Impact case study database

We have directly benefited global banks, stock traders, cryptocurrency and VPN service providers, and their millions of customers across four continents by developing an automated tool, Spinner, which detects cryptographic protocol failures in security applications. Spinner has significantly mitigated against future losses by improving methods in security-critical applications and improving existing technology. This commercial and economic impact is a consequence of the responsible disclosure we made to banks, with the support of the Government Communications Headquarters (GCHQ) and the Centre for the Protection of National Infrastructure (CPNI), of the vulnerabilities identified by the underpinning research [KF1, KF2].

As we move towards a cashless society, the security of our internet banking infrastructure is becoming more critical. The magnitude and likelihood of potential losses due to security failures is enormous. In 2019, more than 25,000 incidents of internet banking fraud amounted to losses of over £111M in the UK alone [S1]. Besides the economic impact on the banks, there is also a socioeconomic aspect, as banks typically refuse to refund transactions where the right credentials have been input [S2]. We have shown that existing flaws in the banks’ own apps enable fraud [KF1]. [text removed for publication] Our research and subsequent intervention prevented this negative impact and protected tens of millions of customers globally from falling victim to fraud.

Table 1 shows the apps that we identified as vulnerable in the underpinning research [KF2] together with their respective numbers of users. They all had insecure TLS connections that exposed their users’ credentials, and therefore their bank accounts, to attackers and fraudsters.

Table 1: Vulnerable banking apps identified by the underpinning research

After identifying these flaws, we initiated a process of responsible disclosure that directly led to changes in existing technologies (the apps) and the adoption of improved security methods. Using the knowledge and recommendations we provided to them, financial and VPN service providers were able to patch their software.

We first informed [text removed for publication] on 27 February 2015 of the vulnerabilities in their app. These vulnerabilities, identified using Spinner [KF2], had been missed by two pentesting companies. One week later, [text removed for publication] pushed a fix. Afterwards, a similar process was carried out with [text removed for publication]. After these disclosures, it was evident that a more scalable approach to vulnerability disclosure was needed. [text removed for publication]

The reach and significance of our work is attested by improvements across global banking and financial service providers and by the stimulation of policy debate between [text removed for publication] and the UK financial sector on responsible disclosure. [text removed for publication]

As a result of our disclosures, all of the affected apps have been fixed, to the benefit of both the respective banks and their customers. Some of the largest affected banks have made public statements acknowledging our contribution to fixing their apps, including HSBC: ‘We thank the University of Birmingham for the opportunity to work together, and we have already taken steps to address this’ [S4] and Bank of America: ‘The vulnerability identified in this report [R1] was resolved in Bank of America’s health app in January 2016’ [S4].

To ensure the continued impact of our research, we released the Spinner tool as open source in December 2017 so that pentesting companies are free to use it. Spinner’s availability and a wide range of national media coverage in late 2017 [S5, S6, S7, S8, S9], led to international recognition of the importance of our research and impact. [text removed for publication]

Taken together, we have improved the security of mobile apps across the sector, benefiting companies, customers and the economy more broadly. A measurement study of 20 banking apps conducted by one of our students shows a sharp increase in the prevalence of certificate pinning [S10, section 3.2.2]. Significantly, the study quantifies the impact by showing that each of the banking apps using certificate pinning in 2019 does so correctly and securely [S10, section 3.4].