full-disclosure - Re: Bank Of America Vulnerable

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Sat, 3 Nov 2007 16:01:00 -0500
From: nocfed <nocfed@...il.com>
To: full-disclosure@...ts.grok.org.uk
Cc: Jamal Al-Aseer <suproot@...il.com>
Subject: Re: Bank Of America Vulnerable

On 11/3/07, Jamal Al-Aseer <suproot@...il.com> wrote:
> Dear SF,
> I am writing this to inform the public that bank of America's two step
> authentication is fundamentally flawed. The user at there website will
> enter a user name then tell there systems which state it originates
> from but the next step is flawed. The server connects you to a secret
> challenge where it gives a question like "Whats your mothers maiden
> name?" but if you were to answer "Joni" it lets you in. On step 1 of
> this authentication you answer "Jon i" or "Jni "  it lets you in, I
> found a couple times the server did not mind a letter missing as long
> as the beginning is kept the same; Also moving the word or letters
> with spaces allows entrance. This is a common vulnerability in fact
> the Point Of Sale at the company I work for allows 3 letters of your
> password to be entered and it usually authenticates because it isn't
> strict on how precise you enter the password as long as it appears to
> be the original password.
>
> Superuser of Socal

And the 3rd step... you know, the actual Password.  Is that a loose
password as well?
It looks like it is just the challenge question that allows this loose matching.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/