full-disclosure - Bank Of America Vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sat, 3 Nov 2007 11:38:16 -0500
From: "Jamal Al-Aseer" <suproot@...il.com>
To: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Bank Of America Vulnerable

Dear SF,
I am writing this to inform the public that bank of America's two step
authentication is fundamentally flawed. The user at there website will
enter a user name then tell there systems which state it originates
from but the next step is flawed. The server connects you to a secret
challenge where it gives a question like "Whats your mothers maiden
name?" but if you were to answer "Joni" it lets you in. On step 1 of
this authentication you answer "Jon i" or "Jni "  it lets you in, I
found a couple times the server did not mind a letter missing as long
as the beginning is kept the same; Also moving the word or letters
with spaces allows entrance. This is a common vulnerability in fact
the Point Of Sale at the company I work for allows 3 letters of your
password to be entered and it usually authenticates because it isn't
strict on how precise you enter the password as long as it appears to
be the original password.

Superuser of Socal
gr33ts to 23.org,
Uber Tron Da Hacker

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/