3 ms·

Typically bank tech support have no idea about the inner workings of their website. My bank uses 2 stage auth to login which works really well. However, they h

Typically bank tech support have no idea about the inner workings of their website. My bank uses 2 stage auth to login which works really well. However, they have a sort of shortcut service where you can activate and pick a password and then use that password to do quick stuff online or in their mobile app. The quick stuff still let's you transfer away all your money to someone else so it's basically a gaping hole. That password has the wildest restrictions I've seen. It allows only a-zA-Z0-9 and it must consist of exactly 6 characters. No restriction on containing at least one digit or anything like that. I've e-mailed them several times about this but their response is that this particular service has been out sourced to one of the many companies they out source things to, so they have no control at all over it. And it's rather funny because you can tell that when you use this service, you're taken to a completely different server farm than the rest of the internet site. Fucking scary is what I call it.

ValentineC 14y ago
I imagine there's the possibility of a huge PR scandal, especially if a blog post is written eloquently and carried by the right news sources. Unless the bank doesn't care about their image, of course.
- INTPenis 14y ago
  You know you really got me going with your post. I've spent the whole day thinking about this and now I've been looking up ways to write a PoC. Because I don't think a blog post without a proper PoC will do much good. So first of all assembling a wordlist was easy using Python. The hard part will without a doubt be interacting with one of the entry points to their service. It's a flash application, with a login form. I've discovered Selenium for this purpose, and theoretically Selenium can act as a browser, clicking input fields in the flash form relative to where the element is created on the page. And then I can take a picture of the current page after each operation and compare it to how the page should look at login, or at failed login. Jesus did you just ruin my weekend. ;) (in a good way) Edit: Found sikuli and was amazed by how simple it is. Jython script that let's you essentially use images from your screen as conditional expressions in Jython. So you can do if exists(screenshot of bank login form.jpg): click(screenshot of first input field.jpg) type('bla') And so forth. Very powerful stuff! Sikuli scripts can then be called by external programs such as CPython Popen for example, and passed arguments.

ValentineC 14y ago

I imagine there's the possibility of a huge PR scandal, especially if a blog post is written eloquently and carried by the right news sources. Unless the bank doesn't care about their image, of course.

INTPenis 14y ago
You know you really got me going with your post. I've spent the whole day thinking about this and now I've been looking up ways to write a PoC. Because I don't think a blog post without a proper PoC will do much good. So first of all assembling a wordlist was easy using Python. The hard part will without a doubt be interacting with one of the entry points to their service. It's a flash application, with a login form. I've discovered Selenium for this purpose, and theoretically Selenium can act as a browser, clicking input fields in the flash form relative to where the element is created on the page. And then I can take a picture of the current page after each operation and compare it to how the page should look at login, or at failed login. Jesus did you just ruin my weekend. ;) (in a good way) Edit: Found sikuli and was amazed by how simple it is. Jython script that let's you essentially use images from your screen as conditional expressions in Jython. So you can do if exists(screenshot of bank login form.jpg): click(screenshot of first input field.jpg) type('bla') And so forth. Very powerful stuff! Sikuli scripts can then be called by external programs such as CPython Popen for example, and passed arguments.