30 apps, 29 hacks and one surprised Money20/20 audience

By Matt High
At this year's Money20/20 USA, ethicalhacker Alissa Knight, revealed her latest research work. "Generally, the reaction has kind of been 'you have to b...

At this year's Money20/20 USA, ethical hacker Alissa Knight, revealed her latest research work.

"Generally, the reaction has kind of been 'you have to be kidding me, this is crazy'," she told us, after we managed to grab some time with her towards the end of the event. In fairness to Knight, it's a perfectly reasonable reaction.

A day earlier, she had unveiled the results of a research project into the security of financial services apps. Specifically, that she had hacked 29 of 30 apps chosen from some of the biggest players in banking, stock trading, digital currency wallets and insurance. Each of them in less than eight minutes.

"It's a real problem," she told us, "and, basically, I'm the one that gets paid to be the bearer of bad news, which feels pretty cool."

"Are you guys all sitting down?"

Meeting people like Knight is rare. It's also eye-opening. Having started hacking at the age of 13, her life (so far) includes working for the US intelligence community in cyber warfare, being a serial entrepreneur, spending time in Germany hacking into, and taking control of, connected vehicles and hacking into a bank's internal network through its CCTV cameras in the parking lot. 

At Money20/20 she largely focused on her app research, and the wider implications it has on cyber security. Following her opening gambit - "are you guys all sitting down? I don't think any of you are doing anything correctly" - she proceeded to outline the key findings.

She also explained that, as well as major banks, she looked at a number of fintech apps, noting that I actually thought that the smaller companies would have the most vulnerabilities, but it was the complete opposite. The cryptocurrency wallets in smaller companies have more secure code than their larger counterparts. It's the weirdest thing – the bigger banks, the bigger institutions have the worst, most horrible apps.”


Knight explained to us the routes of the problem, including "too much outsourcing, but very little checking", and the shift in direction to an API-first world. "They’re securing them with web application firewalls or API gateways, and that's wrong [...] We need to be looking at APIs differently."

As part of a new project - details of which will be featured in the next edition of FinTech magazine - Knight is doing just that. She has, in short, created a fake bank with internet-facing APIs and a fake website, all with the idea of better understanding the threat faced by hackers. "It’s based off the idea of Sun Tzu’s Art of War: if you’re going to defeat your enemy, you need to understand your enemy," she said.

Read the full interview with Knight in the next edition of FinTech magazine

For more information on all topics for FinTech, please take a look at the latest edition of FinTech Magazine.

Follow us on LinkedIn and Twitter.


Featured Articles

FinTech LIVE London: Introducing Three New Speakers

FinTech LIVE London 2024 welcomes Wendy Redshaw, Joanna Pamphilis and Steve Round as the latest speakers joining the show this October

FinTech LIVE London: Group Speaker Announcement

FinTech LIVE London 2024 welcomes Kirk Donohoe, Jas Narang and Matt Cumbers as its latest speakers joining the show

FinTech LIVE London 2024: Key Themes

We look at some of the key themes from our upcoming FinTech LIVE London event for 2024, giving you even more reasons to attend virtually or in-person

Want to Become a Media Partner of FinTech LIVE London 2024?

Financial Services (FinServ)

FinTech LIVE London: Three New Speakers Onboard

Financial Services (FinServ)

FinTech LIVE London Welcomes Three Group Speakers

Financial Services (FinServ)