Many of the organizations improved their setup since then, and it became quite troublesome to manually check each bank and each change, update the table and so on. It’s also good to have not just a snapshot in time, but a continuous record of how they were doing.

Thus I’ve hacked together some monitoring scripts, put the results online, and here’s the Taiwan Financial Institute SSL Status page.

Page features include:

• Automatically run once a day
• Highlighting issues, showing grade evolution
• RSS feed of grade changes
• Automatic tweeting of daily status and changes as @twbankssl

This is quite a bit more than “minimal features”, but wanted to make something that is actually useful.

Notes on the tech

In a nutshell:

• to run the SSL Test queries, I’m using ssllabs-scan, a official program written in Go to do just that.
• scrapting is parallelized and managed by a Python script.
• the results are parsed and output JSON, RSS, tweets are generated by another Python script.
• the site displays the results as a single-page app, pulling in the results through the generated JSON file.
• the grade sparklines are using an external library.

All the code is open source on Github. Tried to make it reusable for people wanting to monitor any other sets of sites (eg. other countries’ banks, government institutions, own sites), though I did not completely succeed. There are hard-wired parts that could use a rewrite, but can be a starting point for any other project for sure. By the way, patches / pull requests are welcome if you see something could be improved!

Future

I hope to leave the scripts and page running for a while to see whether it actually works autonomously, whether it’s useful for anyone, and as a tool to push for change for these financial institutions. Will also try to connect to people here in Taiwan who can make that change happen faster.

Some code rewrite and expanding the documentation is also inevitable – once my current coffee high has been metabolized. :)

What do you think? How would you use this data, or how you’d improve on the service?

The post Taiwan Bank SSL Continuous Monitoring appeared first on ClickedyClick.

SSL Test Overview

I had a list of 43 banks, and for a quick overview I took into account a few key features only. The first is whether there are any active vulnerabilities against the site according to the test (these were mostly CRIME, FREAK, and POODLE attacks). The second is whether RC4 encryption was enabled, as it is now prohibited, and having it on is an automatic Payment Card Industry Data Security (PCI) compliance failure, according to one of the commenters. Other various warnings are mentioned when something really stands out, they are not crucial but more nice to have (though I’d contend that Forward Secrecy and HTTP Strict Transport Security is more than “nice” for anything financial).

Edit: Since publishing this post, there’s a brand new password recovery attack against RC4, so it’s even more urgent to switch it off.

Test Outcome

The only A rating was for Deutsche Bank, which uses its global site for all regional sections too, so not that surprising that it was better than average. The rest of it in a nutshell:

• 22 out 43 banks (51%) got an F,
• 2 of them did not have SSL (though no online banking either, fortunately),
• 1 SSL enabled site couldn’t be tested somehow, possibly because of redirections
• Only 4 of them (9%) disabled RC4, the rest of it (91%) is vulnerable to password recovery attacks,
• 24 of them (56%) are vulnerable to common attacks, 5 (11%) to multiple different attacks (besides RC4), POODLE being the most common
• There was one site where the general corporate website’s HTTPS was better configured (B) than the e-banking (F)…
• Handling redirects and subdomains is generally very confusing for banks
• Most banks have multiple subdomains for different services (“bank site”, “e-banking”, and “web ATM” are the three most common)
• Of the 4 banks I have account at, there’s one B and three F-rated (not naming names)

The raw overall data and test links follow (with an outlook afterwards). Usually I’ve linked to the e-bank pages of banks, unless I couldn’t see it or was the same domain as their corporate site.

Update (2015-03-19): Some banks started to fix their systems, noticed changes will be added to the bottom of this post!

Update (2015-03-25): Instead of keeping up with the changes manually, made a page for automatic status tests. It’s still in development but you can check it here: Taiwan Financial Institutes SSL Tests.

Taiwanese Bank SSL Test Results

What’s next?

Financial fraud in Taiwan is pretty prevalent, though it’s usually the “old fashioned” phone scam type. On the other hand, people here seem to be very lucrative target of groups based in China and Philippines. While I don’t know about the latter, the former likely has black hat teams with a lot more computer savvy than most users here (or anywhere else). It would be very-very good to fix up these systems.

Since these banks don’t seem to be on Twitter in general (except maybe the international ones), would be good to look up the local tech contacts, and bring the problem to their attention. One thing that makes me optimistic about it on the long term, is that Taiwan has a lot of computer savvy and outspoken activists. Will try to reach out to them, and use the local talent (and local ways) to approach this. Also, local administration (ie. city government) seems to be more powerful here, and we have a quite techy and driven new mayor in Taipei city. Putting pressure on the banks through them is not inconceivable.

I like it a lot where technology is going over here (many days I feel like being in a science fiction), and hope to make it work out well by keeping an eye on the practical implementations such as this.

If you find any problems in the dataset above (or any updates as sites are fixed:), please let me know!

Updates

• 2015-03-19: Chinatrust fixed their POODLE vulnerability, improving their score from F to B! Hope they’ll fix RC4 next.
• 2015-03-19: Bank of Taiwan went from F to A-, the first Taiwan-based bank to achieve an A!
• 2015-03-23: The ANZ Credit Card site went from F to B as well, which is pretty good, even if their corporate site remains F.
• 2015-03-24: Mega Bank went from B to A- by disabling RC4.

The post SSL status of Taiwanese banks: a sad affair appeared first on ClickedyClick.