7 ms·

Content editors should not be able to add arbitrary code to a bank's website unless it undergoes review from someone who understands web security. If there is s

Content editors should not be able to add arbitrary code to a bank's website unless it undergoes review from someone who understands web security. If there is some kind of content editing tool, it should only allow content (not arbitrary scripts) to be edited.

wolfgke 6y ago
> Content editors should not be able to add arbitrary code to a bank's website unless it undergoes review from someone who understands web security. Hardly anybody really understands web security.
- HenryBemis 6y ago
  I've audited e-banking websites before. Every file, every element needs to be accounted for. This is beyond "an honest mistake" and it should have been caught by any of the (many) scans the bank orders for its websites. And the scan/report should have caught that. Who does their scans/reports? What is the scope of these scans? Who reviews these reports? This is not about content. Content is "make a new page with that template and add a photo and the new text about XYZ product". Not a new functionality/code. I wonder who signed this off prior to.release and what does their wiki/Jira mentions. Edit: e-banking and other banks websites/online presence(s). Edit2/rant: I have been the go-to audit/sec/compliance guy for more than a decade. It amazes me in this forum that there are very few discussions/POVs on the audit/security element. In most cases (like this one), an experienced auditor would have picked this up in 20mins. If only Barclays (in this case) bothered to escape the fixed-10 years old checklist/audit program these would never have happened.
  - chrisan 6y ago
    > This is beyond "an honest mistake" and it should have been caught by any of the (many) scans the bank orders for its websites. And the scan/report should have caught that. Who does their scans/reports? What is the scope of these scans? Who reviews these reports? It is partially baffling at least. We had to do a standalone website ad campaign for a bank (same level/recognition as barclays) once, some kind of rewards program where all you could do was browse what was possible to redeem your points for. No accounts, no cart, no integration whatsoever, it was basically a static site (with some user interactivity). We'd get scanned constantly and were always made aware of mistakes or issues, one of them being 3rd party resources. On the other hand, I wasn't too impressed with their security scanning. Two issues had come up that made me dubious of what all good this actually did. First was some kind of ssh vulnerability. We were using an older (but still supported) amazon linux ami. The ssh was actually patched but the version did not match what they wanted in the security tool's version. We had to get them to talk with AWS to ensure it was an actual patched version of ssh and the security scanning tool just wasnt accepting it as valid. The other was some kind of javascript vulnerability in a library. There was an open cve on the library, an open issue on github, with comments on how to fix it, but the library itself wasn't being updated. I manually patched it and named it version x.y.z-patched or something. Report comes back that its still a vulnerability. I'm like what? Impossible I just patched it and tested it myself. The CVE no longer works. So I just renamed it to x-patched.y.z and poof, we pass validation. This was my version time with vulnerability testing and I was kinda let down by it. I assumed they had people (or tools) actually trying to exploit the site like how I tested the patch for the javascript library prevented the CVE from working instead of just looking for version numbers and comparing to a list of known issues.
    - ownagefool 6y ago
      This doesn't make the scanning dubious; it's just shows it's limitations of simply being a check of known vulnerabilities. If you hadn't scanned, would you have fixed the CVE at all?
      - VBprogrammer 6y ago
        I get what you are saying but I also think the parent has a point, if it was that easy to do an end run around the scanning (accidentally or otherwise) then it's not really suitable for auditing external parties. For your internal teams you can probably have some level of confidence they will fix it in good faith.
        ownagefool 6y ago
        Yeah it's complicated. Scanning is useful to automate a "thing" but your audit is multifaceted and should probably require peer review (pull/merge requests). In simple terms, scanning should _hopefully_ help a dev who wants to do the right thing, but it won't help a malicious dev, so you're gonna need something else. Peer review, least privileged access, protective monitoring, etc.
BattyMilk 6y ago
Until about a year ago I was working as a FE developer for a major intenrnational bank. All the processes and knowledge were in place to make sure all considerations were taken with our software with regards to security. But... all that good work and intention goes out the window when the marketing and analysis teams could pretty much, on a whim dump any old JS onto a production page via GTM. During my 18 months there, there were numerous issues (thankfully not security issues - at least that we know of) indroduced via this method inc a full outage of the customer onboarding journey.
- ethagnawl 6y ago
  What is GTM?
  - arez 6y ago
    Google Tag Manager https://tagmanager.google.com/ https://tagmanager.google.com/
  - deleted 6y ago
    [deleted]
- jcahill 6y ago
  "customer onboarding journey" sounds altogether twee for a major international bank. Banks are mattresses with insurance policies. Why is there even a journey to be broken?
  - gpm 6y ago
    Because they have to know who you are in a fair bit of detail both to comply with the law and to know who they should let take money out of the account. Because they need you to agree to a bunch of contacts. Because they need to get you things like a bank card. Because they need to decide if they want to lend you money (most often in the form of a credit card). And so on and so forth.
- tweetle_beetle 6y ago
  I see GTM being used (abused?) by marketing teams regularly, but I'm really surprised that a bank with its own development team would allow it. It is really powerful and sometimes incredibly useful in some scenarios (e.g I once built a schema.org metadata system that scraped the pages on the fly for a site with a broken CMS). Simo Ahava does clever things with it. But from what I can tell, it seems to be a way of avoiding communication between teams, or a political power grab inside bigger companies - a parallel CMS. And the silly bit is that it's normally not doing much more than could be achieved by copy and pasting a few lines of code into a template.
wastedhours 6y ago
When I was coming up as a CMS operator there were a lot of jobs to undertake site updates for banks and law firms - the JDs were always caveated about needing to understand both regulatory as well as security issues. I never applied as I like pushing the boundaries when it comes to using CMSs, but if they're calling it out from Day One it's also on the operator to not do it even if they could.
onion2k 6y ago
Adding scripts might be considered OK (content editors could be given light-weight developer tasks), but modifying the site's CSP definitely isn't. There aren't many things you can do to stop an attacker injecting code in to your site, but having a CSP that whitelists servers under your control and blocks everything else is something that you can implement. Changes to the CSP should not be done lightly. The fact that the CSP is whitelisting archive.org makes this look like an attack to me, or at least a test run before a real attack. I don't believe this was a simple mistake.
- mijoharas 6y ago
  I'm gonna invoke hanlon's razor (never attribute to malice what can equally be explained by stupidity) here to assert that this isn't an attack. Looks like their main homepage doesn't have a CSP policy at all https://cspvalidator.org/#url=https://www.barclays.com https://cspvalidator.org/#url=https://www.barclays.com I really hope they have a postmortem and actually implement a CSP for their site, pretty crazy not to, especially for a bank.
  - yyyk 6y ago
    "implement a CSP for their site, pretty crazy not to, especially for a bank." I just checked some of the local banks. Oh dear...
iforgotpassword 6y ago
Sure, but this is Barclays. Fun story: I had a Barclaycard once. I chose to get bills/invoices via snail mail because I'm old fashioned. Didn't use the card for almost a year after signing up and then finally bought something online with it. Got an invoice next month and paid it. Then got another invoice the next month over 60ct for the invoice sent via snail mail. Fair enough, they stated that when I signed up. But then I got another bulk the following month because, you guessed it, the invoice for the invoice was sent via mail. I tried to be clever then and paid 1.20€, but that doesn't work since I still got a letter saying there's still enough money in my account covering the invoice. So after four or five months I just gave up and canceled my account.

wolfgke 6y ago

> Content editors should not be able to add arbitrary code to a bank's website unless it undergoes review from someone who understands web security. Hardly anybody really understands web security.

HenryBemis 6y ago
I've audited e-banking websites before. Every file, every element needs to be accounted for. This is beyond "an honest mistake" and it should have been caught by any of the (many) scans the bank orders for its websites. And the scan/report should have caught that. Who does their scans/reports? What is the scope of these scans? Who reviews these reports? This is not about content. Content is "make a new page with that template and add a photo and the new text about XYZ product". Not a new functionality/code. I wonder who signed this off prior to.release and what does their wiki/Jira mentions. Edit: e-banking and other banks websites/online presence(s). Edit2/rant: I have been the go-to audit/sec/compliance guy for more than a decade. It amazes me in this forum that there are very few discussions/POVs on the audit/security element. In most cases (like this one), an experienced auditor would have picked this up in 20mins. If only Barclays (in this case) bothered to escape the fixed-10 years old checklist/audit program these would never have happened.
- chrisan 6y ago
  > This is beyond "an honest mistake" and it should have been caught by any of the (many) scans the bank orders for its websites. And the scan/report should have caught that. Who does their scans/reports? What is the scope of these scans? Who reviews these reports? It is partially baffling at least. We had to do a standalone website ad campaign for a bank (same level/recognition as barclays) once, some kind of rewards program where all you could do was browse what was possible to redeem your points for. No accounts, no cart, no integration whatsoever, it was basically a static site (with some user interactivity). We'd get scanned constantly and were always made aware of mistakes or issues, one of them being 3rd party resources. On the other hand, I wasn't too impressed with their security scanning. Two issues had come up that made me dubious of what all good this actually did. First was some kind of ssh vulnerability. We were using an older (but still supported) amazon linux ami. The ssh was actually patched but the version did not match what they wanted in the security tool's version. We had to get them to talk with AWS to ensure it was an actual patched version of ssh and the security scanning tool just wasnt accepting it as valid. The other was some kind of javascript vulnerability in a library. There was an open cve on the library, an open issue on github, with comments on how to fix it, but the library itself wasn't being updated. I manually patched it and named it version x.y.z-patched or something. Report comes back that its still a vulnerability. I'm like what? Impossible I just patched it and tested it myself. The CVE no longer works. So I just renamed it to x-patched.y.z and poof, we pass validation. This was my version time with vulnerability testing and I was kinda let down by it. I assumed they had people (or tools) actually trying to exploit the site like how I tested the patch for the javascript library prevented the CVE from working instead of just looking for version numbers and comparing to a list of known issues.
  - ownagefool 6y ago
    This doesn't make the scanning dubious; it's just shows it's limitations of simply being a check of known vulnerabilities. If you hadn't scanned, would you have fixed the CVE at all?
    - VBprogrammer 6y ago
      I get what you are saying but I also think the parent has a point, if it was that easy to do an end run around the scanning (accidentally or otherwise) then it's not really suitable for auditing external parties. For your internal teams you can probably have some level of confidence they will fix it in good faith.
      - ownagefool 6y ago
        Yeah it's complicated. Scanning is useful to automate a "thing" but your audit is multifaceted and should probably require peer review (pull/merge requests). In simple terms, scanning should _hopefully_ help a dev who wants to do the right thing, but it won't help a malicious dev, so you're gonna need something else. Peer review, least privileged access, protective monitoring, etc.

BattyMilk 6y ago

Until about a year ago I was working as a FE developer for a major intenrnational bank. All the processes and knowledge were in place to make sure all considerations were taken with our software with regards to security. But... all that good work and intention goes out the window when the marketing and analysis teams could pretty much, on a whim dump any old JS onto a production page via GTM. During my 18 months there, there were numerous issues (thankfully not security issues - at least that we know of) indroduced via this method inc a full outage of the customer onboarding journey.

ethagnawl 6y ago
What is GTM?
- arez 6y ago
  Google Tag Manager https://tagmanager.google.com/ https://tagmanager.google.com/
- deleted 6y ago
  [deleted]
jcahill 6y ago
"customer onboarding journey" sounds altogether twee for a major international bank. Banks are mattresses with insurance policies. Why is there even a journey to be broken?
- gpm 6y ago
  Because they have to know who you are in a fair bit of detail both to comply with the law and to know who they should let take money out of the account. Because they need you to agree to a bunch of contacts. Because they need to get you things like a bank card. Because they need to decide if they want to lend you money (most often in the form of a credit card). And so on and so forth.
tweetle_beetle 6y ago
I see GTM being used (abused?) by marketing teams regularly, but I'm really surprised that a bank with its own development team would allow it. It is really powerful and sometimes incredibly useful in some scenarios (e.g I once built a schema.org metadata system that scraped the pages on the fly for a site with a broken CMS). Simo Ahava does clever things with it. But from what I can tell, it seems to be a way of avoiding communication between teams, or a political power grab inside bigger companies - a parallel CMS. And the silly bit is that it's normally not doing much more than could be achieved by copy and pasting a few lines of code into a template.

wastedhours 6y ago

When I was coming up as a CMS operator there were a lot of jobs to undertake site updates for banks and law firms - the JDs were always caveated about needing to understand both regulatory as well as security issues. I never applied as I like pushing the boundaries when it comes to using CMSs, but if they're calling it out from Day One it's also on the operator to not do it even if they could.

onion2k 6y ago

Adding scripts might be considered OK (content editors could be given light-weight developer tasks), but modifying the site's CSP definitely isn't. There aren't many things you can do to stop an attacker injecting code in to your site, but having a CSP that whitelists servers under your control and blocks everything else is something that you can implement. Changes to the CSP should not be done lightly. The fact that the CSP is whitelisting archive.org makes this look like an attack to me, or at least a test run before a real attack. I don't believe this was a simple mistake.

mijoharas 6y ago
I'm gonna invoke hanlon's razor (never attribute to malice what can equally be explained by stupidity) here to assert that this isn't an attack. Looks like their main homepage doesn't have a CSP policy at all https://cspvalidator.org/#url=https://www.barclays.com https://cspvalidator.org/#url=https://www.barclays.com I really hope they have a postmortem and actually implement a CSP for their site, pretty crazy not to, especially for a bank.
- yyyk 6y ago
  "implement a CSP for their site, pretty crazy not to, especially for a bank." I just checked some of the local banks. Oh dear...

iforgotpassword 6y ago

Sure, but this is Barclays. Fun story: I had a Barclaycard once. I chose to get bills/invoices via snail mail because I'm old fashioned. Didn't use the card for almost a year after signing up and then finally bought something online with it. Got an invoice next month and paid it. Then got another invoice the next month over 60ct for the invoice sent via snail mail. Fair enough, they stated that when I signed up. But then I got another bulk the following month because, you guessed it, the invoice for the invoice was sent via mail. I tried to be clever then and paid 1.20€, but that doesn't work since I still got a letter saying there's still enough money in my account covering the invoice. So after four or five months I just gave up and canceled my account.