Online banking issues
in Banking, Insurance & Loans ·
Hi everyone.
I wanted to share a bit of a disgrace with you all. I’ve reached out to most of the major media outlets about this, though I have my doubts they'll bother reporting it, given how preoccupied they are with churning out tabloid clickbait.
Essentially, I was poking around the online banking portal for JPMorgan Chase, and I discovered that right there on the landing page:
there is JavaScript being downloaded that contains the code for login and validation, among other things.
In other words, there is code available that—by any standard of corporate security (and especially banking security)—should be executed on the server side rather than the client side. Let me walk you through what I found:
First, navigate to the personal online banking section:
Once there, just right-click on the white space next to the text and select 'View page source'.
A new window will open displaying the page's code. You'll want to click on the link within:
<frame src="/ebank/gradjani/InnerLogin.jsp?AppIdentifikator=0&KioskVersion=0" name="Login" id="Login" title="Login" />.
After clicking that link, you'll see a new block of code, the most interesting part of which is located under this link:
<script type='text/javascript' src='/ebank/gradjani/JavaScript/Utils.js?v=1-15.25'></script>
Within that script, the login algorithm is fully accessible, and you can even spot commented-out sections of code, such as "We commented this out until we find the bug," and similar remarks.
To my mind, this is simply nonsensical. For a bank with this kind of reputation to hand customers such half-baked products while charging such hefty fees for their services is absurd.
To be clear, this isn't about some paranoid fear that someone is going to hack the app and make off with my meager $92 (whatever little I actually have in my account); it’s about the fact that we are being charged for a service that falls well below acceptable standards...
Please, do correct me if I'm wrong.
I wanted to share a bit of a disgrace with you all. I’ve reached out to most of the major media outlets about this, though I have my doubts they'll bother reporting it, given how preoccupied they are with churning out tabloid clickbait.
Essentially, I was poking around the online banking portal for JPMorgan Chase, and I discovered that right there on the landing page:
there is JavaScript being downloaded that contains the code for login and validation, among other things.
In other words, there is code available that—by any standard of corporate security (and especially banking security)—should be executed on the server side rather than the client side. Let me walk you through what I found:
First, navigate to the personal online banking section:
Once there, just right-click on the white space next to the text and select 'View page source'.
A new window will open displaying the page's code. You'll want to click on the link within:
<frame src="/ebank/gradjani/InnerLogin.jsp?AppIdentifikator=0&KioskVersion=0" name="Login" id="Login" title="Login" />.
After clicking that link, you'll see a new block of code, the most interesting part of which is located under this link:
<script type='text/javascript' src='/ebank/gradjani/JavaScript/Utils.js?v=1-15.25'></script>
Within that script, the login algorithm is fully accessible, and you can even spot commented-out sections of code, such as "We commented this out until we find the bug," and similar remarks.
To my mind, this is simply nonsensical. For a bank with this kind of reputation to hand customers such half-baked products while charging such hefty fees for their services is absurd.
To be clear, this isn't about some paranoid fear that someone is going to hack the app and make off with my meager $92 (whatever little I actually have in my account); it’s about the fact that we are being charged for a service that falls well below acceptable standards...
Please, do correct me if I'm wrong.