Online Banking Industry Very Vulnerable to Cross-Site Scripting Frauds

    Date13 Mar 2005
    CategoryHacks/Cracks
    8912
    Posted ByBrittany Day
    Phishing Attacks reported by members of the Netcraft Toolbar community show that many large banks are neglecting to take sufficient care with the development and testing of their online banking facilities. Well known banks have created an infestation of application bugs and vulnerabilities across the Internet, allowing fraudsters to insert their data collection forms into bona fide banking sites, creating convincing frauds that are undetectable to most customers. Indeed, a personal finance journalist writing for The Motley Fool was brave enough to publicly admit to having fallen for a fraud running on Suntrust's site and having her current account cleaned out. It's a reasonable premise that if a Motley Fool journalist can fall for a fraud, anyone can.


    One fraud recently blocked by the Netcraft Toolbar was at Citizens Bank. Fraudsters composed and mass mailed a phishing mail which exploited a program on CitizensBank.com, loading Javascript from the attackers' server hosted at Telecom Italia. Customers were presented with a page bearing the CitizensBank.com URL in the address bar, while the browser window displays a form from the Telecom Italia server asking for user login information.

    The script being exploited allows visitors to search for Citizens Bank branch offices in their town. Along with search scripts, branch locator pages are frequently carelessly coded and are targets for fraudsters who are actively analyzing financial web sites for weaknesses.

    In this case, a coding oversight in the Citizens Bank application allows an attacker to inject JavaScript into the URL, which is executed by customers' web browsers. The additional commands following "CitizensBank.com" in the URL are hex-coded to evade detection, but call a JavaScript file (city.js) from a server at the IP address 82.184.108.158.
    You are not authorised to post comments.

    LinuxSecurity Poll

    Do you reuse passwords across multiple accounts?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 2 answer(s).
    /component/communitypolls/?task=poll.vote
    13
    radio
    [{"id":"55","title":"Yes","votes":"4","type":"x","order":"1","pct":44.44,"resources":[]},{"id":"56","title":"No","votes":"5","type":"x","order":"2","pct":55.56,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    Advisories

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.