TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

How I reverse engineered my bank's security token

311 点作者 valverde超过 11 年前

20 条评论

jwr超过 11 年前
Think about it for a moment. He did all this (impressive) work just because the application that the bank provided sucked.<p>Now, once he writes a better app, what do you think the bank will do? Hire him (or buy the app), or fight him?<p>How much effort do we collectively waste because of moronic organizations that force their crap upon us, that we cannot escape from? (You can go to a different bank, but what if they all uniformly suck?)
评论 #7010858 未加载
评论 #7010761 未加载
评论 #7010762 未加载
fpgaminer超过 11 年前
Wonderful work, and thank you for documenting the experience. From the title, I thought this would be a story about decoding a banking website&#x27;s cookies and gaining access to other peoples accounts, or something similar. I was quite surprised to see that your bank did basically everything right. I was also surprised that you went so far as to implement an embedded clone. Very cool!<p>P.S. Consider yourself lucky to have such a bank. Here in the U.S., our major banks do not take security seriously by any stretch of the imagination (they have little incentive to).
lstamour超过 11 年前
This post had me guessing, but good work. First I saw the card with codes and thought you&#x27;d be showing that they weren&#x27;t randomly created. But then you went on to the app -- and from the &quot;What you&#x27;ll need&quot; section, when I saw the decompiler and the rest, I thought, &quot;I know what comes next,&quot; but again I was surprised. You went above and beyond with the decryption of obfuscated error messages, etc. I could have guessed that it was OATH TOTP, as that&#x27;s how these apps should work. Congrats on getting there from the source code, and indeed it&#x27;s too bad they didn&#x27;t retain compatibility with Google.<p>To fix the bug you mention -- root access from phone -- perhaps you could use something like Yubikey Neo loaded with ykneo-oath. I was searching the code for ykneo-oath (it&#x27;s a java applet for the small key) to see where the timestamp was used for the dates, but it appears to be part of the YubiOATH app: <a href="https://play.google.com/store/apps/details?id=com.yubico.yubioath" rel="nofollow">https:&#x2F;&#x2F;play.google.com&#x2F;store&#x2F;apps&#x2F;details?id=com.yubico.yub...</a> So you&#x27;d have to modify the app source (it&#x27;s on github). The advantage, however, is that your secret isn&#x27;t stored on your phone and vulnerable to root apps. Instead, your secret is on a mostly-offline key inaccessible from your phone. There&#x27;s a YouTube video on how it uses NFC to get that OTP from the Yubikey when you need it. In case you&#x27;re somewhat extremely paranoid, this might interest you. :) For the truly paranoid, you&#x27;ve found a way to disable account recovery methods while mixing time-based and counter authentication mechanisms ;-)
评论 #7010597 未加载
评论 #7012516 未加载
Vespasian超过 11 年前
While I don&#x27;t know about the situation elsewhere in the world, here in Germany most banks retired the single use codes (called TANS or (if indexed) iTans) quite some years ago for being insecure.<p>Most online banking will now require a code created per transaction that is 1. either send to you via text on your mobile phone (and is thus prone to phone malware) or 2. is generated using an external device and the chip on your banking card[1] (a true two factor authentication). Both system will show you the exact details (target account, amount to be send) before confirming the transaction. A virus on the computer is not sufficient to hijack your account.<p>Just out of curiosity: What security measures do your banks employ and do they allow you to upgrade to a higher security level?<p>[1]<a href="https://www.ksklb.de/privatkunden/banking/chiptan/chiptan_faq/FAQ-TAN-Generator.jpg" rel="nofollow">https:&#x2F;&#x2F;www.ksklb.de&#x2F;privatkunden&#x2F;banking&#x2F;chiptan&#x2F;chiptan_fa...</a>
评论 #7011237 未加载
评论 #7010796 未加载
评论 #7013077 未加载
评论 #7011002 未加载
评论 #7010842 未加载
nly超过 11 年前
Just another example of a proprietary implementation tweaking a de-facto standard &#x2F; well-known algorithm (RFC 6238) just enough to be annoying.<p>Fresh in my mind is the Wii U controller reverse-engineering presented at 30C3, where the WPA-PSK handshake protocol was tweaked by performing bit-rotations on the resulting keys.
memracom超过 11 年前
A good lesson for those of us who have had the idea of building a similar app to generate one-time passwords. Now we have a better idea of the minimum that needs to be done to build such an app securely. Thanks.
评论 #7009835 未加载
评论 #7010436 未加载
评论 #7010444 未加载
评论 #7009972 未加载
jrockway超过 11 年前
The only point of these token generators is to provide a stream of tokens, so that if the generator is cloned (which is trivial), that can be detected. That&#x27;s it. As far as I can tell, this attack does not prevent the server from detecting a cloned token.<p>(To do that, you would have to install a new client on the victim&#x27;s device that will increment its counter and tell you the counter when you ask.)
评论 #7009850 未加载
sajb超过 11 年前
Thanks valverde, quite interesting work, and very well written.
shocks超过 11 年前
Dark grey text on a light grey background. :(<p>Apart from this, awesome read.
StavrosK超过 11 年前
It looks like this is down, does anyone have a mirror? It&#x27;s frustrating to read all the gushing comments and not be able to read the post!
评论 #7010650 未加载
评论 #7010735 未加载
raverbashing超过 11 年前
Interesting<p>I suppose my bank token uses the same structure and produces a similar code (but I haven&#x27;t reversed engineered it though)
r4pha超过 11 年前
A very interesting read. Also, I think I saw you on facebook&#x27;s hackathon this year!
ithinkso超过 11 年前
Why obscuring error&#x2F;debug messages? Couldn&#x27;t production just go without it?
sebastianavina超过 11 年前
he is going to get a very awkard phone call from the bank...<p>Some years ago I stumbled with something similar on a webpage, posted it on reddit, and the next day the IT manager of the company called me... it was one of the most embarrassing days of my life.<p>Lesson: don&#x27;t mess with other peoples work just because you can...
评论 #7009965 未加载
评论 #7009941 未加载
评论 #7009927 未加载
评论 #7009957 未加载
elwell超过 11 年前
Wow, that&#x27;s commitment!
B0Z超过 11 年前
Article is 404 inside of 5 hours. That&#x27;s fairly swift. (assuming OP didn&#x27;t remove it himself)
评论 #7010304 未加载
easy_rider超过 11 年前
Well explained, nice read!
piyush_soni超过 11 年前
Just one word. Wow!
bblough超过 11 年前
Nice work!
fiorix超过 11 年前
dat hax