Posts Tagged


Zendure Unveils Credit Card-Sized SuperMini 10,000mAh Power Bank

When you think a bit of technology isn’t going to evolve anymore, someone finds a way to change it up. For standard wired power banks, there’s not much else that can change, as they’re already pushing the limits of battery capacities.

However, the team behind a new power bank called the SuperMini actually found a way to squeeze a 10,000mAh battery into a package that’s smaller than other ones out there. That means you’ll get a high capacity in a package that’s about the size of a credit card (albeit quite a bit thicker than one).

SuperMini Power Bank Features

The main thing that makes SuperMini stand out is its physical size. It’s 3.1-inches long, 2.2-inches wide, and 1-inch deep. In addition to being quite small, it’s also pretty light, tipping the scales at 6.35oz. It’s about an inch smaller than typical 10,000mAh power banks on the market in terms of length, which makes it quite a bit easier to carry around in a pocket.

As far as outputs, there’s both USB-C and USB-A, and both feature 18W of power delivery. In about 30 minutes, the battery pack can charge an iPhone XS to about 50%, which is pretty solid. Additionally, the battery itself will reach a full charge in about three hours, so you won’t have to wait too long to get it back on the go.

That 10,000mAh capacity will get you about 2.8 iPhone XS charges, .8 iPad Pro charges, 2.5 Galaxy S9 charges, and 1.7 Nintendo Switch charges.

SuperMini Price and Availability

The team behind SuperMini is seeking funding on Indiegogo. Backers who want to preorder a power bank can do so for a minimum pledge of $34. When the chargers hit the market, the team plans to have a retail price of $79, so it’s quite a bit cheaper. Of course, you’re shouldering a bit of risk when backing a crowdfunding project

3 Things to Consider Before Backing a Kickstarter Project

3 Things to Consider Before Backing a Kickstarter Project

Before you back your first or next Kickstarter project, here are a few things to keep in mind if you don’t want to get scammed or waste your money.
Read More

, so that’s the tradeoff for getting the power bank at a lower price.

Source link

Forrester: Bank mobile apps frustrating, confusing

Mobile banking should be effortless, with financial institutions sharing data, offering helpful suggestions and automating frequent tasks. But according to a new report from Forrester Research on mobile banking apps, far too many banks offer frustrating apps that show little thought given to how consumers interact with their financial institutions — or at least how they should.

“Banks too often send customers to separate apps or web pages to view content. These experiences, which are often inconsistent with the main app, can feel disjointed and confusing for the customer,” said the report. “Menus disappear or compete with each other, names and icons have multiple meanings, or links take the customer out of the app without warning.”

One key example, noted lead author and Forrester senior analyst Peter Wannemacher, is alerts/messaging. Chase, for instance, marks its app icon on users’ devices with a red number indicating how many messages are unread, but it is unclear where the messages are. Are they in “View Alerts”? The “Secure Message Center”? Even worse, users tend to expect the “alerts” to be on critical matters — a potential fraud action or an especially large withdrawal — but they are often actually about mundane matters, such as flagging that the regular monthly statement has been mailed. Alert fatigue quickly sets in.

Not so serendipitously, as I was writing this column, I received an alert from Chase. It showed one message in “View Alerts.” I clicked on “View Alerts.” It displayed a list of various accounts and payment cards, but it gave no indication of where the message was. I clicked on several and didn’t find anything new. The alert notification then disappeared. Oh well. I hope it wasn’t anything important.

“I literally use Chase as an example of how not to do that alert experience,” Wannemacher said in a Computerworld interview. “It’s very bad for the customer to have alerts that are all over the place.”

Wannemacher added, “Alerts are powerful drivers of engagement that every bank wants.” I would quibble and say that that sentence needs to be modified to, “When done properly, alerts are powerful drivers of engagement that every bank wants.” Done improperly, they can anger and confuse customers and ultimately cause them to cut back on engagement. In short, waste your customers’ time at your own peril.

“Today, millions of US banking customers use apps to manage their money, yet these experiences rarely evoke positive emotions — some are frustrating and negative, while others are simply neutral and utilitarian,” the report said. Forrester did find “a few glimpses of how banks can evoke positive emotions: For example, Wells Fargo provides in-line guidance on how to avoid service fees directly within the transaction list.”

Typically, these mobile content issues are dictated by various product business units or marketing. But Wannemacher makes an argument that IT — and sometimes security and compliance people — must get more involved in the process. Referencing missing elements in some of these apps, Wannemacher said that “the IT folks, they have a role to make sure it’s there. We talk about grabbing the steering wheel if no one else will.”

In fintech discussions today, most argue that mobile apps need to go far beyond making existing banking tasks easier. The apps must take the next step and make consumer financial lives better. Bots, for example, can propose a budget based on a history of a consumer’s activities and then actively help the consumer stick with the budget. For example, when the phone detects that the consumer has walked into a favorite retailer or restaurant, it can issue an alert along the lines of, “You have $35 remaining in this month’s clothing budget line and you have 19 days left this month. It also looks like you’re in a Target, and you have typically spent $40 on each shopping trip.”

Or it might proactively help with savings, by saying something such as, “It looks like you can make a $50 investment in your savings account. May I move the money now?”

Wannemacher saw search as a critical area where banking apps tend to fall short — and there is no easy fix. “There is a ton of integration work for search to work well,” he said.

Another two areas where Wannemacher saw shortfalls with bank mobile apps were security — where banks should do quite well, since they understand security quite well — and privacy, where banks should be horrible, since they see data acquisition as a critical part of their survival and growth strategy.

Speaking about security, Wannemacher said the problem was not in the apps’ security per se as much as in banks’ efforts to make customers aware of security mechanisms already in place. This is where banks have to wrestle with the same security conundrum that all businesses face: On the one hand, they want to shout about all of the security that they have in place. On the other hand, customers generally don’t want to read about it. When banks display their security measures — by frequently requesting passwords, asking for biometric authentication, providing a USB fob for onetime authentication (which won’t work for most mobile applications) — customers dislike the friction that is added to the experience. When banks push top-level authentication that has relatively little friction (such as behavioral analytics, where the app detects how the phone is being held and the typing speed and precise geolocation and uses that to try and find fraudsters), it works well, but the customers wonder if their money is being held securely. Yes, I know: it’s hard to win either way.

For privacy, Wannemacher said that banks must make the options for customers to change their data-sharing permissions easy to find and to manage. “It’s almost always poorly delivered to the customer,” he said. “I think these will be egregious failures if they are not solved within a few years.”

In the report’s research, Wannemacher’s team did find some bank apps — or at least apps that had good parts:

  • USAA: “Although it has not made major changes to its app in the past year, USAA remains the US leader in mobile banking experiences, with a wide range of useful features and good UX design. USAA leads in five areas of mobile banking — login and security alerts, money management, money movement, assisted service features, and content — more categories than any other U.S. bank we reviewed.”
  • Bank of America: “The Bank of America has steadily improved its app over the past year, earning the second-highest overall score and narrowing the gap with USAA. Bank of America leads in three areas: marketing and sales, privacy and security cues and content, and self-service features. There is no category of our review where Bank of America falls far short of customer expectations — something no other US bank achieved.8 At the heart of its mobile app sits Erica, the bank’s in-app chatbot that acts as a search mechanism, a proactive guide for the customer, and a curator of personalized insights about the customer’s spending and financial life.”
  • Chase, Chime, Citi, U.S. Bank and Wells Fargo: “Each demonstrates some best practices. Chime leads in search and navigation,with sticky screen headers, a persistent bottom navigation bar that guides customers to key task flows, and calls to action that are clear and conversational rather than written in bank speak. Wells Fargo helps customers see and manage upcoming transfers, letting them easily view, cancel, or even amend a future-dated account transfer. Citi’s app nails best practices for content — it is useful, easy to read thanks to strong visual design choices, and easy to understand. Chase, meanwhile, has implemented Zelle P2P payments in a way that makes it easy for customers: The Chase app can group multiple emails and phone numbers for a single Zelle contact.”

Source link

Wireless Charger AND Power Bank

Our verdict of the Mipow Power Cube X:
A functional and beautifully designed charger. Well built, but a little overpriced for the features and battery capacity.

The Mipow Power Cube X is a Qi wireless charger, but it also sports a detachable 5000 mAh power bank for wireless charging on the go. Currently retailing for $79, and available in a choice of black or white color schemes. Is this the one charger to rule them all? Read on to find out.

Don’t forget to enter our giveaway contest at the end of this review, where you can win a Power Cube X, courtesy of Mipow.

Design and Features

Mipow Power Cube X separated

This charger and power bank comprises of two parts. The Power Cube itself contains the battery and wireless charging components. This contains status lights, along with a USB Type-A output port, and a USB Type-C input port, for charging the battery. This sleek battery is very smooth. The rear is brushed aluminum alloy, while the front is glossy plastic. It doesn’t appear to attract fingerprints immediately. The rear of the battery also houses a proprietary two pin charging/power delivery connection. This is used in conjunction with the dock to simultaneously charge the battery, and supply power to any devices charging wirelessly.

Mipow Power Cube X combined

The Power Cube X Smart Dock is reminiscent of a children’s toy. Its plain matte finish and rubber feet ensure stability on any surface. This dock houses a USB Type-C port for its main power input, along with another USB Type-A port, so you can pass through the power to charge wired devices too.

Aside from the charging connection to the battery, there’s not much else to look at. The smooth battery-shaped groove in this dock ensures the battery sits almost flush with the surface. The top edge contains an inset channel to make battery removal an easy task.

Mipow Power Cube X connector

Both the Power Cube X and dock feel well designed. The smart dock measures 7.32 x 3.85 x 0.74 inches (186 x 98 x 19 mm) and weighs 4.93 oz (140g). The power cube itself weighs 4.23 oz (120g), and measures 5.66 x 2.79 x 0.59 inches (144 x 71 x 15 mm). This is quite large for such a low capacity power bank (5000mAh), but don’t forget this also houses the Qi wireless charging technology.

It features foreign object protection, so only suitable devices receive power. It also has over-charge protection so your phone battery won’t explode once it reaches 100% charge.

Mipow Power Cube X components

Inside the box, you’ll find a USB Type-C to Type-A charging cable, along with a protective bag for the battery itself. You’ll need to supply your own mains charger. Don’t forget to read our guide to USB cable types

Understand USB Cable Types and Which One to Use

Understand USB Cable Types and Which One to Use

Why are there so many different USB cable types? Learn the differences between USB connector types and how to buy the best cable.
Read More

if you’re not sure what your phone uses.


  • Battery capacity: 5000 mAh
  • Cycle life: >300
  • Output voltage/current: 5V/3A
  • Wireless output voltage/current: 5V/1A

This total output current of 3 amps is ample, and should provide enough power to charge all but the largest of phone batteries in a reasonable time. Unfortunately, the wireless output voltage and current of 1 amp is rather low for a device made in 2019. Sure, it will charge your phone, but slowly. The Qi specification allows for higher current delivery, so this lower wireless power output is outdated. Still, if you’re charging your phone overnight, or using the wireless charger as a mini cradle for your device throughout the day, you shouldn’t encounter any problems running out of charge.

Mipow Power Cube X

This 5000 mAh capacity is on the low side, but it should be sufficient for one to two charges, depending on your mobile device.

This cycle life of “greater than 300 charges” is only OK. Premium battery packs can often handle over 1000 charge cycles, so the fact that Mipow won’t commit to a higher number of claimed power cycles perhaps illustrates where they may have cut corners on quality.

Using the Power Cube X

Mipow Power Cube X

This charger is super simple to use. Once charged, or mounted in the dock and actively charging, you can place your phone on top to begin charging. As mentioned above, the reduced current available when wirelessly charging means modern devices take that little bit longer to fully charge. Using a Google Pixel 3 XL, Android alerts me that “this device is charging slowly”.

One quirk I noticed is that wireless charging does not often begin when using the battery alone. To initiate a charge, you have to “wake up” the charger by touching it until a light appears. Once awake, devices charge without issue. This is not a problem when the battery is connected to the dock.

Mipow Power Cube X

Wireless charging requires your mobile devices to sit at a specific angle and orientation. Your phone won’t charge if you haphazardly throw it on to the charger, without care for its orientation. This isn’t the fault of Mipow, it’s just a limitation of the underlying Qi wireless charging technology. Still, it’s something to be aware of. You can read more about why this happens in our wireless charging technology guide

What You Need to Know About Wireless Charging

What You Need to Know About Wireless Charging

Until our devices offer week-long battery life, charging on the go will remain a reality for us all.
Read More


This charger makes a very faint noise when charging wirelessly, and this only happens when a device is charging wirelessly. It’s very faint, and you’ll need to hold your ear almost next to the charger, but it’s there. This isn’t likely to cause many problems with your sleep as it’s so quiet, and it’s nothing like the high-pitched whine you sometimes hear with cheap chargers. When no device is wirelessly charging, the Power Cube X is silent.

Mipow Power Cube X

Should You Buy the Mipow Power Cube X?

It’s difficult to fully recommend the Power Cube X. While it’s undoubtedly a beautifully designed and well-made product, it’s a little expensive for what you get. You can easily buy a wireless charger and higher capacity power bank for less money. Many of the issues with speed are due to the limitations of Qi wireless charging itself, but many alternative wireless chargers use the newer standards for faster charging of your tech.

Mipow Power Cube X

That said, it’s a wonderful piece of design and engineering. If you want to reduce the number of cables and devices in your life, or are looking for a well-designed charger to live on your desk or bedside unit, then the Power Cube X is a solid choice. We’d like to see a mains adapter included in the box and an increase in the battery capacity in the future, but this is still an excellent product.

Mipow Power Cube X

If you’d like to win a brand new Mipow Power Cube X in white with Smart Dock, then enter our giveaway contest below!


Enter the Competition!

Mipow Power Cube X Giveaway

Explore more about: Battery Life, Induction Charger, MakeUseOf Giveaway, Mobile Accessory, Wireless Charging.

Source link

Financial firms bank on A.I. as pilot projects head to production

The financial services sector is pouring money into artificial intelligence (AI), with banks, for example, expected to spend $5.6 billion on AI in 2019 – second only to the retail sector.

Until now, the vast majority of AI projects have remained pilots, and in many cases those projects led to tech deployments without a clear business use.

Simply put, it’s been trendy.

Most AI projects today are aimed at improving customer service efficiency and security by introducing chatbot technology, or by deploying machine-based learning to uncover trends across business lines in customer behavior and what they need.

“It’s about ensuring banks are able to retain the memory of a customer’s journey across bank services,” said Sankar Narayanan, chief practice officer at Indian analytics service provider Fractal Analytics.

Initial systems aimed at fundamental issues

As those test projects mature, there’s a sea change coming, according to Narayanan,  and beginning this year companies are expected to start rolling out production systems. At first, they’ll be focused on solving fundamental problems, such as customer relationship management through conversational chatbots that have advanced in their capabilities.

“The bigger idea is reducing friction,” Narayanan said. “Most banks, when providing lending to businesses, require lots of documentation. One significant friction point is the vetting of those documents. It’s a hassle for businesses seeking funds and bank officials who need to go through checks and balances for risk.”

For example, something as simple as automating credit line increases has typically relied on simple financial calculations: a client who uses a card regularly and pays on time gets offered a credit line increase. But very little research is done on how a consumer perceives an increase in credit.

“Will they be happy? Or will they think you’re giving them a longer noose to hang by,” Narayanan said. “It’s a simple question. So, it’s easy to see if a client qualifies, but genuinely is it the right thing for them? So, [by knowing their history more completely], you can offer them an increase versus automatically increasing it. That’s humanizing AI.”

Most financial services’ lines of business are currently compartmentalized, relying on proprietary or legacy computer systems adopted through the acquisition of other businesses that are not integrated with other CRM or ERP systems. For example, a bank may be able to see a client’s checking, savings and credit card history but not necessarily their mortgage background through a single, integrated view. Integrating that information would make it easier to offer up additional products based on their complete financial profile.

Chuck Monroe, head of AI Enterprise Solutions at Wells Fargo, said many organizations get stuck early on by viewing AI through a narrow lens of either data science or technology rather than as a strategic business tool that can be applied across the company.

“AI technology truly has the potential to drive transformational change. It’s critical to organize data in a way that allows you to pull meaningful insights across your company,” Monroe said. “I think it’s also important to clearly define opportunities and understand the end-to-end process; standalone AI solutions rarely meet business goals.”

A year and a half ago, Wells Fargo created an AI Enterprise Solutions team that  partnered closely with the bank’s data management and IT teams to accelerate adoption of AI throughout the organization. The team touched everything from customer experience to operations and risk management.

The Wells Fargo experience

Wells Fargo began its foray into AI with a Facebook chatbot pilot that began in April 2017 and ran for a year so the bank could evaluate how it enhanced and simplified customer interactions. The bank more recently conducted a short-term Banking Assistant pilot within the Wells Fargo Mobile app to learn about how conversational banking capabilities can improve customer experience and deliver banking information using AI.

The bank, however, hasn’t yet ramped up any production systems.

“We’ve learned a lot about how our customers prefer to use chatbots, which will help inform potential future experiences,” Monroe said. “For example, customers have appreciated the ability to access account information and analyze transactions, and we received very useful feedback on a number of additional capabilities they would like to see in future chatbot experiences, such as the ability to transfer funds and make payments.”

Getting started on AI development

Finding AI developers isn’t easy, as talent in the nascent field is scarce. It’s easier to find developers of rules-based technology than actual AI or machine-learning tech, said Sridhar Rajan, a principal in charge of robotic and cognitive automation at Deloitte consulting.

In creating an AI Development team and deploying AI, a company should first be clear on its business objectives and realize AI developers are rarely home grown; it’s a complex field that requires a lot of education and training. What’s needed, said Rajan,  is a developer who has a good grasp of the technology married to business acumen.

“The center of gravity is shifting toward business knowledge,” Rajan said. “You don’t want to say, ‘I have machine learning, where do I apply it?’ Look for business problems first to solve. Hire a small set of talent. Create a small core team through a center of excellence… like an incubator project.”

In August, a report from Deloitte pointed to the major sticking point for enterprises eyeing AI projects. They include: disparate legacy systems that do not talk to each other; a general lack of AI developers and programmers; and a lack of understanding about what AI can – and can’t – do.

Deloitte also noted that AI does not live in a vacuum but must be intertwined with the development of other technologies, such as blockchain or quantum computing.

AI and machine learning is primarily used for pattern detection to recognize  irregularities or regularities in data; foresight to determine the probability of future events; customization for generating rules from specific profits and applying general data to optimize outcomes; decision-making from generating rules for general data and applying policies against those rules; and interaction or communication with customers through digital or analogue media.

“When business people talk about AI, they typically are not talking about a particular technical approach or a well-defined school of computer science,” the report said. “Rather, they are talking about a set of capabilities that allows them to run their business in a new way.”

At their core, those capabilities are almost always a suite of technologies, enabled by adaptive predictive power and exhibiting some degree of autonomous learning, that have advanced the ability to automate and enhance services or internal processes.

There are four distinct areas where AI is now being used in pilots or production systems, according to Rajan:

  • Chat bots and virtual assistants used by retail banks to answer mundane customer questions.
  • Robotic process automation or rules-based scripts that can pull data from multiple systems to generate forms or invoices.
  • Natural-language processing and generation, enabling systems to read text in contracts to pick out key clauses (and determine the implications of that text) as well as enabling the system to write in plain language.
  • And cognitive analytics, which can find customer trends to determine which products they’re more likely to purchase.

Regulatory compliance gets more automated

Anti-fraud, anti-money laundering and know your customer (KYC) rules have also prompted companies to deploy investigative AI, which combs through internal and external resources to paint a more complete picture of potential customers.

When a client logs into a banking site, for example, an AI script would search for a client record, identify any missing data required for regulatory compliance, email the bank relationship manager and subsequently update the information received by the customer – whether it’s a person or a company.

Today, manually searching for missing client data to fulfill KYC and other rules can take as much as six weeks to onboard a new corporate client, according to Rajan. AI and machine learning can cut the time to onboard a new client to a few days, he added.

“The process to investigate and clear somebody is a very well-defined process. The time-consuming part is usually a function of gathering and aggregating data from disparate sources within your shop and outside,” Rajan said.

AI technologies of different capabilities are being used to more efficiently manage client onboarding, offer a more intuitive line of questioning tailored to them while also being able to cull their preferences in order to offer future products to them, Rajan said.

“A lot of financial services firms grew organically and have multiple systems and it takes a tremendous effort to bring the data on all those systems together for clients quickly,” Rajan said.

Wells Fargo looked into an AI model that can detect and continuously re-prioritize potential fraud cases, which would greatly reduce the number of high-risk cases handed over to employees to investigate.

“We have hundreds of thousands of debit card transactions marked as potentially suspicious,” Monroe said. “This…cuts down on the number of false positives for cases that aren’t actually fraud, which helps keep the customer experience [be more] seamless and secure.”

One “global financial institution” client of Deloitte’s, which the company declined to name for privacy reasons, faced a significant manual effort in reviewing each expense report and the supporting receipts for validity and accuracy. The company used AI to automate the reading of the reports and receipts, validating key fields and providing a summary. Additionally, the AI program stores all inputs and reports in a central location enabling audit trail.

The system saved the company “thousands of hours per year” in manual reviews of expense item and receipts. The system also identified rules non-compliance on a daily basis, saving out-of-policy reimbursements. And, the streamlined verification process made it easier to look for potential fraud.

The challenge of integrating legacy data systems with AI remains for companies seeking a unified view of client information. The ideal would be to have one or two data platforms where information flows smoothly, but that doesn’t happen often, Rajan said. As more companies move toward placing their data in the cloud – and away from a fixed infrastructure with multiple systems – AI can enable more automated management of that data.

Even so, AI technology can still help a business cut across different systems and bring data together.

“If the systems aren’t integrated today, which they are not, can I use a technology that will get customer information from a bank file and from a mortgage file, bring it together and present it to you internally so you can then talk to your customer with a unified view?” Rajan said. “I think that’s where we’re seeing AI bridging that gap today while the overall integration is going on. That’s where I think the acceleration of AI technology is happening.”

Source link

Portal Cord is a Charger Cable With a Power Bank Hiding Inside

Power banks are an incredible invention. They make it so we can keep our devices running for substantially longer than their built-in batteries.

They’re not without flaws, though. Part of the reason a device like a smartphone is so useful is that it’s easy to carry around. It fits right into your pocket. Most power banks, however, aren’t so portable.

Portal Cord is setting out to solve that problem by tucking the power bank right inside of the cord.

Portal Cord Features

The way the Portal Cord is able to contain the power within the cord is by having multiple batteries lining the length of the device. While a traditional power bank features one large battery, this one uses a bunch of smaller ones.

Obviously, even by having multiple batteries along the cable, there’s just no way to fit a huge amount of juice. As such, the Portal Cord features 1,800 mAh of charging power. To put that into perspective, an iPhone XS Max features a 3,174 mAh battery, while a Pixel 3 features a 2900 mAh battery. Basically, you won’t get a full charge for your devices out of this power bank, but thanks to Quick Charge technology, you’ll get a decent amount of juice rather quickly.

The Portal Cord is available in USB-C, Lightning, and micro USB, so it’ll work with a wide range of devices including newer iPhones and most Android devices.

For length, the Portal Cord measures three feet, which is pretty standard for power cables. Not going with an incredibly long cable allows the device to remain portable. The cable and attached batteries are pretty light, coming with a weight of only 4.24 ounces.

Portal Cord Availability

Portal Power is seeking funding for Portal Cord on Kickstarter right now. The project is tracking to meet is $20,000 funding goal with around $15K as of this writing. Backers who would like to order a device can do so for $55 while the early special lasts. After that, the price goes up by $10. The company plans to ship the power banks to backers in October 2019.

Make sure you understand the risks of backing a crowdfunding project

Why Fraud Is a Real Threat to Crowdfunding

Why Fraud Is a Real Threat to Crowdfunding

Crowdfunding, once novel and untested, has started to make its way into the mainstream. As a result, it has attracted scammers and fraudsters able to exploit the system and walk away with millions of dollars.
Read More

before you jump in though. Read our guide featuring things you need to know before backing a Kickstarter

3 Things to Consider Before Backing a Kickstarter Project

3 Things to Consider Before Backing a Kickstarter Project

Before you back your first or next Kickstarter project, here are a few things to keep in mind if you don’t want to get scammed or waste your money.
Read More


Explore more about: Batteries, .

Source link

Massive bank app security holes: You might want to go back to that money under the mattress tactic

A new report from a well-regarded payments consulting firm has found a lengthy list of security insanity while examining several major fintech company mobile apps. Although the very nature of apps that manage and move money would suggest presumably strong security, banks and their cohorts tend to adopt new technology slower than almost any other vertical, which puts them in a bad place when it comes to security.

My favorite finding from the Aite Group report: “Several mobile banking apps hard-coded private certificates and API keys into their apps. [Thieves] could exploit this by copying the private certificates to their computers and running any number of free password-cracking programs against them,” the report noted. “Should the [attackers] successfully crack the private key, they would be able to decrypt all communication between the back-end servers and mobile devices, among other things. The API keys allow an adversary to then begin targeting the [financial institution’s] API servers, gaining them access to data in the back-end databases. This allows [attackers] to authenticate the device with the back-end servers of that app, since this is what APIs use for authentication and authorization.”

In other words, these banks have made the attackers’ jobs far easier. “One of the directories was actually called ‘API Keys,'” said Alissa Knight, the senior analyst with Aite Group’s cybersecurity practice who did the research for the report. “My coffee didn’t even get cold while I was on that list” trying to find vulnerabilities.

Some other especially scary points made in the Aite report:

  • “Many of the apps contained hard-coded SQL statements that gave adversaries the ability to employ SQL injection attacks, such as modifying an existing SQL query or inserting a new SQL query in a man-in-the-middle attack that allows them to download all of the data in the database, delete data, or modify it.”
  • “Ninety-seven percent of the apps tested suffered from a lack of binary protection, making it possible to decompile the apps and review the source code. Additionally, all of the FI apps tested failed to implement application security that would have obfuscated the source code of the apps, making it possible to decompile them. This provided all of the sensitive API URLs, API keys, and API secrets hard-coded into the apps, and some of the URLs included nonstandard port numbers and development servers used by developers for testing and QA, which were reachable at the time of the testing. By decompiling the binaries, it was also possible to discover several private keys hard-coded into their files and located in subdirectories of the app, making it possible to crack the private key passwords offline.”
  • “Additional findings included the ability to execute client-side code in an app’s WebView; raw SQL queries embedded in the source code, yielding database schema information and the ability to perform SQL injection; the creation and storage of sensitive data into temp files on the mobile device or clipboard memory; and hard-coded public and private keys. Decompiling the binary into its raw source code gives adversaries the ability to inject malware and repackage the app as a rogue/pirated app hosted in a third-party app market, such as TweakBox, Aptoide, and TutuApp, or send it to victims via smishing (SMS phishing). Decompiling the app also allows an adversary to understand how the app detects jailbroken mobile devices, which, once vulnerabilities (such as API keys, private keys, and credentials) are found in the source code, results in theft of money through banking trojans, username/password theft or account takeover using overlay screens, and the theft of confidential data.”
  • “About 80 percent of the apps tested implemented weak encryption algorithms or the incorrect implementation of a strong cipher, allowing adversaries to decrypt sensitive data and manipulate or steal it as needed.”
  • “About 70 percent of the apps use an insecure random-number generator, a security measure that relies on random values to restrict access to a sensitive resource, making the values easily guessed and hackable.”

In terms of the mobile apps she examined, Knight said many procedures were simply sloppy. Cyberthieves love sloppy. “Everything in the app was being logged and it had some very verbose logging. A gratuitous amount,” Knight said in a Computerworld interview. “A lot wasn’t being done in sandboxes and was stored directly on the mobile device.”

Aaron Lint is the chief scientist and research vice president for Arxan, which underwrote the Aite research. “It’s no secret that the finance industry is a hot target because the payload is cold, hard cash,” Lint said. “Virtually none of the apps tested in this research had app security measures in place that could even detect an app was being reverse-engineered, let alone actively defend against any malicious activity originating from code level tampering.”

Lint referred to the API leakage as “a blueprint of how to deal with the app.”

Making the API keys so easy to find is certainly a courtesy that will be much appreciated in the dark web, although likely less so by the financial institution’s customers. That said, those customers will be unable to do anything about this — such as switching banks — because Aite declined to identify which companies they looked at.

They did email Computerworld some descriptions of the companies profiled — there were 30 companies examined in eight categories: retail banking apps (four companies examined); credit card issuers (3); mobile payment apps (3); healthcare savings accounts apps (3); retail brokerage accounts (5); health insurers (4); auto insurance (4); and crypto-currency companies (4). Aite also released how many were publicly-traded (most were) and gave a hint about company-size by saying how many employees each company had (that number ranged from 250,000 employees for one of the retail banking app companies to 50 employees for one of the crypto-currency companies.

Even more troubling, Aite said, it chose to not tell any of the companies examined that it found major security holes on their sites. This is regrettable, but understandable. It’s a fear — ranging from litigation to being blackballed in the industry — that pen testers have these days about examining sites or apps without the company’s permission. Given that Aite has to work with these companies, it makes sense that it wouldn’t want to flag these companies that they have issues.

In a Utopian world, companies would be ecstatic to be informed about issues on their site/app before cyberthieves found them, but that’s not how the world works, especially in the U.S. Hint to FI companies: Hire a pen tester today to check out your site and apps. Some of you have massive issues.

Source link