Re: [PEN-TEST] Home-Banking PEN-TESTING

[Iván Arce <core.lists.pentest () CORE-SDI COM>]

Rafael Coninck Teigao wrote:
> Hi, ppl.
>     I'm pen-testing a home-banking system. My client has a doubt and we
> basically disagree in some level: is the client's machine of the
> responsibility of the bank? I mean, if I can break the client's machine
> and steal useful information from it (passwords, account's data, etc.),
> is the bank responsible, having in mind that it's programmers can fix
> the problem (they just don't do it 'couz it is costly)?
>     Let me hear what you think.

I would say that the bank is responsible ONLY if they are pushing any
sort of software component to the clients machine and that software
component has a flaw that allows attackers to gain access to the
customer's data either on the server or the client or otherwise
comprise the customers security.

then again, im not familiar with the particular home banking system
you are targeting so YMMV
-ivan

--
"Understanding. A cerebral secretion that enables one having it to know
 a house from a horse by the roof on the house,
 It's nature and laws have been exhaustively expounded by Locke,
 who rode a house, and Kant, who lived in a horse." - Ambrose Bierce


==================[ CORE Seguridad de la Informacion S.A. ]=========
Iván Arce
Presidente
PGP Fingerprint: C7A8 ED85 8D7B 9ADC 6836  B25D 207B E78E 2AD1 F65A
email: iarce () core-sdi com
http://www.core-sdi.com
Pte. Juan D. Peron 315 Piso 4 UF 17
1038 Capital Federal
Buenos Aires, Argentina.              Tel/Fax : +(54-11) 4331-5402
Casilla de Correos 877 (1000) Correo Central
=====================================================================

--- For a personal reply use iarce () core-sdi com