compromise the security system.

The same OTP vulnerability was confirmed in the mobile application, although a different server was used to process requests, and the web and mobile application APIs were supposed to function separately. Thus, the mobile application contained the same flaw in the session management logic, and the security risk was correspondingly higher.

Authentication compromise:

  • Another critical vulnerability was discovered when authorizing access to user data. By logging into the online banking system and changing the user’s identification token, the hacker could see private data of other bank customers, including their transactions and account balances. Thus, it was possible to select accounts with the desired balances and then – using an automatically generated script – pick up credentials, log in to the victims’ accounts, pick up OTPs, and withdraw money.

Hacking scenario:

  • Gaining full access. A vulnerability in the authentication process allowed access to any user account in the system. The attacker could easily check the account balance, select the desired accounts, pick up the necessary data, and initiate unwanted transactions by exploiting the OTP vulnerability.

RESULT

We conducted a series of tests to analyze the security of the bank’s web and mobile applications. The tests revealed several types of vulnerabilities classified according to the risk levels defined by the OWASP methodology. The combination of two critical vulnerabilities allowed our team to conduct any transaction from the bank’s customers’ accounts without proper authentication.

To help the bank address the identified security gaps, we prepared a comprehensive report covering all the vulnerabilities identified and provided remediation recommendations that were implemented during the remediation phase.

Chat with manager
cheat engine mahjongpria bandung cheatmenang mahjong 10menitrahasia menang mahjongserver thailand abc1131scatter gems bonanzajackpot big bassmaxwin santas giftswild riches scatterscatter emas wildwestgame lucky piggycara dapatkan jackpot besar pada situs pg softcara cepat dapatkan scatter hitam mahjong ways 2bocoran game gacor joker gamingtrik jackpot dengan akun viptips dan trik jitu starlight princess x1000kemenangan maksimal rujak bonanzapola anti rungkad rise of apollobocoran game gacor playtechsimbol penting mahjong wins 3jackpot tanpa batas bakery bonanzagame the great icecapeteknik gacor jackpot fortune rebbittrik jackpot gates of olympus 1000 xmas9 taktik jackpot terbaru gates of olympusrtp live pgsoftscatter game pgsoftrtp live pgsoft gacorjackpot game pgsoftjackpot pragmatic playbocoran trik jitu pancing scatter dalam game onlinegame mahjonggame online gampang dapat scattersitus akun pro thailandbocoran admin jarwositus game server luar negeripola gacor starlight christmasbocoran provider game online terbaik di situs akun gacor vipbocoran game starlight princessgame maxwinlink super maxwingame mahjong wins 3bocoran game ghacor anti rungkadmahjong ways 2game mahjong wins1399 mahjong cara menang1400 mahjong anesong1401 starlight princess mudah banget1402 mahjong mengguncang dunia1403 cuan super besar1404 starlight princess bagus kali1405 starlight princess luar biasa1406 admin vip bantu member1409 sugar rush strategi menakutkan1410 mahjong cara profitstrategi scatter hitam mahjong ways auto cuanpria bandung ciptakan metode menang game pgsoftcara menang mahjong ways 10 menit anti ribetmetode rahasia menang besar mahjong ways terbaruserver thailand abc1131 pragmatic jackpot lebih gampang4 scatter gems bonanza jackpot 300jt strategi gacorbig bass bonanza modal sekotak rokok auto jackpotmaxwin tanpa batas santas great gifts rtp live tinggiwild wild riches server thailand auto sultan modal kecilstrategi scatter emas wild west gold keuntungan besar0604 mahjong ways2 lebih gampang gacor dibanding pertama0605 modal receh hasil besar di web game terpercaya 20250606 pola terbaru mahjong ways2 april 2024 auto menang0607 rtp terjitu 2025 maksimalkan kemenangan anda0608 server asia game online winrate 99 persen0609 teknik pintar starlight princess x1131 anti rugi0610 bang jarwo bocoran pola mahjong ways menang mudah0611 asosiasi pagcor modal minim mahjong wins 3 maxwin0612 metode ampuh menang game online modal kecil1407 sweet bonanza teknik cuan1408 lucky neko hujan perkalianteknik spin starlight princess 1000 jackpot7 game pgsoft terbaik 2025 hujan angpaostrategi naga terbang dragon hatch x5000gates of olympus 1000 modal receh auto cuanhindari kesalahan candy burst rtp live akuratcandy bonanza pgsoft pola maxwin modal kecilwild bandito scatter beruntun tanpa boncospola scatter mahjong ways 2 rtp tinggipanduan lengkap mahjong ways 2 auto cuanrevolusi mahjong ways 2 scatter rahasiagame mahjong jackpot maxwingame modal recehrtp game pg softkitab suci scatterpola gacor game wild bandito yang gampang dapat scatterbocoran trik olympus x1000game deposit qrissitus game gacor terpercayasweet bonanzastarlight princess 1000situs cheat game anti rungkadpola gacor jackpot phausgame online dengan rtp tertinggi di aplikasi game hksbetrtp game jackpotgame mahjong ways1391 mahjong solusi joss1392 mahjong tanpa resiko1393 mahjong filipina mengamuk1394 mahjong mendadak kaya1395 mahjong meledak saldo1396 mahjong tiap hari panen1397 mahjong calon pemenang1398 mahjong spin mautteknik spin starlight princess 1000 jackpot sensasional7 game pgsoft 2025 pola rahasia jackpot lebih gampangstrategi naga terbang dragon hatch perkalian x5000modal receh gates of olympus 1000 bali auto cuanhindari kesalahan candy burst rtp live anti rungkadpola maxwin candy bonanza 2025 modal receh cuan besarwild bandito rtp live tinggi pola scatter beruntunpola scatter langka mahjong ways 2 jackpot tanpa modalpanduan lengkap mahjong ways 2 pola stabil konsistenrevolusi mahjong ways 2 pola scatter rahasia terbaru0596 rtp live mahjong wins 2 waktu terbaik menang besar0597 awsbet rilis fitur analisis statistik auto cuan0598 turnamen awsbet pemain makassar pola taruhan unik0599 teknik manajemen modal awsbet auto profit konsisten0600 ai analisis rtp awsbet pilih game menang terbaik0601 shio ular macan 2025 pola main cuan maksimal0602 awsbet kompetisi leaderboard ranking real time0603 pola dan mindset awsbet menang stabil anti rugispin santai pgsoftstrategi menang mahjong wins 3sweet bonanza xmastrik dapat scatter hitam mahjongteknik gacor olympusperuntungan luar biasa mahjong wins 3fitur tersembunyi mahjong ways 2 scatter hitamstrategi pro player jp gates of olympusbocoran pola maxwin gates of gatot kacasitus gacor mpoxo server kambojakemenangan spektakuler bersama lucky nekoteknik dan trik rahasia maxwin spadegamingpanduan dan tips terbaik sensational sweet bonanza 1000xjackpot spektakuler taruhan bola onlinestrategi cuan ngalir terus mahjong wins 3tips dan trik jackpot mahjong winskesalahan yang harus di hindari dalam koi gate6 alasan sulit dapatkan jackpot besar pada game onlinerahasia kemenangan fantastis crypto goldpola maxwin kakek zeus1383 mahjong full power1384 sweet bonanza perkalian1385 olympus tuntaskan sekarang1386 mahjong mau cuan1387 wild bandito jelajahi dunia1388 ada cara kegacoran1389 mahjong naik daun1390 situs aman terpercayateknologi ai deepseek bongkar rtp abc1131hindari kesalahan fatal gates olympus starlightteknik menang tiger kingdom infinity reelspola maxwin pyramid bonanza the dog housestrategi harimau emas tiger kingdom rtp gacortaruhan maksimal wild west gold scatter x4000strategi menang fortune ox floating dragonpola platinum the dog house megaways jackpotshio hoki hot fiesta free spin maxwinjackpot great rhino teknik taruhan sejati0588 pola spin baru mahjong wins 3 maxwin cepat0589 rtp live tinggi mahjong ways 2 pola wild menang0590 pg soft gandeng awsbet scatter hitam lebih mudah0591 duel mahjong ways vs mahjong wins 3 mana gacor0592 pola 5 spin mahjong ways 2 auto free spin0593 awsbet favorit pro mahjong ways 3 rtp live tinggi0594 shio tajir 2025 maxwin mahjong wins 3 pola rahasia0595 trik wild west gold pola spin maxwin efektifakun game maxwintrik dan tips mix parlay gampang tembusgame deposit bcatips dan panduan memilih game jackpot dengan peluang bonus tinggigame gacor habaneroteknik dan trik game gacorrtp game gacorsitus game anti rungkadgame gacor mahjongpola game online gacorrtp game vip gacorpanduan dan tips memilih game yang tepat di situs pg softgame wild banditogame keluaran terbaru pragmatic playpola spin 30x dan 50x mahjong wins 3bocoran pola dan strategi efektif starlight princess 1000xjam gacor mahjong ways 2 untuk kemenangan maksimalfitur pembantu kemenangan gates of olympusgame super gacor terbaik server thailandpanduan lengkap mahjong wins 3 untuk pemulajackpot terbesar hand of midas dengan strategi jitusolusi untuk yang sering kalah dengan bocoran rtp liverahasia tersembunyi game sweet bonanzapola gacor mahjong ways 2 yang hebohkan warga bandungbocoran game gacor yang jarang dimainkan pemainjackpot fantastis mahjong winsstrategi paling gacor starlight princess 2025kemenangan spektakuler wild bandito 2025pola spin gates of valhalla scatter beruntunjurus ampuh pyramid bonanza scatter wildpola jokers jewels multiplier berlian jackpottrik 14 free spin aztec blaze rtp gacorstrategi menang olympus 1000 gates valhallarisiko maxwin abc1131 modal kecil jackpotwild west gold demo scatter jackpot abc1131trik petir x500 starlight princess terbaruhujan scatter aztec blaze big bass bonanzastrategi pola 10 50 30 jackpot modal 26k0580 pola perkalian ganda mahjong wins 3 naikkan rtp0581 bocoran scatter mahjong ways 2 free spin maxwin0582 jam keberuntungan mahjong wins 3 kemenangan beruntun0583 gates of olympus rtp live petir x500 awsbet0584 wild bandito auto spin perkalian besar modal kecil0585 strategi mahjong wins 3 kombinasi spin jackpot0586 shio beruntung minggu ini feng shui mahjong ways0587 pola tersembunyi starlight princess jackpot ratusan jutasolo magic134heylink magic134heylink macauklubheylink asiaklubheylink hksbetheylink kapten76heylink mpoxompoxoABC1131 AMPABC1131garuda76asiawin189 1asiawin189 2asiawin189 3asiawin189 4asiawin189 5