full-disclosure - http://www.chase.com/ vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <40B7D346.3070302@comcast.net>
From: Dark-Avenger at comcast.net (Dark-Avenger)
Subject: http://www.chase.com/ vulnerability

No, you are not correct. Take a look at the source of the page, and you 
can see that the login is a POST operation to an https page.


Subject: 	RE: [Full-Disclosure] http://www.chase.com/ vulnerability
Date: 	Fri, 28 May 2004 12:11:26 -0700
From: 	Schmidt, Michael R. <Michael.Schmidt@...obile.com>
To: 	'Perry E. Metzger' <perry@...rmont.com>, 
full-disclosure@...ts.netsys.com

>Yes, you are correct; when you go to the "contact us" page they require you to use the quite un-secure login page first.  That is brilliant.  The credentials are passed along unsecured over the Internet.  I am glad that my bank has an actual SSL login page.
>
>I sent them a message - one that the page said was "protected" via SSL, which it was not, it was however posted to a page that had SSL, then redirected to a non protected thank you page.  This is such poor security that it is frightening.  Do they not understand that all the posted data is being sent clear text?
>
>Someone needs to be fired.
>
>-----Original Message-----
>From: full-disclosure-admin@...ts.netsys.com [mailto:full-disclosure-admin@...ts.netsys.com]On Behalf Of Perry E. Metzger
>Sent: Friday, May 28, 2004 10:57 AM
>To: full-disclosure@...ts.netsys.com
>Subject: [Full-Disclosure] http://www.chase.com/ vulnerability
>
>
>I don't know if this is the right place to note a vulnerability in an
>individual web site, but it is the web site of one of the largest
>banks in the world, and it is a serious vulnerability. I have given up
>on finding anyone inside JP Morgan Chase to tell about it, and not for
>lack of trying.
>
>If you go over to http://www.chase.com/, you will note that there is a
>form on the front page to enter your userid and password for your bank
>account.  Note that the page is downloaded without SSL -- it is an
>ordinary http downloaded page.
>
>If the page isn't mangled by evil people, this is vaguely safe because
>the form posts the information via SSL, but as we all know, the world
>is *not* free of bad guys, and a person with malice in their heart
>could "man in the middle" attack you and redirect the form to a site of
>their choosing. One could, of course, always read the html to make
>sure it is pointing at the right place, but as no one ever does that
>it is barely worth mentioning.
>
>The man in the middle attack can be done in a variety of ways,
>including spoofing DNS replies to victims computers or wholesale
>interception of the the http request. Wireless also makes for some fun
>games. I leave all that as an exercise to the reader -- how such an
>attack is performed isn't important, only that Chase has left its
>customers vulnerable to such an attack.
>
>Note that Chase is effectively training their customers to enter in
>vital passwords into forms downloaded in the clear, which is precisely
>the opposite of what it should encourage. A major international bank
>should know better. In addition, they display a small image of a
>closed lock next to the insecure form -- thus training their users to
>be confused about what the lock image in the corner of their browser
>means, and about when they are and are not entering data securely.
>
>I first reported this problem to Chase quite some time ago, and I
>tried reporting it again to them about three months ago. I got
>nowhere. I more recently resorted to asking a friend who worked at the
>company to leak me the name of a Chase internal security person, and I
>emailed them. They replied, saying they would look in to it, but sadly
>no action whatsoever has been taken.
>
>It is a shame that so many large companies have made it effectively
>impossible for their customers to report problems, such as security
>issues. I should not have to resort to posting in public to get
>the problem fixed. Sadly I'm unsure of any other way to proceed.
>
>
>--
>Perry E. Metzger                perry@...rmont.com
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.netsys.com/full-disclosure-charter.html
>
>  
>