On 11/3/07, Jamal Al-Aseer <[EMAIL PROTECTED]> wrote: > Dear SF, > I am writing this to inform the public that bank of America's two step > authentication is fundamentally flawed. The user at there website will > enter a user name then tell there systems which state it originates > from but the next step is flawed. The server connects you to a secret > challenge where it gives a question like "Whats your mothers maiden > name?" but if you were to answer "Joni" it lets you in. On step 1 of > this authentication you answer "Jon i" or "Jni " it lets you in, I > found a couple times the server did not mind a letter missing as long > as the beginning is kept the same; Also moving the word or letters > with spaces allows entrance. This is a common vulnerability in fact > the Point Of Sale at the company I work for allows 3 letters of your > password to be entered and it usually authenticates because it isn't > strict on how precise you enter the password as long as it appears to > be the original password. > > Superuser of Socal
And the 3rd step... you know, the actual Password. Is that a loose password as well? It looks like it is just the challenge question that allows this loose matching. _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
