[23164] in bugtraq
Charter One Bank privacy/security hole
daemon@ATHENA.MIT.EDU (Dustin Miller)
Thu Nov 15 21:18:01 2001
From: "Dustin Miller" <dustin@fusewerx.com>
To: <bugtraq@securityfocus.com>
Date: Tue, 13 Nov 2001 19:17:22 -0600
Message-ID: <!~!UENERkVCMDkAAQACAAAAAAAAAAAAAAAAABgAAAAAAAAAG6NY/iXCQkS8FUGP284EfsKAAAAQAAAAtefBaITAWEGi0RETpX0LugEAAAAA@fusewerx.com>
MIME-Version: 1.0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
I recently e-mailed Charter One to notify them of this security
loophole. Their response was just plain ignorant, telling me there is
no security problem when there is clearly a gaping one.
This affects ALL Charter One online banking customers who sign up for
additional deposit/savings accounts from the Charter One online banking
site.
When logged in to the Charter One online banking site, one of the menu
options (New Accounts) allows you to apply online for Deposit Accounts
or Consumer Loans. Selecting either of those options brings up a page
prompting you to "click the 'Submit' button below". Clicking that
button submits a form with hidden form fields containing the customer's
name, address, phone number, zip code, and social security number.
That, in and of itself, is a bit unusual. The bad part is this: It
submits it to an insecure form, allowing anyone sniffing that connection
access to all the information they need to steal the customer's
identity.
Here's a snippet of the offending code (identifying info ***'d out)
<form name="confirmGo" method="post"
action="http://www.charterone.com/pf/brokat_deposit.asp" />
<input type="hidden" name="URLRETURN"
value="https://www.totallyfreebanking.com/deposit_accounts.jsp" />
<input type="hidden" name="SOURCEURL"
value="https://www.totallyfreebanking.com/deposit_accounts.jsp" />
<input value="*********" name="TAXID" type="hidden">
<input value="DUSTIN" name="NAME" type="hidden">
<input value="MILLER" name="NAME_2" type="hidden">
<input value="**********************" name="ADDRESS"
type="hidden">
<input value="" name="ADDRESS_2" type="hidden">
<input value="*************" name="CITY" type="hidden">
<input value="**" name="STATE" type="hidden">
<input value="*****-****" name="ZIP" type="hidden">
<input value="**********" name="HOME_PHONE" type="hidden">
<input value="dustin@fusewerx.com" name="EMAIL" type="hidden">
-----
Dustin Miller, President
FuseWerx LTD
Purveyors of Technological Magic
http://www.fusewerx.com
