Home page logo

bugtraq logo Bugtraq mailing list archives

Charter One Bank privacy/security hole
From: "Dustin Miller" <dustin () fusewerx com>
Date: Tue, 13 Nov 2001 19:17:22 -0600

I recently e-mailed Charter One to notify them of this security
loophole.  Their response was just plain ignorant, telling me there is
no security problem when there is clearly a gaping one.

This affects ALL Charter One online banking customers who sign up for
additional deposit/savings accounts from the Charter One online banking

When logged in to the Charter One online banking site, one of the menu
options (New Accounts) allows you to apply online for Deposit Accounts
or Consumer Loans.  Selecting either of those options brings up a page
prompting you to "click the 'Submit' button below".  Clicking that
button submits a form with hidden form fields containing the customer's
name, address, phone number, zip code, and social security number.
That, in and of itself, is a bit unusual.  The bad part is this: It
submits it to an insecure form, allowing anyone sniffing that connection
access to all the information they need to steal the customer's

Here's a snippet of the offending code (identifying info ***'d out)

<form  name="confirmGo" method="post"
action="http://www.charterone.com/pf/brokat_deposit.asp"; />
<input type="hidden" name="URLRETURN"
value="https://www.totallyfreebanking.com/deposit_accounts.jsp"; />
<input type="hidden" name="SOURCEURL"
value="https://www.totallyfreebanking.com/deposit_accounts.jsp"; />
<input value="*********"      name="TAXID"      type="hidden">
<input value="DUSTIN"       name="NAME"       type="hidden">
<input value="MILLER"      name="NAME_2"     type="hidden">
<input value="**********************"    name="ADDRESS"
<input value=""   name="ADDRESS_2"  type="hidden">
<input value="*************"       name="CITY"       type="hidden">
<input value="**"      name="STATE"      type="hidden">
<input value="*****-****"        name="ZIP"        type="hidden">
<input value="**********"  name="HOME_PHONE" type="hidden">
<input value="dustin () fusewerx com"      name="EMAIL"      type="hidden">
Dustin Miller, President
FuseWerx LTD
Purveyors of Technological Magic

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]