ATO declines to fix code replay flaw within myGovID – ZDNet

The default login option for agents used by the Australian Taxation Office (ATO) is vulnerable to a code replay attack, security researchers Ben Frengley and Vanessa Teague said.
Writing in a blog post, the pair described that an attacker could use a malicious login form to capture user details, which the attacker could then use to login into other accounts held by the myGovID user.
The nub of the attack is that when a myGovID user attempts to login into a site, they are asked to input a fou…

Click here to view the original article.