Feeds

Santander downplays risk of 'personal data-stuffed' cookies

'If compromised', cookies would not allow access to online services 'on their own'

Remote control for virtualized desktops

The Spanish banking giant Santander has downplayed growing concerns over its alleged inclusion of "sensitive data" in its cookies.

The bank did not deny including personal data in cookies.

In a post on widely read security mailing list Full Disclosure, an anonymous contributor details a number of alleged problems on Santander UK's consumer eBanking site.

He claims that Santander online banking "unnecessarily stores sensitive information within cookies". Depending on which areas of online banking the customer uses, he claims this data allegedly includes the user's name, PAN (credit card number), bank account number and sort code, Alias and UserID.

"Of particular concern is the full PAN, which PCI DSS states should be rendered unreadable anywhere it is stored," the whistleblower stated.

He adds that he had gone public after experiencing problems getting the bank to play attention to (now fixed) cross-site scripting problems he had previously unearthed on its website.

The source alleges that Santander is violating its own cookie policy, which states that session cookies "do not contain personal information, and cannot be used to identify you" as well as the credit card industry's PCI DSS regulations (PDF).

Santander issued a statement strongly denying allegations that anything was amiss. It said that data stored in its cookies posed no risk to account security.

The data items stored within our cookies, if compromised, would not allow access to our online services on their own and our primary login processes do not rely on cookie data.

We review the use of our cookies and the data contained within them, and if necessary will review the IDs used by our customers to limit any future risks.

We take the security of our customer data very seriously. Customers can change their IDs at any time themselves and are reminded not to use the 'remember me' function on public or shared computers.

The Full Disclosure critic argues that Santander's handling of cookies does pose a risk, in cases where customers fail to close their browser after an e-banking session. "Additionally, whilst the cookies expire at the end of a session, they are not overwritten on logout," he explains. "This mean any user who does not close their browser, even if they log out correctly, will still have these cookies present until they close their browser, [t]hus increasing the window for exposure."

In the UK, Santander is the third biggest bank and a major provider of mortgages, with a combined total of more than 25 million British customers. The Full Disclosure posting was brought to our attention by three Reg readers who described it as unverified but potentially noteworthy. ®

Intelligent flash storage arrays

More from The Register

next story
Webcam hacker pervs in MASS HOME INVASION
You thought you were all alone? Nope – change your password, says ICO
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
Meet OneRNG: a fully-open entropy generator for a paranoid age
Kiwis to seek random investors for crowd-funded randomiser
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Internet Security Threat Report 2014
An overview and analysis of the year in global threat activity: identify, analyze, and provide commentary on emerging trends in the dynamic threat landscape.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.