Online Banking Industry Very Vulnerable to Cross-Site Scripting Frauds

[David Farber <dave () farber net>]

------ Forwarded Message
From: Monty Solomon <monty () roscom com>
Date: Tue, 15 Mar 2005 11:53:47 -0500
To: <undisclosed-recipient:;>
Subject: Online Banking Industry Very Vulnerable to Cross-Site Scripting
Frauds


Online Banking Industry Very Vulnerable to Cross-Site Scripting
Frauds 

Phishing Attacks reported by members of the Netcraft Toolbar
community show that many large banks are neglecting to take
sufficient care with the development and testing of their online
banking facilities.

Well known banks have created an infestation of application bugs and
vulnerabilities across the Internet, allowing fraudsters to insert
their data collection forms into bona fide banking sites, creating
convincing frauds that are undetectable to most customers. Indeed, a
personal finance journalist writing for The Motley Fool was brave
enough to publicly admit to having fallen for a fraud running on
Suntrust's site and having her current account cleaned out. It's a
reasonable premise that if a Motley Fool journalist can fall for a
fraud, anyone can.

One fraud recently blocked by the Netcraft Toolbar was at Citizens
Bank. Fraudsters composed and mass mailed a phishing mail which
exploited a program on CitizensBank.com, loading Javascript from the
attackers' server hosted at Telecom Italia. Customers were presented
with a page bearing the CitizensBank.com URL in the address bar,
while the browser window displays a form from the Telecom Italia
server asking for user login information.

The script being exploited allows visitors to search for Citizens
Bank branch offices in their town. Along with search scripts, branch
locator pages are frequently carelessly coded and are targets for
fraudsters who are actively analyzing financial web sites for
weaknesses.

...

http://news.netcraft.com/archives/2005/03/11/online_banking_industry_very_vu
lnerable_to_crosssite_scripting_frauds.html



------ End of Forwarded Message


-------------------------------------
You are subscribed as lists-ip () insecure org
To manage your subscription, go to
  http://v2.listbox.com/member/?listname=ip

Archives at: http://www.interesting-people.org/archives/interesting-people/