Sennaike exposes threatening security loopholes in Nigeria’s financial sector
By Zion Rufus
The Nigerian financial sector is currently grappling with a growing wave of cyber threats, exposing vulnerabilities that could have severe implications for the country’s economy and its citizens.
As cybercriminals continually evolve their tactics, data extortion has emerged as a prominent strategy, with hackers targeting customer and employee data and resorting to threats of public leaks.
Sennaike David, an Information Security expert, bug bounty hacker, and founder of Sennaike Consulting Limited, recently shed light on the alarming state of cybersecurity in Nigeria’s financial institutions. His findings exposed critical vulnerabilities that significantly jeopardize the integrity of these institutions and the security of customer assets.
Sennaike’s research also shed light on the vulnerabilities plaguing Nigeria’s financial sector and highlights the urgent need for robust cybersecurity measures and proactive strategies to counter the rising menace.
While significant investments are being made in cybersecurity globally, cybercriminals are finding new ways to exploit weaknesses in systems and networks, particularly targeting personal devices and high-ranking executives. As noted by OpenAI, the battleground has shifted towards data extortion, where hackers steal sensitive information and exploit it for financial gain. This transition is driven by hackers’ adaptation to the increasing visibility and law enforcement response associated with ransomware attacks. By focusing on data extortion, cybercriminals seek to exploit the value of stolen information while avoiding detection and decryption efforts employed by cybersecurity professionals.
Speaking to MARKETING EDGE in an exclusive interview, James Kuboye, a data analyst and security expert explained that Nigeria’s financial sector now faces significant challenges in combating the escalating threats of data extortion and cybercrime.
According to him, the vulnerabilities uncovered by Sennaike demand immediate attention and concerted efforts from financial institutions, regulatory bodies, and the government to strengthen the cybersecurity landscape.
He said: “By investing in cutting-edge technologies, skilled professionals, and a proactive approach to security, Nigeria’s financial institutions can protect sensitive data, build customer trust, and ensure the stability of the nation’s financial infrastructure in the face of emerging cyber threats.”
Commenting on Sennaike’s report, Binta Ojone, a cybersecurity professional, opined that the root concern is that “The Nigeria Governance System first has to gain a proper understanding of the need to invest in building an army of cyber talents as a Capacity Building Strategy as identified in Nigeria’s Cyber Security Strategy document.”
According to Ojone, the main factor that contributes to Nigeria’s Cyber Security posture still remains the lack of experts in the rather demanding field.
“I am certain that the majority of the financial institutions in Nigeria are not oblivious to this saddening reality. The few experts we have are nowhere to be found in their home country; talk more of coming to the rescue of the cyber security situation of their motherland. This is owing to the mere fact that the quality of life they are living in Nigeria cannot be equated to the investment they made in themselves to attain the level of competence they possess. Logically speaking, everybody tends to shift to an environment that is more favorable to them,” she added.
In a similar submission, Osahon Asanor, a security engineer, argued that well trained defensive security practitioners are what’s in short supply in Nigeria.
“I’ve been saying the same thing. I didn’t realize it was this serious, I just thought it was due to a lack of professionals (thanks to the ‘Japa’ syndrome). However, this shows that it’s a deeper issue. It’s amazing how many people in the cybersecurity space think that established good practices are just mere suggestions,” he said, adding that while a bug bounty program would be very beneficial, “it’s more to the extent that it encourages proper defensive security practices”.
However, Olanrewaju Yusuf, a director and finance executive, doubts Nigerian banks are “this vulnerable”.
Contributing to the LinkedIn conversation, Yusuf said “I just read his report. Not sure he hacked anyone. More like he did an analysis of a pen test report. I doubt if Nigerian banks are this vulnerable. North Korea would have cleaned out if true.”
In a similar vein, Uchenna Ezeilo, a webmaster at the Central Bank of Nigeria revealed he will only take the findings with a “pinch of salt”.
Ezeilo posed in his LinkedIn statement, “Well, it’s security you’re talking about, so everybody is shocked and interested. But why have you not gone to the banks to demonstrate your findings and profit from it? By now, I’m sure a lot of people have already rushed to the dark web looking for their bank’s details. Also, this is your story so you control the narrative, and the narrative does not point at any facts that can be verified. And then you said they should come to you after revealing their vulnerabilities journalist style. This is a journalism business not a computing security business that you are running.”
Others advised that better-trained professionals should be engaged to conduct comprehensive penetration tests and Security Operations Center (SOC) monitoring to proactively identify vulnerabilities and respond swiftly to potential threats.
“Certifications alone should not be the sole requirement when conducting critical infrastructure pen tests, as hands-on expertise and practical knowledge are vital for thorough evaluations,” Pemisire Onifade, an AWS specialist noted.
She further advised financial institutions to invest in robust cybersecurity measures, including regular software updates and patch management to mitigate vulnerabilities in systems like the vulnerable WebLogic servers found in over 30 banks. Additionally, adopting multi-factor authentication, encrypting sensitive data, implementing intrusion detection systems, and conducting regular employee training on cybersecurity best practices are crucial steps in fortifying the defense against data extortion attacks.
Some notable vulnerabilities highlighted by Sennaike include:
- SQL Injection Vulnerabilities:
Startlingly, at least 40 banks were found to have an SQL injection vulnerability on their servers. This flaw allows cybercriminals to manipulate databases, potentially leading to unauthorized access and the subsequent exposure of sensitive data.
- Vulnerable Cisco VPN and Forti IOS Versions:
Approximately 70 percent of banks were found to be running vulnerable versions of Cisco VPN and Forti IOS, providing cybercriminals with potential entry points to exploit and compromise the security of these institutions.
- Exposed Log Files and Directories:
Several banks neglected to secure their log files, including Elmah log files, which contain valuable insights into operational activities. Shockingly, one financial institution even provided access to a drive containing logs, further exposing sensitive information. Moreover, eight banks had exposed directory listings, with three of them containing highly sensitive data. For instance, one listing exposed usernames and passwords of bank staff, encoded in base64, allowing unauthorized individuals to access and exploit these credentials for illicit purposes.
RECOMMENDED ARTICLES
Comment
No comments found.