Recently we exploited nice XSS vector in one of RBS (Remote Banking Service) system. This example shows very well how dangerous can be client-attack.
Client after the authorization could sign electronic documents.
For signature from browser developers used CAPICOM technology.
If you are already understood us, you can not finish this note ;)
Signature from JavaScript - this is easy and usefull from client-side attacks.
JS code for sign document looks like:
You can easily call this function from stored/reflected XSS to sign arbitrary data.
To solve the PIN entry problem, we have used the caching mechanism for the key. Most often, after entering the PIN code of the key, PIN is remembered for a while.
So we were able to sign arbitrary (injected) document immediately after the user signs his own document (and entered PIN of course).
Then, using the Javascript we were able to hide the injected signed document from users's orders table (document was order request) for current user.
So only a single stored XSS vulnerability defeated all security measures of the RBS system. Note, that typically protections such as httpOnly cookies and SSL have been included, but it does not help.
Client after the authorization could sign electronic documents.
For signature from browser developers used CAPICOM technology.
If you are already understood us, you can not finish this note ;)
Signature from JavaScript - this is easy and usefull from client-side attacks.
JS code for sign document looks like:
function SignCreate(certSubjectName, dataToSign) { var oStore = CreateObject("CAPICOM.Store"); oStore.Open(CAPICOM_CURRENT_USER_STORE, CAPICOM_MY_STORE, CAPICOM_STORE_OPEN_MAXIMUM_ALLOWED); var oCertificates = oStore.Certificates.Find( CAPICOM_CERTIFICATE_FIND_SUBJECT_NAME, certSubjectName); if (oCertificates.Count == 0) { alert("Certificate not found: " + certSubjectName); return; }
...
You can easily call this function from stored/reflected XSS to sign arbitrary data.
To solve the PIN entry problem, we have used the caching mechanism for the key. Most often, after entering the PIN code of the key, PIN is remembered for a while.
So we were able to sign arbitrary (injected) document immediately after the user signs his own document (and entered PIN of course).
Then, using the Javascript we were able to hide the injected signed document from users's orders table (document was order request) for current user.
So only a single stored XSS vulnerability defeated all security measures of the RBS system. Note, that typically protections such as httpOnly cookies and SSL have been included, but it does not help.
nice artical
ОтветитьУдалитьYour English kills me. It must be really very "artical" ;)
ОтветитьУдалитьYou might be asking how you can keep away from this, or whether a payday advance is ever justified regardless of the hazard.
ОтветитьУдалитьCash Advance
So it is prudent to pick your bank carefully, by working out the net payable enthusiasm utilizing the online mini-computers for the most part gave by the loan specialists site.
ОтветитьУдалитьPayday Loans Chicago
Know about every one of the terms and conditions that may apply. The web makes correlation shopping simple; ensure you exploit this to spare a couple of dollars on charges every payday.
ОтветитьУдалитьPayday Loans Chula-vista
Payday credits are a snappy and simple approach to 'top up' a financial balance that may have excessively month left toward the finish of the cash!
ОтветитьУдалитьCash Advance Corona
Savage moneylenders are promptly accessible so take the time and contact no less than 3 unique organizations preceding being in a defenseless state.
ОтветитьУдалитьCar Title Loans Chicago
Thanks It was useful and practical
ОтветитьУдалитьدانلود سریال قورباغه دانلود سریال قورباغه دانلود سریال قورباغه دانلود سریال قورباغه دانلود سریال قورباغه
ОтветитьУдалитьشركة تنظيف الامارات
شركة تنظيف دبي شركة نظافة بدبي
شركة تنظيف كنب دبي بالبخار تنظيف كنب دبي بالبخار
شركة غسيل سجاد بدبي غسيل سجاد دبي
شركة تنظيف في ابوظبي شركات تنظيف ابوظبي
شركة تنظيف منازل فى العين شركة تنظيف منازل العين
شركات تنظيف كنب في ابوظبي شركات تنظيف كنب ابوظبي
دانلود سریال موچین
ОтветитьУдалитьhttps://www.namayesh.com/v/o722
دانلود سریال موچین
ОтветитьУдалитьhttp://netlike.blog.ir/1399/01/29/mochin-series
دانلود سریال موچین
ОтветитьУдалитьhttp://topwebdesign.mihanblog.com/post/287
Этот комментарий был удален автором.
ОтветитьУдалитьbest tnks
ОтветитьУдалитьhttps://toplink-33.webself.net/ramin-fallah
https://www.aparat.com/result/gitar_ramin_fallah_Maple
https://www.slideshare.net/miladdel/ramin-fallah
https://uta.academia.edu/RaminFallah
https://www.facebook.com/public/Ramin-Fallah
ОтветитьУдалитьhttp://www.fast-trackdiagnostics.com/human-line/our-distributors/iran/
https://theiranproject.com/blog/tag/ramin-fallah/
http://ncmbjpiau.ir/article-1-623-en.html
best
ОтветитьУдалитьhttp://postbe.parsiblog.com/category/%d9%81%d8%b6%d8%a7%d9%8a+%da%a9%d8%a7%d8%b1+%d8%a7%d8%b4%d8%aa%d8%b1%d8%a7%da%a9%d9%8a+%d9%be%d8%a7%d8%b1%d8%a7%d8%af%d8%a7%d9%8a%d8%b3+%d9%87%d8%a7%d8%a8/
best
ОтветитьУдалитьhttps://www.pinterest.com.au/raminfallahco/
https://www.pinterest.se/pin/763641680547137509/
https://www.pinterest.co.uk/pin/677017756464692529/
https://www.pinterest.com.mx/pin/722757440179487563/
https://www.pinterest.cl/pin/799881583799104958/?send=true
tnks
ОтветитьУдалитьفضای کار
فضای کار اشتراکی
فضای کار اشتراکی در تهران
فضای کار مشترک
اجاره فضای کاری
https://penzu.com/p/9f4c447f
ОтветитьУдалитьI was able to find good info from your articles. http://webcity.ir
ОтветитьУдалитьhttp://webcity.ir ابزار وبلاگ
Great article! We will be linking to this great article on our website. Keep up the good writing.
ОтветитьУдалитьروش تحقیق در علوم رفتاری زهره سرمد روش تحقیق در علوم رفتاری زهره سرمد
روش تحقیق در علوم رفتاری زهره سرمد روش تحقیق در علوم رفتاری زهره سرمد
ОтветитьУдалитьhttp://edoctors.rozblog.com/post/17