TechMiso

Online banking users are hopefully aware of the need to login to their banks web-based system using secure means, such as via a web site protected using SSL encryption. Every legitimate bank offers such protection, normally disallowing customers the ability to login via unsecure means. But not every bank appears to be conscious of the myriad of potential security risks associated with their site. Navy Federal Credit Union is plagued by a huge security vulnerability on their web site and is possibly the easiest bank on which to perform a phishing expedition.

Updated – August 12, 2009: Added correspondence from the RSA Anti Fraud Command Centre and SliceHost Support regarding a take-down notice and trademark infringement claim. This little article has apparently generated some interest and visibility by an NFCU “security” contractor.

Updated – August 15, 2009: The saga appears to have come to an end as the RSA AFCC responds to SliceHost after TechMiso stipulates the content was not infringing. The attack dogs are ostensibly caged for now.

As web browsers have matured throughout the years their ability to quickly and easily identify secure web sites has gotten exponentially better. Years ago the only way to determine if a genuine SSL connection was established was to look for the lighted “lock” icon in both Internet Explorer and Netscape.

Fast forward to today where all current major browsers display the SSL connection status in the browser location bar. For example, Firefox 3.5 uses the leftmost side of the location bar to visually present the validity of the certificate presented by the server. If a valid Certificate Authority can verify the authenticity of the certificate, if company information is present in the certificate and if the fully qualified domain name on the certificate matches the one in the address bar then the background color of this area is green to let users know they are essentially safe from a potential phishing attack.

Any other combination of the above will result in a different background color, alerting to a probable security issue. At this juncture users should not attempt to login because there is a high risk for their data being stolen or misused.

But even with all the security controls offered by browser vendors, nothing can stop people from forsaking security for convenience. In this case, Navy Federal Credit Union (NFCU) does just that – it offers customers the ability to login to their web based banking system from their unsecured home page. How many users merely enter their credentials in the form provided without ever thinking twice about whether the site they are visiting truly is NFCU?

Even though the web browser does not display any sign of a secure connection or an authentic connection to navyfcu.org, rest assured most users make use of the convenient form on the home page. This is a huge security risk because it is ripe for phishing. By allowing users to login to an online bank from an unsecure, unverified site, those same customers could be tricked in to entering their credentials from just about any domain.

To their credit, NFCU does offer the ability to enter login credentials from a secured page. By clicking the home page “sign on” button with an empty form users are then redirected to an SSL-enabled page where they are assured the site being visited is in fact the authentic NFCU web site.

Even though the NFCU home page is unsecured and offers the ability to enter details on a potentially phished page, the form data is in fact submitted via secure means. So although users may use this less-than-secure yet convenient method of logging on to NFCU, their credentials are secure – assuming they are entering the data from the authentic site.

But the secure transportation of data to NFCU is not the issue in question. The issue is the complete and utter disregard NFCU displays for the potential for their customers to be phished by malicious attackers seeking to gain access to NFCU customer accounts. Any bad guy could easily copy the entire contents of the NFCU home page and everybody would be none the wiser because NFCU fails to follow industry standard security best practices.

The best solution to this issue is for NFCU to completely remove the login form from their home page and replace it with a huge “LOGIN HERE” button which, when clicked, takes users to the secure login page. It is easy to implement, can be done in a mere 5 minutes and is exponentially more secure than the current method. Additionally, this mitigates the potential risk from any phishing site because users will be able to identify NFCU via browser security controls.

Alternatively, NFCU can do what Chase has done and merely secure their home page via SSL, redirecting all http visitors to their https site. This approach essentially provides the same level of assurance the previous method does, but in a different manner. Assuring users they are visiting the authentic NFCU home page rather than some mirrored version being run by malicious attackers is the ultimate goal.

The NFCU web site has been run like this for years. Considering today’s climate, I find it very peculiar they continue to take on such liability and allow their users to be potentially phished so easily. While I am amazed to a degree, since the average user does not entirely comprehend these issues in full it does make sense to see NFCU allow this vulnerability to persist.

If your bank is doing anything similar, ensure you take the necessary steps to protect your login credentials from being phished. Otherwise, if there is no other recourse, close your account and contact the bank to explain why you will no longer conduct business with them to their lacking security controls.

Update 1 – July 19, 2009. It seems this article generated some interest from the RSA Anti Fraud Command Centre, a company “under contract to assist Navy Federal Credit Union in preventing or terminating online activity that targets, or may potentially target Navy Federal Credit Union’s clients as potential fraud victims.” It seems they are not too happy with the spirit of this post, which is pretty peculiar considering that we are pointing out a pretty serious, long-standing security flaw with the Navy Federal Credit Union web site. Here is the first email I received from the RSA Anti Fraud Command Centre:

Dear Sirs:

RSA, an anti-fraud and security company, is under contract to assist Navy Federal Credit Union in preventing or terminating online activity that targets, or may potentially target Navy Federal Credit Union’s clients as potential fraud victims.

RSA has been made aware that a domain name, which abuses Navy Federal Credit Union’s trademark, has been registered with you. This domain http://techmiso.com/2434/navy-federal-credit-union-web-site-operating-with-security-issue/ not only violates Navy Federal Credit Union’s copyright, trademarks and other intellectual property rights, but may also become a host to a phishing attack, or other fraudulent scams against the bank and the bank’s clients.

The fraudulent website not only represents a misuse of Navy Federal Credit Union’s intellectual property; its purpose is to mislead the Navy Federal Credit Union clients. Our experience has shown that such sites become a host of phishing** and other fraudulent scams against the bank clients.

Please take all necessary steps to immediately shut down the fraudulent website, terminate its availability to the Internet and discontinue the transmission of any e-mails associated with this website.

We understand that you may not be aware of this improper use of your services and we appreciate your cooperation.

We specifically would ask that you also take the following actions (if relevant or possible):

Please provide us with a tar/zip file of the source code for this site, so that we may analyze it to help prevent further attacks.
If any customer data has been captured that is stored on your systems or equipment, please send us that data so that the customers to whom that data
relates can be notified and take steps to protect their credit.

Please provide a copy of any records you maintain that indicate the name, contact information, method of payment or similar information that may be useful in helping learn the identity and location of the customer for whom the website has been operated.

We specifically would ask that you also take provide a copy of any records you maintain that indicate the name, contact information, method of payment or similar information that may be useful in helping learn the identity and location of the customer for whom the website has been operated.

Thank you for your cooperation to prevent and terminate this fraudulent activity.

Sincerely,

RSA Anti Fraud Command Centre

Tel: +44(0)800-032-7751 (UK)
Tel: +1-866-408-7525 (US)
Fax: +972-9-9566658 (EU)
Fax: +1-212-208-4644 (US)
E-mail: afcc@rsasecurity.com

http://www.rsa.com

For more information about RSA’s AFCC http://www.rsa.com/node.aspx?id=3348

Navy Federal Credit Union Legal Department
contact Julie Griffin
AVP., Telecom
Tel: 703.206.3327/ 571.283.9930/ 703.919.9939
email: Julie_griffin@navyfederal.org

*”Phishing” is an e-mail scam that attempts to trick consumers into revealing personal information, such as their credit or debit account numbers, checking account information, Social Security Numbers, or banking account passwords, through an imposter’s Web site or in a reply e-mail.

At first glance I thought the RSAS AFCC email was bogus because of the what appears to be some severely lacking English skills. For an official inquiry, the email was peculiarly worded. After all, RSA surely must employ personnel capable of coherent and literate English skills. It just seemed really odd to go after TechMiso for an article designed to help point out a fatal flaw with NFCU’s web site and inform users of a smarter way to login to the banks site.

But after performing a bit of checking I was unable to find anything to truly lead me to believe this was a phishing attempt or a falsified claim. So I immediately responded to the RSA Anti Fraud Command Centre as well as Julie Griffin, the NFCU representative RSA asked me to contact, with the following reply:

Did you people bother to even read the article written at “the domain” specified in your email? Or, do you merely allow your bot to crawl the Internet uninhibited so that it may send out potentially libelous communications without verifying the authenticity of such claims prior to their transmission?

The article, which coincidentally I authored, is written about a web security vulnerability on the navyfcu.org web site. Ironic how a blog devoted to technology is improperly targeted by a business whichclaims it is under contract with NFCU for “preventing or terminating online activity that targets, or may potentially target Navy Federal Credit Union’s clients as potential fraud victims,” especially when the article was written to help shed light on a security issue with
NFCU’s web site!

Might I suggest you consider looking at the navyfcu.org web site and resolving the issue I outlined in the article at the URL cited below? More importantly, is it too much to ask that a human actually read the article before an automated bot send out emails to web site owners without verifying the validity of any potential issues?

If you have a specific claim with the TechMiso article then please kindly clarify your concern without the use of a form letter. We are more than willing to assist because we care about NFCU and its customers, hence the article we wrote which addresses our concern with security vulnerability on navyfcu.org.

TechMiso has no reason to immediately shut down because there is absolutely nothing fraudulent in use. As I mentioned, if you have an issue then please clarify what your concern is.

I look forward to hearing back from you.

Best Regards,

Scott Jarkoff
Faithful NFCU customer

I received the following response from RSA, which essentially completely ignored anything relevant.

Dear Sirs:

RSA, an anti-fraud and security company, is under contract to assist Navy Federal Credit Union in preventing or terminating online activity that targets, or may potentially target Navy Federal Credit Union’s clients as potential fraud victims.

The problem with the material on the blog is that it suggests that Navy Federal’s website is not secure.

You claim in your Blog that you care about NFCU and its customers whereas the blog you wrote only confuses and frightens the customers.

The bank has asked RSA Security to try taking the offending blog down.

It is true that the first page isn’t https secured but it is secured in different ways.

We will forward the complaint to the bank regarding the first login page.

Sincerely,

RSA Anti Fraud Command Centre

Tel: +44(0)800-032-7751 (UK)
Tel: +1-866-408-7525 (US)
Fax: +972-9-9566658 (EU)
Fax: +1-212-208-4644 (US)
E-mail: afcc@rsasecurity.com

http://www.rsa.com

For more information about RSA’s AFCC http://www.rsa.com/node.aspx?id=3348

Navy Federal Credit Union Legal Department
contact Julie Griffin
AVP., Telecom
Tel: 703.206.3327/ 571.283.9930/ 703.919.9939
email: Julie_griffin@navyfederal.org

*”Phishing” is an e-mail scam that attempts to trick consumers into revealing personal information, such as their credit or debit account numbers, checking account information, Social Security Numbers, or banking account passwords, through an imposter’s Web site or in a reply e-mail.

Their stipulation is that the material on TechMiso suggests the NFCU web site is not secure? Uh, hello – it’s not. If you read the entire article then you will understand why we make the claim we’re making. I wonder if these people are required to pass some form of English comprehension prior to signing on with RSA.

At this point I really questions whether this was a valid claim or not. It seemed so peculiar, and lacked any legal basis, that I decided to ignore any further emails from the RSA AFCC. I ended up receiving nothing more from this supposed security company.

It was at this point that Jennifer Sadler, someone purporting to be an NFCU Public Relations employee commented on the blog post, thanking us for the post. As far as I was concerned, this was proof positive that NFCU did not have an issue with the post and recognized the issue with their web site.

Update 2 – August 12, 2009. After figuring that the “fight” with the RSA AFCC was over because I had not heard from them in almost a month, I was very surprised to see an email from SliceHost support with the subject line “Trademark Infringement” sitting in my Inbox this morning. It seems the attack dogs at the RSA AFCC have not had enough miso soup and were back for more.

Apparently not convinced by our earlier conversation, these clowns have resorted to making a trademark infringement claim, most likely on the small little graphic in the upper-right of the post. Fair use? Moron in a hurry test?

Here is the email in full:

Dear Customer,

We have received a complaint alleging that you are infringing on the complainant’s trademark rights. A copy of the complaint is attached hereto.

We have established the following procedure for handling trademark infringement complaints where our customers appear as respondents:
(1) Upon receipt of a complaint, we will forward it to you.
(2) If you agree to take down or otherwise disable access to the allegedly infringing content, we will notify the complainant. If you do not agree to so, we will require that the complainant furnish us with the following information:
a) Federal trademark registration numbers the complainant relies on for his rights in the trademark(s) at issue. The trademark(s) must be registered on the principal register and registrations must be issued and active (not pending, not expired, cancelled, or abandoned).
b) The owner of the furnished trademark registrations as it appears on record with the USPTO. The name of the complainant must appear as the registrant of record.
c) The complainant must submit a statement attesting that, to the best of his knowledge, you do not have any implied or express permission from the complainant or his authorized parties to use the mark(s) nor do you make fair use of the mark(s).
In the event the complainant is unwilling or unable to supply the information, as outlined above, we will not provide assistance.
(3) If the complainant is able to satisfy the above information requirements, we will advise you that the complainant’s asserted rights appear valid and serve you with a 30-day takedown notice. In the event of non-compliance within the 30-day period, and absent any legal process served by you on Rackspace, precluding Rackspace from carrying out the takedown, Rackspace will be required to proceed with disabling access to the allegedly infringing content.

Please be advised that in the event Rackspace has to comply with the takedown demands, and you believe that the complaint is unsubstantiated, Rackspace recommends that you consult with your attorney regarding options relieving Rackspace of such responsibility.

Thank you for your attention to this matter.

Regards,
Renee Graves
Rackspace AUP
——————————————————-
Dear Sirs:

RSA, an anti-fraud and security company, is under contract to assist Navy Federal Credit Union in preventing or terminating online activity that targets, or may potentially target Navy Federal Credit Union’s clients as potential fraud victims.

RSA has been made aware that a domain name, which abuses Navy Federal Credit Union’s trademark, has been registered with you. This domain http://techmiso.com/2434/navy-federal-credit-union-web-site-operating-wi
th-security-issue/ not only violates Navy Federal Credit Union’s copyright, trademarks and other intellectual property rights, but may also become a host to a phishing attack, or other fraudulent scams against the bank and the bank’s clients.

The fraudulent website not only represents a misuse of Navy Federal Credit Union’s intellectual property; its purpose is to mislead the Navy Federal Credit Union clients. Our experience has shown that such sites become a host of phishing** and other fraudulent scams against the bank clients.

Please take all necessary steps to immediately shut down the fraudulent website, terminate its availability to the Internet and discontinue the transmission of any e-mails associated with this website.

We understand that you may not be aware of this improper use of your services and we appreciate your cooperation.

We specifically would ask that you also take the following actions (if relevant or possible):

* Please provide us with a tar/zip file of the source code for
this site, so that we may analyze it to help prevent further attacks.
* If any customer data has been captured that is stored on your
systems or equipment, please send us that data so that the customers to
whom that data

relates can be notified and take steps to protect their credit.

* Please provide a copy of any records you maintain that indicate
the name, contact information, method of payment or similar information
that may be useful in helping learn the identity and location of the
customer for whom the website has been operated.
*

We specifically would ask that you also take provide a copy of any records you maintain that indicate the name, contact information, method of payment or similar information that may be useful in helping learn the identity and location of the customer for whom the website has been operated.

Thank you for your cooperation to prevent and terminate this fraudulent activity.

Sincerely,

RSA Anti Fraud Command Centre
Tel: +44(0)800-032-7751 (UK)
Tel: +1-866-408-7525 (US)
Fax: +972-9-9566658 (EU)
Fax: +1-212-208-4644 (US)
E-mail: afcc@rsasecurity.com

http://www.rsa.com

For more information about RSA’s AFCC

http://www.rsa.com/node.aspx?id=3348

[49450]
—-
Slicehost Support
support@slicehost.com

What a complete and utter set of lies by the RSA AFCC! NFCU needs to settle these attack dogs down. What is there to gain by going after TechMiso other than a hot, steaming bowl of miso soup goodness?

I opted not to remove the content and promptly responded to the good folks at SliceHost with the following:

Hello Renee,

Thank you for the email and for contacting me about the trademark complaint submitted by RSA.

I do not agree to take down or disable access to the content specified in the complaint because I stipulate there is no trademark infringement taking place. The content is not an attempt to mislead NFCU clients but, rather, to inform them about a serious long-standing security issue with the NFCU web site. I already rejected the entire claim when RSA contacted me directly.

The article in question displays an image depicting a small portion of the NFCU web site, specifically the account access login form, and is in no way infringing on any NFCU trademarks. The article delves in to a long-lasting security issue with the NFCU web site and does not make any attempts to misrepresent NFCU or its trademarks. Our use of any potential NFCU marks under this claim are fair use.

More importantly, the infringement claim does not pass the “moron in a hurry test” at all. Any user visiting the content in question will surely *not* be confused in to believing they are at an officially sanctioned NFCU web site. For more information on the “moron in a hurry test” please visit http://en.wikipedia.org/wiki/A_moron_in_a_hurry

As I already mentioned, I have been in contact with RSA regarding this matter. They emailed me directly and I responded saying we will not remove the content because there is no infringement, misrepresentation or attempt to phish NFCU clients. In fact, an NFCU representative that RSA asked us to contact ended up commenting on the blog post, offering thanks for pointing out the security flaw.

In any event, thanks again for the email. Please let me know how you would like to proceed at this point.

Best Regards,

–
Scott Jarkoff

http://techmiso.com/

It should be interesting to see what type of response this generates. I am very interested in pursuing this and seeing how far the rabbit hole leads and where we end up.

Update 3 – August 15, 2009. I had not had an opportunity to update the site yesterday due to a very busy day at work. The latest actually arrived in my inbox Friday morning, August 14, 2009. The most recent email I sent to SliceHost, in response to the take-down notice RSA sent our hosting provider, seems to have convinced RSA to back down. The wonderful folks at SliceHost support sent me the following concise email:

Hello Scott,

I just received the following response from the complainant.

I will go ahead and close the ticket at this time. We will continue to monitor the incoming complaints and will let you know if something arises. Thanks for your cooperation in this matter. If you have any further questions or concerns, please feel free to contact us!

Kindest Regards,
Renee Graves
Rackspace AUP

—————————————————————————————————————
Dear Rack Space Team,

Please disregard the shut down request email below.

Best Regards,
RSA AFCC

I am very glad to see RSA has opted to stop fighting such a pointless battle. They would have made better use of their time and energy working to reconcile the issues with the NFCU web site rather than attempting to silence a blog aimed at helping inform their customers (incidentally, I am an NFCU customer so I care about this stuff) of a long-standing security issue.

I want to thank the SliceHost Support Team for their kind, professional and very helpful assistance with this issue. In this day and age, it is nice to have a provider who comprehends these types of issues and does not automatically act to disable a web site without allowing their customers to first respond to the take-down notice. This is a testament to their excellent customer service, and clearly depicts why SliceHost is one of the most popular web hosts these days.