Security Advisory: Banks in Taiwan (by militan)

Nabukadnezar · February 12, 2009

==============================================

Security Advisory: Banks in Taiwan

militan (Lin, Chia-Jun)

militan.c7 [at] gmail.com

Advanced Defense Lab, NCU CSIE TAIWAN

12th February, 2009

==============================================

I. VULNERABILITY

-------------------------

Blind Command(SQL, LDAP) Injection

Information Leakage

Banks below are vulnerable:

Union bank of Taiwan. www.ubot.com.tw

prudential uk in Taiwan. www.pcafunds.com.tw

II. DESCRIPTION

-------------------------

Some banks or fund companies contain vulnerabilities while handling account information,

it may cause information leakage.

Usually the input is sanitized indeed, but some specific pages do not perform the validation properly.

Otherwise, sometimes error messages also show the architecture of web sites.

III. POC

-------------------------

1. Union bank: may be susceptible to blind injection.

2. prudential uk in Taiwan: Get information first(JNDI LDAP), then do the LDAP injection.

3. SinoPac Securities: The page re-generates the password in Javascript. It`s not a vulnerability, but a insecure behavior in programming.

IV. SOLUTION& CONCLUSION

-------------------------

Strip all symbols in ANY input variable.

This advisory prove that sites of banks are not secure enough.

Vulnerabilities may be fixed up in a very short time because details were sent to them already

Citi?i ?i:

Recommended Posts