NatWest mobile banking fail and why real innovation in security is needed

Not a good week for NatWest innovative banking services. 

NatWest Get Cash fraud  (Get Cash Pulled)

A combination of a simple phishing attack and a fundamentally insecure service led to many users of the Get Cash service ( a sub set of the NatWest mobile banking app – powered by Monitise) being defrauded of cash from their accounts.   

The system allows users to get cash from an ATM by keying in a ‘secure cash code’ into the terminal.    The assumption is that once you have logged in to your app you are legit and so you ping the system for the code.   A user name and password level of security – that’s it!.   No better than 99% of all apps on the Net today.   

Needless to say the service was shut down once the fraud started becoming rampant.   

Does the drive for customer convenience completely outweigh basic security rules. ?   The problem with this kind of solution and others that rely on the presentation of self reported credentials i.e. user name and password are that these stateful artifacts are vulnerable to interception and re-use by a non-legitimate party i.e. the hacker, in this case through a phishing attack.  The system does not know that the credentials being presented are being done so by the ‘wrong’ person.   

Any security system worth its salt (pun intended) thus needs to rid itself of the baggage of years and years of ‘traditional’ security solutions such as certificates, tokens, java-script scraping, cookies passwords, keys and OOB.  All shared secrets - incarnations of ‘security by obscurity’.  (The problem with Passwords ) (The end of passwords)

Modern day hackers can crack passwords in seconds and bypass the defences laid by these solutions.   The conundrum for CIO’s and CSO’s is to find the balance between usability and efficacy.   As I stated in a previous blog – I am sure that most sites and custodians of your security are actually indifferent to your privacy and your security, hence the weakness of the solutions implemented.   Here is an example of just how weak the ‘latest’ technologies are :  
(The failure of RFID ) 

Imagine if there were solutions that harnessed the ubiquity of SSO’s but were also strong in the 2FA sense.   In order to have universal appeal new solutions need to work in the BYOD / mobile domain.  No more needs to be said about the proliferation of smart mobile devices.   Effective solutions need to be easy for decision-makers to get and try out.  Gone are the days of lengthy POC’s and trials.   In the same way that consumers can try out tracks on iTunes and return unwanted products to sites like Zappos,  so security solutions should  be as easy to try out for free and get if they work and cancel if they don’t.   I think that professional services will take a big hit in the enterprise arena.   No longer required with SAAS. 

We have already seen RSA take a big hit last year when its own defences were breached.   We are now at the stage that the Lance Armstrong’s of the security industry (i.e. those who have pulled the wool over the eyes of their customers for many years ) are going to be exposed as their solutions fail on an ever increasing basis.   

It is time for security to come clean.  Only those solutions that are truly innovative will succeed.   When someone like the founder of Wikipedia says that a security failure could bring down a company like Facebook  (Security breach could bring down Facebook) maybe its time to wake up.