> An attack on akamai or an insider there could access all
> wellsfargo.com bank accounts.
>
> This is the equivalent of noticing that the bank's vault has another
> door and connects to the candy shop next door. Sure the candy shop
> is owned by a nice guy who locks his door at the end of the day, but
> I don't expect my bank to rely on him for security.
>
> This was reported to wellsfargo security on November 17. They
> assure me that the padlock icon on the browser means everything is
> just fine.
Vulnerability like in topic (connected with vulns in xpdf). More details available here:
======
Last few weeks I was talking(mailing) with Derek (xpdf developer –
btw. really nice guy) about some vulnerabilities in his product. 14th of
October he published path for bugs (not only my vulnerabilites) so i decide
to release advisory…
Oryginal advisory you can find here… I want to write about this
vulnerabilites on blog for several reasons:
Since any script loaded by the page has access to all the page data, that script could steal passwords very easily. Loading the script via a CDN reduces the banks security to the level of security provided by the CDN. I doubt that banking regulators would approve.
An attack on akamai or an insider there could access all wellsfargo.com bank accounts.
This is the equivalent of noticing that the bank's vault has another door and connects to the candy shop next door. Sure the candy shop is owned by a nice guy who locks his door at the end of the day, but I don't expect my bank to rely on him for security.
This was reported to wellsfargo security on November 17. They assure me that the padlock icon on the browser means everything is just fine.
