Citibank forces clients to use older (vulnerable) version of Java Runtime (JRE)

Source :

http://packetstormsecurity.org/1007-advisories/citibank-java.txt

Basically in short, Citibank forces their client to use a vulnerable JRE because only that version is compatible with their application. No wonder Citibank is always on the frontpage getting hacked for at least a few times per year. Why doesn't Citibank upgrade their application? Lazy programmers? No budget? To pentest it (again) is too expensive?

Well, its all up to guesses, but seriously, to protect yourself, it is extremely important to uninstall all older version of JRE (btw, in case you did not know, upgrading doesn't really remove the older version in some cases - flagged as vulnerability in 07) so that application such as the above will not work (without telling you).

Also, as a side note, there is also a simply utility called JavaRa to remove older version of JRE:
http://sourceforge.net/projects/javara/

Evolution of Banking

I had seen how banking is evolving but is really kinda worried at the latest stage this is getting to... Lets take a look at the cycle :

Paper Banking -> ATM Banking -> Phone Banking -> Internet Banking -> Home Banking

What is home banking? Well, its something you can only do at home and not elsewhere. Why? Because we need a 2FA token now. this 2 factor authentication token is small, but would someone carries like a whole bunch of them, one for each bank? No, not me. I have a few and they all stay at home. no more banking in the office, banking at Macdonald (btw, that is so the wrong thing to do) and banking at Microsoft. I can only bank at home now.

This is certainly not a step forward. Some bank tries to overcome this by giving a mobile phone option which is much better. Otherwise, I really hope they can sit down and unify the token instead. There is just not enough common sense to assume people will carry all the bunch of token all around.