Reader Comments

Subscribe: RSS

View by: Time | Thread

• 

  Greg Funk, 29 Oct 2000 @ 5:43pm

  
  

  Look closer...

  You should look closer at the URL. This is merely a way of posting information to the page (albeit a lame method). There is no account information related to you. You can confirm this by changing some of the parameters in the URL and getting new output. Try this:
  
  https://www.accountonline.com/CB/amount.jsp?POSTING_DATE=10%2F20%2F00&SALE_DATE=10%2F20%2F00&TR ANSACTION_TYPE_TEXT=ANONYMOUS+USAGE&REFERENCE_NUMBER=00000000&PERSON_NAME=&TRANSACTION_AMOUNT=1000.0 0&FOREIGN_CURRENCY=&MERCHANT_DESCRIPTION=ANONYMOUS+USAGE+OCT+00-SEP+01++++++++++++&SIC_DESCRIPTION=+ +++++++++++++++++++++++++++++++++++++++&STATEMENT_DATE=10%2F19%2F00
  
  Now this would all change if account number and any reference numbers were part of the URL passed.
  
  Greg

  [ link to this | view in chronology ]

  • 

    Dan Miller, 29 Oct 2000 @ 10:43pm

    
    

    Re: Look closer...

    You are right that it is a posting method. The point is not the stupidity of the URL formation, but that the fact that anyone could sit down at my computer, start to type the Citibank address and have the rest auto-filled in, including the URL with the transaction information. This is utterly stupid programming and a security hole, in my view.

    [ link to this | view in chronology ]

    • 

      mhh5, 29 Oct 2000 @ 11:10pm

      
      

      Re: Look closer...

      I hope you've reported that hole... But it's not an uncommon thing....

      [ link to this | view in chronology ]

    • 

      R.E.Norton, 30 Oct 2000 @ 9:23am

      
      

      Re: Look closer...

      Two things: You should not allow untrusted persons to access your PC. If this is not possible, use the Browser's feature to delete all history from the cache and the URL bar...

      [ link to this | view in chronology ]

• 

  Ookami, 30 Oct 2000 @ 9:21am

  
  

  The URL is secure

     After playing with the URL you posted for a min or two I have determined that the only thing that could be potentially insecure about it is that someone could grab your account number. Using that URL though does not pose any security risk. The only place the information in that URL goes is into a script that formats whatever is in it. Thier database is not accessed. Check out my modification of the link here to see an example.
  
  Otakudo - The Way of the Nerd.

  [ link to this | view in chronology ]