Saturday, June 6, 2015

SSL/TLS security overview of forex web cabinets

Recently, I saw few reports on how banks doing with SSL/TLS security. Reports included internet-banking portals from various countries. For instance: UK, The Netherlands, even Russia.

As I work in forex industry, I decided to have a look how they are doing. Qualys SSL Test tool was used.

First of all, I'd like to say, that sometimes it was really hard to find a user portal/cabinet/etc. on some broker pages. Really guys, do something about it. Hiding it won't make it more secure.

Report date: 06 May 2015
Forex brokers are sorted in alphabetical order.

BrokerURLScoreSSL3SSL2SHA1TLS1.2DHRC4FSPOODLEHeartbleedFreakLogjamCCSHSTSOSCP
Admiral Marketshttps://tr.admiralmarkets.comС-++-----++++--
Alfa-Forexhttps://my.alfa-forex.ruB++++-++++++++-
Alparihttps://my.alpari.comA+++++++++++++++
AMarketshttps://office.aforextrading.comA-++-+++-+++++--
Ayondohttps://social.ayondo.comB-++++--+++++-+
BCS Forexhttps://login.forex-bcs.ruB++++-++++++++-
CitiFXhttps://web.citifxpro.comС++--+--++++++-
DeltaTradehttps://delta.tradeB++++-+++++++--
Dukascopyhttps://live-login.dukascopy.comB++++---+++++--
EasyForexhttps://secure.easy-forex.comB+++++--+++++--
Etorohttps://openbook.etoro.comB+++++-++++++--
Exnesshttps://www.exness.comA+++++++++++++++
FBShttps://my.fbs.ruС-+++-+--++++--
Fibohttps://mtclient.fibo.ruB++++-+++++++--
Finamhttps://cabinet1.whotrades.comС-+-+--+-++++-+
FinFXhttps://www.finfx.fiA++++++++++++-+
Forex4Youhttps://account.forex4you.orgA++++++++++++--
ForexClubhttps://secure.fxclub.orgA++++++++++++--
ForexTimehttps://my.forextime.comA++++++++++++--
FX-Trendhttps://fx-trend.comB++-++-++++++--
FXCMhttps://www.myfxcm.comA++++++++++++--
FXDDhttps://secure.fxdd.comB++++-+++++++--
FxOpenhttps://my.fxopen.ruA++-+++++++++-+
FxProhttps://direct.fxpro.comA-++-+++-+++++--
GFThttps://dealbookweb.live.gftforex.comF--------+-++--
GKFXhttps://my.gkfx.ruС-+++-+++++++--
Grand Capitalhttps://grandcapital.ruA+++++++++++++++
IGhttps://www.ig.comB++-++--+++++--
InstaForexhttps://cabinet.instaforex.comС+++----+++++--
Iron FXhttps://www.ironfx.comB+++++--+++++--
LionStonehttps://account.lionstone.co.ukB++++-+-++++++-
Lite Forexhttps://secure.liteforex.comB++-+-+++++++--
Masterforexhttps://mfxbroker.comС-++-+--+++++--
Mayzus.comhttps://secure.mayzus.comF-+-+-+--+++---
NasBrokerhttps://my.nas-broker.comA++++++++++++-+
NordFxhttps://account.nordfx.comA++-+++++++++--
Oandahttps://fxtrade.oanda.comB++++--++++++--
RoboForexhttps://my.roboforex.ruA++-+++++++++--
SaxoBankhttps://ru.saxobank.com/loginB+++++--+++++--
Swissquotehttps://wt.swissquote.comB++++-+-+++++--
Teletradehttps://my.teletrade-dj.comF--+-----+-++--
ThinkForexhttps://portal.thinkforex.comA-++++++-+++++--
VTB24https://lk.olb.ruF-+--++--++++--
WelTradehttps://secured.weltrade.ru/signinB++++---+++++--
Youtradehttps://www.youtradefx.com/loginС-++-+--+++++--
BrokerURLScoreSSL3SSL2SHA1TLS1.2DHRC4FSPOODLEHeartbleedFreakLogjamCCSHSTSOSCP

The full table could be found here.

Frankly speaking, I'm quite surprised. The things are not so bad with these forex guys. Maybe it is because their industry is moving pretty fast and they must be as flexible as possible.

I've added OSCP just for fun, to have a look if somebody is using it and again was surprised :)

What conclusions can we draw from this report:

  • There are still some brokers who use SSLv3 and even SSLv2. And that is bad. This means they do not care about security at all. With SSLv3 POODLE is almost always there. Bad again.
  • Many brokers still use weak DH keys (512 and 786 bits). That is not a serious security flaw, but still.
  • Perfect Forward Secrecy is a must nowdays. Does not matter that your key is safe now. Some day it might leak to the web.
  • We all love Ronald Rivers, but RC4 must not be used. Have a look at RFC 7465.
  • As for SHA1 certificates - that is just the matter of time. Almost all CAs are issuing SHA256 now. The certs will expire eventually.
  • We may see, that recently discovered Logjam and Freak vulnerabilities are pretty rear in our report. IT security became very popular after Heartbleed was announced. Give a security issue a name and it will be closed in a second.
  • As for HSTS (HTTP Strict Transport Security) - that is remarkable, how few brokers are using this feature.
In my humble opinion SSL/TLS is a basis of web security and it is configured pretty easily (even when you don't know what you're doing). There are lots of examples all over the Internet. What other security issues might broker have if one of the most significant things is not configured properly. Forex brokers should give it a thought.
Posted by at
Labels: , , ,

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)