EDIT: ING is now A- (not reflected in this blog post).
EDIT 2: Keytrade & Hello Bank also went to A. I’ll post a new blog post later tonight.
EDIT 3: Updated post here.
Part three, or how I single-handedly “fixed” SSL at the Belgian banks. 😉
Part one and two are available here. Not related but useful nonetheless NY Times article about bank hackers.
Argenta promised to fix their SSL, so it’s the time to check everything again.
TL;DR: Only Argenta’s status changed for the better.
Those that did not change:
- Rabobank: A+
- Triodos: A+
- Belfius: A-
- BNP Paribas Fortis: A-
- bpost bank: A-
- AXA: B
- beobank: B
- CPH: B
- KBC: B
- Keytrade Bank: B
- Crelan (internet banking): B
- Hello bank!: C
- Bank Van Breda (internet banking): C
- BvB no longer supports secure renegotiation (which, afaik, it did before). However, it’s still rated as C, as this isn’t a real issue.
- ING: F
- Record Bank (internet banking): F
Those that did change:
- Argenta (internet banking): F to B
- No longer vulnerable to POODLE,
- Support for protocol downgrade attacks prevention,
- Still using SSL3 (obsolete and insecure),
- Weak signature (SHA1),
- RC4 cipher is supported (insecure),
- No Forward Secrecy.
Still a little way to go for Argenta, but it’s on the right path.
Those that I hadn’t tested before:
- VDK: B
- ABK: F
- MeDirect Bank: F
- Ogone: C (technically not a bank, and promised a fix, but it got delayed).
The entire list updated:
Grade A
- Rabobank (A+): no known issues. Support for HTTP Strict Transport Security and prevented downgrade attacks.
- Triodos (A+): no known issues. Support for HTTP Strict Transport Security and prevented downgrade attacks.
- Belfius (A-): weak signature (SHA1), no Forward Secrecy.
- BNP Paribas Fortis: (A-) weak signature (SHA1), no Forward Secrecy.
- bpost bank: (A-) weak signature (SHA1), no Forward Secrecy.
Grade B
- Argenta: no SSL on main page.
- internet banking: SSL3 (insecure), weak signature (SHA1), RC4 (insecure), no Forward Secrecy.
- AXA: weak signature (SHA1), SSL3 (insecure), RC4 (insecure), no Forward Secrecy.
- beobank: weak signature (SHA1), no TLS 1.2, RC4 (insecure), no Forward Secrecy.
- CPH: no TLS 1.2, RC4 (insecure), no Forward Secrecy.
- KBC: weak signature (SHA1), no TLS 1.2, no Forward Secrecy.
- Keytrade Bank: weak signature (SHA1), RC4 (insecure).
- VDK: SSL3 (insecure),no TLS 1.2, weak signature (SHA1), RC4 (insecure), no Forward Secrecy
- Crelan: no SSL on main page.
- internet banking: weak signature (SHA1), SSL3 (insecure), no TLS 1.2, RC4, no Forward Secrecy.
Grade C
- Hello bank!: vulnerable to POODLE attack, weak signature (SHA1), RC4 (insecure).
- Bank Van Breda: no SSL on main page.
- internet banking: vulnerable to POODLE attack, weak signature (SHA1), no TLS 1.2, no Forward Secrecy, no support for secure renegotiation.
- Ogone: payment facilitator
- weak signature (SHA1), RC4, vulnerable to POODLE, no Forward Secrecy
Grade D
- n/a
Grade E
- n/a
Grade F
- ABK: SSL2 (insecure), vulnerable to POODLE attack, weak signature (SHA1), RC4 (insecure), no Forward Secrecy, no TLS 1.2.
- ING: vulnerable to POODLE attack, SSL3 (insecure), weak signature (SHA1), RC4 (insecure), no Forward Secrecy.
- MeDirect Bank: vulnerable to POODLE attack, OpenSSL CCS vulnerability (quite bad),
- Record Bank: no SSL on main page.
- internet banking: vulnerable to POODLE attack, RC4 (insecure), no Forward Secrecy.
Information about SSL Labs grading can be found here. Grade A (+) being the best possible ranking, and F the worst.
Also, shame on you ING. More than any other bank.
Leave a Reply…