HomeCalendarCertificationsColumnsFeaturesForumResourcesVitals
 
Image
 
linkedin_logo.png rss_logo.jpg
twitter_logo.png youtube_logo.jpg
Latest Additions
 
EH-Net Login
Welcome Guest.
Lost Password?
No account yet? Register
Who's Online
We have 37 guests online
 
Advertisement

You are here: Home arrow Resourcesarrow News from the Outside Worldarrow Citi Discloses Security Flaw in Its iPhone App
EH-Net
May 20, 2013, 08:33:35 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Go back to The Ethical Hacker Network Online Magazine Home Page
 
   Home   Help Calendar Login Register  
Pages: [1]   Go Down
« previous next »
  Print  
Author Topic: Citi Discloses Security Flaw in Its iPhone App  (Read 4812 times)
0 Members and 1 Guest are viewing this topic.
Manu Zacharia (-M-)
Sr. Member
****
Offline Offline

Posts: 393


c0c0n Hacking Conference - where hackers unite


View Profile WWW
« on: July 26, 2010, 10:53:31 PM »

Quote
Citigroup Inc. said its free U.S. mobile-banking application for Apple Inc.'s iPhone contained a security flaw and advised its customers to upgrade to a newer version that corrects the problem.

In an incident that highlights the growing security challenges around wireless apps, Citi said its iPhone app accidentally saved information—including account numbers, bill payments and security access codes—in a hidden file on users' iPhones. The information may also have been saved to a user's computer if it had been synched with an iPhone.

Read more about it here
Logged
Manu Zacharia
MVP (Enterprise Security), ISLA-2010 (ISC)˛, C|EH, C|HFI, CCNA, MCP,
Certified ISO 27001:2005 Lead Auditor

There are 3 roads to spoil; women, gambling & hacking. The most pleasant with women, the quickest with gambling, but the surest is hacking - c0c0n
hayabusa
Hero Member
*****
Offline Offline

Posts: 1631



View Profile
« Reply #1 on: July 27, 2010, 07:23:00 AM »
'accidentally saved information'

I'm sorry... as big as Citigroup is, and with all of the attention they're already getting, it's ridiculous that someone hadn't tested and seen this, previously.  When you're dealing with portable devices, and banking industry security, standards and regulations, IMHO there's absolutely NO excuse for this type of 'accidental oversight.'

Said programmers should be 'accidentally' let go...
Logged
~ hayabusa ~ 

"All men can see these tactics whereby I conquer, but what none can see is the strategy out of which victory is evolved." - Sun Tzu, 'The Art of War'

OSCE, OSCP , GPEN, C|EH
Knb15
Jr. Member
**
Offline Offline

Posts: 50


View Profile
« Reply #2 on: July 27, 2010, 09:54:36 AM »
"The bank doesn't believe any personal data was exposed by the flaw."

"We have no reason to believe that our customers' personal information has been accessed or used inappropriately by anyone,"

In addition to what hayabusa said, i really doubt that during the time that this app has been released and now, that no one else found this vulnerability and perhaps accessed or used it.
Logged
yatz
Full Member
***
Offline Offline

Posts: 222


View Profile WWW
« Reply #3 on: July 27, 2010, 10:57:42 AM »
Quote from: hayabusa on July 27, 2010, 07:23:00 AM
'accidentally saved information'

I'm sorry... as big as Citigroup is, and with all of the attention they're already getting, it's ridiculous that someone hadn't tested and seen this, previously.  When you're dealing with portable devices, and banking industry security, standards and regulations, IMHO there's absolutely NO excuse for this type of 'accidental oversight.'

Said programmers should be 'accidentally' let go...

I was thinking the same thing when I read the article.  How can the data be accidentally saved?
Logged
"Live as though you would die tomorrow, learn as though you would live forever."

CCNA, MCSA, MCTS, Sec+, Net+, Linux+, CEH
Pages: [1]   Go Up
  Print  
« previous next »
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.18 | SMF © 2013, Simple Machines
Joomla Bridge by JoomlaHacks.com 		Valid XHTML 1.0! Valid CSS!
Page created in 0.088 seconds with 22 queries.
 
Exclusive Deal

sansfire13_245x90_cw90.jpg
SANSFIRE 2013
June 15 - 22

5% Off w/ Code: EHN_5

SANS Deals 4 EH-Netters
5% OFF Any SANS Course in Any Format!
Coupon Code: EHN_5 Including SANS Rocky Mountain 2013 & SANS Boston 2013
Polls
Compared to this year, 2013 will be:
 
Recent Forum Topics
EH-Net News Feeds
Latest Additions
 
         
Free Business and Tech Magazines and eBooks

© 2013 The Ethical Hacker Network
Joomla! is Free Software released under the GNU/GPL License.