Citibank Canada

Printable View

January 2nd, 2003, 05:54 PM
sweet_angel

Citibank Canada

Quote:

To: BugTraq
Subject: Re: CITIBANK [CANADA]: INTERNET EXPLORER BROWSERS
Date: Dec 30 2002 9:47PM
Author: Ben Laurie <[email protected]>
Message-ID: <[email protected]>
In-Reply-To: <[email protected]>

[email protected] wrote:
> Sunday, December 29, 2002
>
> There is a small silly hitch with CITIBANK CANADA's secured sign in
> to online banking:
>
> https://citibankcanada.ebilling.com/index.jhtml
>
> Specifically AUTOCOMPLETE="off" in the forms. It is not set.
>
> While much explanation is made about SSL connections and fancy
> digital certificates, the simplest of web programming errors
> Thwarte ! all that:
>
> CITIBANK CANADA's login allows for the Microsoft Internet Explorer
> autocomplete feature to function. What that does is remember your
> name and password. So on a public or even private machine, all one
> needs to do is, double click the "name" form and the password will
> automicrosoftly autocomplete [fill in].

This is, of course, a fault in IE, not Citibank.

Cheers,

Ben.

I just read this bugtraq...and my question is ...is this one of vulnerability...of IE?..if so... that could be dangerous..I suppose.
I can't go the link..today..but two days ago still on
January 2nd, 2003, 06:54 PM
CXGJarrod

Its a IE Issue. Its only a problem if you use a public computer with the Autocomplete feature turned on. They could of done better coding and included that autocomplete=off in the forms.
January 2nd, 2003, 07:12 PM
phishphreek

To disable autocomplete... follow the instructions here.

I think this is also profile based, so you'd have to do that for every user account that has it turned on.
January 2nd, 2003, 07:41 PM
Tedob1

its amazing that a program written for an online banking program wouldn't include that...someone no doubt lost their job!
January 2nd, 2003, 08:27 PM
Vorlin

The problem is, the page with the forms won't have anything preventing auto-complete to not work unless it might be an ASP page (I don't know if they do any kind of circumvention for things like this, like password fields are filled with *'s automatically). IE's to blame here for allowing ANY field to be filled in, no matter what the content, cookie timeout length, secure pages, etc etc.

I'd simply make it (if I were doing anything with IE) so that any page that's "secure" to not cache anything previously put in said fields.

EDIT: of course, that would require IE to UPDATE their browser and we know that hasn't happend in quite some time. <shameless plug> Opera 7 now has the 2nd beta out! </shameless plug>