Feeds

Santander downplays risk of 'personal data-stuffed' cookies

'If compromised', cookies would not allow access to online services 'on their own'

The Essential Guide to IT Transformation

The Spanish banking giant Santander has downplayed growing concerns over its alleged inclusion of "sensitive data" in its cookies.

The bank did not deny including personal data in cookies.

In a post on widely read security mailing list Full Disclosure, an anonymous contributor details a number of alleged problems on Santander UK's consumer eBanking site.

He claims that Santander online banking "unnecessarily stores sensitive information within cookies". Depending on which areas of online banking the customer uses, he claims this data allegedly includes the user's name, PAN (credit card number), bank account number and sort code, Alias and UserID.

"Of particular concern is the full PAN, which PCI DSS states should be rendered unreadable anywhere it is stored," the whistleblower stated.

He adds that he had gone public after experiencing problems getting the bank to play attention to (now fixed) cross-site scripting problems he had previously unearthed on its website.

The source alleges that Santander is violating its own cookie policy, which states that session cookies "do not contain personal information, and cannot be used to identify you" as well as the credit card industry's PCI DSS regulations (PDF).

Santander issued a statement strongly denying allegations that anything was amiss. It said that data stored in its cookies posed no risk to account security.

The data items stored within our cookies, if compromised, would not allow access to our online services on their own and our primary login processes do not rely on cookie data.

We review the use of our cookies and the data contained within them, and if necessary will review the IDs used by our customers to limit any future risks.

We take the security of our customer data very seriously. Customers can change their IDs at any time themselves and are reminded not to use the 'remember me' function on public or shared computers.

The Full Disclosure critic argues that Santander's handling of cookies does pose a risk, in cases where customers fail to close their browser after an e-banking session. "Additionally, whilst the cookies expire at the end of a session, they are not overwritten on logout," he explains. "This mean any user who does not close their browser, even if they log out correctly, will still have these cookies present until they close their browser, [t]hus increasing the window for exposure."

In the UK, Santander is the third biggest bank and a major provider of mortgages, with a combined total of more than 25 million British customers. The Full Disclosure posting was brought to our attention by three Reg readers who described it as unverified but potentially noteworthy. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.