The Members Forum

A number of wireless banking applications for iPhone and Android phone users contain privacy and security flaws that cause the phones to store sensitive information in cleartext that could be gleaned by hackers, according to a report.

The applications distributed by such top banks and financial institutions as Wells Fargo and Bank of America placed various types of information at varying degrees of risk. But at least one Android application, distributed by Wells Fargo, stored an account holder’s user name and password on the phone in cleartext. The application also stored account balances on the phone, according to a security researcher who spoke with the Wall Street Journal.

The applications store the information in the phone’s memory, allowing an attacker to easily glean it from the phone by tricking the user into visiting a malicious website. An example would be sending the user a phishing e-mail containing a link to the malicious site.

A financial-services application by the United Services Automobile Association was found to store a mirror image of the banking webpage the phone user visited, which could reveal the user’s account balances and transactions, as well as the routing numbers, which can be used to conduct electronic money transfers if a hacker also obtains the account number. The application didn’t store the account holder’s user name and password, but an attacker might obtain this information through a more targeted attack against the account holder’s phone if he determines the bank balance revealed on the phone makes the extra effort worth it.

Bank of America’s application also didn’t save user names and passwords, but it did save the answer to a secondary security question in cleartext. An account holder is asked the extra question only if the bank’s website determines that the user is trying to log in from a device it doesn’t recognize — such as from a phone or computer he doesn’t normally use to conduct banking.

Andrew Hoog, chief investigative officer for viaForensics, said that only one of the seven applications his group examined contained no such security flaw. That application is distributed by the Vanguard Group.

Both Wells Fargo and USAA told the Journal that they had fixed the problem in updated applications released on Wednesday. Bank of America said it would be tweaking its application in a new update it would distribute in a few days.

Wired has the details HERE!