Researchers from the UK have uncovered a serious vulnerability in the way nine banking and VPN apps handle encrypted communication that puts tens of millions of users at risk of man-in-the-middle (MitM) attacks. Among those impacted are two of the largest global banks - Bank of America and HSBC - as well as one of the world's most popular VPN providers, TunnelBear.
"Our tests find that apps from some of the world's largest banks contain the flaw, which if exploited, could enable an attacker to decrypt, view and modify traffic - including log-in credentials - from the users of the app," write Chris Mcmahon Stone, Tom Chothia, and Flavio Garcia of University of Birmingham, who detailed the discovery in a paper released yesterday.
The findings came as part of a study involving a new blackbox automated-testing...(continued)
