Researchers expose weaknesses in financial security

Concerns have been raised over potential security flaws in the system used by banks to protect PIN numbers from attack by fraudsters.

Researchers from Cambridge University have warned that the computer systems used to pass along information from cash machine to personal accounts are more easily intercepted than previously thought.

The weakness in the process lies in the cryptoprocessors – the ‘black boxes’ that scramble the details given to the cash machine by the user. These machines then also scramble the program used by the bank’s computers to check the validity of the PIN number entered. It is generally thought that such defence mechanisms afford a high degree of security – with the devices even designed to self-destruct if physically tampered with.

However, security experts have found that there are weaknesses in the system at the points where the different programs exchange information. Exploiting such weaknesses, researchers Michael Bond and Richard Clayton have been able to hack into machines previously thought inaccessible to outside attack.

Mr Bond explained: “Cryptoprocessors are the mainstay of the banking world. A lot of cryptoprocessors are built around the same design and they will have the same kind of faults.” He went on to detail how insiders within banking organisations could utilise the weaknesses to find out a wide range of financial security information.

Mr Clayton added: “A crooked bank manager could duplicate our work on a Monday and be off to Bermuda by Wednesday afternoon.” (CL)