FXBO Announces Wallarm’s Successful Security Audit

In a significant development for the Forex CRM security, FX Back Office (FXBO) proudly announces the successful completion of the latest security penetration audit conducted by Wallarm Inc.. This esteemed information security company specializes in comprehensive penetration testing and security auditing services. The FXBO Wallarm audit accomplishment underscores FXBO's unwavering commitment to maintaining the highest standards of security for its clients and stakeholders.?

FXBO Wallarm Audit Objectives?

The GreyBox Security Audit was meticulously carried out by Wallarm Inc. from June 3, 2024, to July 5, 2024. The audit focused on the following technical objectives:?

• Research on the possibility of gaining access to confidential and personal data of clients and employees.?

• Assessment of potential access to the Customer’s financial data.?

• Identification of vulnerabilities in network services and applications.?

• Analysis of potential consequences of exploiting detected vulnerabilities.?

• Demonstration of exploitation of the most critical vulnerabilities.?

• Provision of recommendations for remediation or compensatory protective measures.??

Detected Vulnerabilities and Remediation?

During the FXBO Wallarm audit, three experts identified several vulnerabilities within FXBO’s APIs, REST and Client API. The findings were documented in a comprehensive report, which included strategic recommendations for secure software development and detailed steps for vulnerability remediation.?

FXBO’s Information Security team worked closely with Wallarm to understand the vulnerabilities and implement the necessary remediation steps. Following these efforts, Wallarm rechecked the remediated vulnerabilities and confirmed that all identified issues had been successfully resolved.?

The following changes have been implemented to the endpoints:?

1. The /client-api/registration/ endpoint now returns a new field called 'registrationToken'. This token should be used for the /client-api/registration/send-pin-by-token endpoint instead of using the user's identifier.?

1. Currently, the /client-api/profile/two-factor endpoint for disabling two-factor authentication (2FA) works with or without a PIN. Soon, the option to disable 2FA without a PIN will be deprecated. The PIN can be obtained via the /client-api/pin/send endpoint.?

In summary, this achievement demonstrates FXBO’s dedication to ensuring the highest levels of security and trust in its products. By addressing the vulnerabilities identified during the audit and adopting industry-leading security practices, FXBO continues to provide secure and reliable solutions to its clients. FXBO is a CRM giant and holds the title of ‘The Ultimate Forex CRM’ for a reason!??????