Web encryption analysis of internet banking websites in Thailand

Name: Suphannee Sivakorn

Organization : Rajamangala University of Technology Tawan-ok. Faculty of Science and Technology

Email : suphannee_si@nnutto.ac.th

Name: Patsita Sirawongphatsara

Organization : Rajamangala University of Technology Tawan-ok. Faculty of Science and Technology

Email : patsita_si@nnutto.ac.th

Name: Nuttaya Rujiratanapat

Organization : Rajamangala University of Technology Tawan-ok. Faculty of Science and Technology

Email : nuttaya_ru@nnutto.ac.th

ThaSH: Internet banking -- Thailand -- Security measures

ThaSH: Computer network resources -- Evaluation

Abstract: With Thailand rapidly moving to a full internet banking ecosystem, the demand for online security has never been needed more than it is today. As the security and privacy of internet users depend on HTTPS, a web encryption protocol, for securing communication between users and web servers, HTTPS is essentially the center of the web ecosystem today. Unfortunately, despite the increasing number of HTTPS adoptions, numerous studies have shown that a large number of websites have adopted HTTPS incorrectly, rendering users vulnerable to information leakages e.g., eavesdropping and manin- the-middle attacks. The correctness of HTTPS deployment is even far greater for internet banking services due to carrying user's sensitive information and being prime targets for criminal activities. In this paper, we present WEAPONS, a novel black-box testing tool for evaluating the completeness and correctness of web encryption deployment including the deployment of HTTPS, and web encryption-related mechanisms i.e., HSTS, secure cookie, HTTPS redirect, HSTS preload. We use WEAPONS to conduct an assessment of 9 popular internet banking websites in Thailand during January - February 2020. We demonstrate that WEAPONS is able to find HTTPS deployment incorrectness. Several of these weaknesses can expose the affected services to man-in-the-middle attacks and sensitive data exposure.

King Mongkut's University of Technology North Bangkok. Central Library

Address: BANGKOK

Email: library@kmutnb.ac.th

Created: 2020

Modified: 2023-11-16

Issued: 2023-11-16

บทความ/Article

application/pdf

BibliograpyCitation : In King Mongkut's University of Technology North Bangkok Faculty of Applied Science. The 17th International Joint Conference on Computer Science and Software Engineering (JCSSE 2020) (pp.139-144). Bangkok : King Mongkut's University of Technology North Bangkok

eng

©copyrights King Mongkut's University of Technology North Bangkok

ลำดับที่.	ชื่อแฟ้มข้อมูล	ขนาดแฟ้มข้อมูล	จำนวนเข้าถึง	วัน-เวลาเข้าถึงล่าสุด
1	JCSSE 2020pp.139-144.pdf	8.44 MB

ใช้เวลา

0.033688 วินาที