SiteKey Security Can Be Defeated

A SiteKey shielded site is slightly more difficult to fake than others. The key difference is that an attacker must create a 'proxy' to relay a small amount of information between the victim (viewing the fake site) and the legitimate web server. The scripts for a server or bot-infected computer1 to carry this out would be simple to create and are well within the means of an attacker seeking a financial payoff. Complicating matters, Bank of America promotes extreme confidence in SiteKey that could unintentionally persuade an otherwise skeptical customer that a fake site is real.

On every computer from which a customer accesses a BofA account, SiteKey may store a token that permanently bypasses the 'challenge questions' and permits account access with just a user name and password. The bypass token is held in persistent storage on each computer, can be replayed, is long-lived, and may be copied from one computer to another.

The gist of their response is that SiteKey is one of many components - some visible outside the bank, some not - that comprise a holistic strategy against phishing and other crimes.

The representatives' sense of this report is that it is accurate but misleading in that it addresses a risk in an isolated element of a larger security apparatus.