Re: [Full-disclosure] Bank Of America Vulnerable

[nocfed <nocfed@xxxxxxxxx>]

On 11/3/07, Jamal Al-Aseer <suproot@xxxxxxxxx> wrote:
> Dear SF,
> I am writing this to inform the public that bank of America's two step
> authentication is fundamentally flawed. The user at there website will
> enter a user name then tell there systems which state it originates
> from but the next step is flawed. The server connects you to a secret
> challenge where it gives a question like "Whats your mothers maiden
> name?" but if you were to answer "Joni" it lets you in. On step 1 of
> this authentication you answer "Jon i" or "Jni "  it lets you in, I
> found a couple times the server did not mind a letter missing as long
> as the beginning is kept the same; Also moving the word or letters
> with spaces allows entrance. This is a common vulnerability in fact
> the Point Of Sale at the company I work for allows 3 letters of your
> password to be entered and it usually authenticates because it isn't
> strict on how precise you enter the password as long as it appears to
> be the original password.
>
> Superuser of Socal

And the 3rd step... you know, the actual Password.  Is that a loose
password as well?
It looks like it is just the challenge question that allows this loose matching.

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/