Online Banking Security
Examines application layer security, transaction signing vulnerabilities, and authentication weaknesses in online banking platforms.
Summary
Arkadiy Litvinenko, Lead Penetration Tester at BI.ZONE, explores security risks inherent in modern digital banking platforms, analyzing vulnerabilities across web and mobile banking architectures. He outlines how intense commercial competition forces financial institutions to rapidly deploy digital features, frequently introducing logic flaws, API security weaknesses, and authentication oversights.
Litvinenko details remote banking architecture and API communication models at 03:00, followed by frontend and client-side testing methodologies at 10:00. He walks through real-world attack scenarios, including currency exchange rounding attacks at 20:00 where fractional cent truncation enables illicit profit. At 30:00, he analyzes flawed OTP (One-Time Password) rate limiting that allows brute-force transaction approvals, insecure pseudorandom number generators in financial workflows at 40:00, and mobile client flaws where biometric and PIN authentication fail to properly protect KeyStore/KeyChain tokens at 48:00.
(AI summary — Gemini Flash)
Related talks
OWASP Foundation·30 min
Analysts investigate attack surfaces and defenses concerning AppSec EU 2017 Analysis And Detection Of Authentication Cross Site Request Forgery by Luca Compagna.
Main Stage·34 min
S Pratap Singh · J Lin · D Seetoh
Demonstrates architectural and implementation weaknesses in commercial passkey syncing and WebAuthn relying party implementations.
App Sec Village·26 min
Kelley Robinson
Evaluates modern two-factor authentication protocols, phishing resistance, and future directions for identity verification.