bugtraq - Banks (Wellsfargo.com) using CDNs to deliver Javascript: enables password theft by anyone compromising or controlling the CDN

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: 20 Nov 2007 03:39:28 -0000
From: joel@...hkin.net
To: bugtraq@...urityfocus.com
Subject: Banks (Wellsfargo.com) using CDNs to deliver Javascript: enables
 password theft by anyone compromising or controlling the CDN

In a recent chnage, wellsfargo.com started to include javascript delivered by akamai.net within sensitive pages, such as their login page.

Since any script loaded by the page has access to all the page data, that script could steal passwords very easily.  Loading the script via a CDN reduces the banks security to the level of security provided by the CDN.  I doubt that banking regulators would approve.

An attack on akamai or an insider there could access all wellsfargo.com bank accounts.

This is the equivalent of noticing that the bank's vault has another door and connects to the candy shop next door.   Sure the candy shop is owned by a nice guy who locks his door at the end of the day, but I don't expect my bank to rely on him for security.

This was reported to wellsfargo security on November 17.  They assure me that the padlock icon on the browser means everything is just fine.