Banking websites are 'turkey shoot for hackers'

Most UK financial services firms have basic IT security flaws that could cause online banking services to become a "turkey shoot for hackers".

The banking sector came off worst in a survey of 600 network security tests by consultancy NTA Monitor across a broad range of large blue-chip firms.

It found 94 per cent of financial organisations have basic router flaws that could cause online banking services to fail. The Vertical Market Security Report 2003 also found almost half of financial firms had firewall flaws.

Worryingly, almost a third had at least 10 security flaws, greatly increasing their exposure to a malicious attack. And the picture has not improved since last year, which showed similar levels of security vulnerabilities in the sector.

Roy Hills, technical director at NTA Monitor, said in a statement that router flaws can allow a malicious hacker to prevent any internet traffic entering or leaving a gateway and disrupt services.

"Tighter security across all areas needs to be made a priority today and the holes plugged quickly – or this could become a turkey shoot for hackers."

Despite this, the financial sector still performed best overall compared to the government, legal and IT sectors. Firewall flaws, for example, were found in 82 per cent of legal firms.

Hills put the gaps down to complacency and a lack of awareness and said most flaws are so basic they could be fixed in under 20 minutes.

One of the main router vulnerabilities is allowing unrestricted access to services on border routers, which could leave a firm open to denial of service attacks. The problem, according to Hills, is that routers are typically outside the corporate firewall and mostly managed by the firm's ISP.

Resilience border routers can still be easily taken out, said Hills: "These resilient devices are typically of the same software type and version and each one could likely be susceptible to the same bug and be knocked out the same time."