Security issue in Mashreq Bank Official Website

DISCLAIMER: IT’S MY PERSONAL VIEW POINT. THIS ARTICLE IS NOT INTEND FOR DECISION MAKING. PLEASE CONSULT YOUR SECURITY ADVISOR OR CONTACT ME IN PERSON FOR DETAILS.

Mashreq Bank official website may look perfect when entered URL http://www.mashreqbank.com or googled for “Mashreq Bank”.

What’s the problem with Mashreq Bank Official Website?

But is the Mashreq Bank website secure? Not really! 

Security is an essential factor for bank websites. Banks and most sensitive information websites are highly recommended to use a secure layer called TLS (SSL was officially deprecated – read more) to transfer information. Such HTTPS communication will prevent eavesdropping, man-in-the-middle attacks that may lead to Phishing attacks to steal customer internet banking username and password information.

HTTPS (Secured Hyper Text Transfer Protocol) provides the maximum protection from the most notorious hacker attacks for banking websites like phishing and sniffing.

What happens when you try https://www.mashreqbank.com?

Invalid Certificate Notice

I am curious, so what happens when you hit Continue to this website (which was not recommended!)?

Note: Typing the full URL of the website (when known) with https is the safest way to access websites.

What is the Problem (Technically)?

The Mashreq Bank official website (www.mashreqbank.com) SSL Certificate is mapped to a wrong certificate that was issued to the Mashreq Bank’s Career portal (careers.mashreqbank.com).

Note: Unfortunately, the career portal is also down.

CERTIFICATE PATH

Besides, the certificate signature has algorithm is a very weak SHA-1 algorithm which needs to be updated to SHA256 as soon as possible. Read more about SHA-1 Sunset.

Is my Mashreq Online Banking unsafe? 

No, not really! The Net Banking is still safe and well secured. The potential risk is only when you are redirected from Official Website to Net Banking site and other potential attacks such as Phishing and zero-day attacks. 

Besides, Mashreq Bank is a reputed financial institution. You may expect for the best support from the bank during such unfortunate situations.

How am I affected?

Mashreq Bank official website has potential security risk. But the Online Banking portal https://netbanking.mashreq.com is safe and configured with good security systems.

• Though you cannot do much on the server side, you can protect yourself by not accessing your bank website on public wifi in cafes, public transportation, etc., and securing your home/office wifi networks. 

Mashreq Online Banking Portal - Certificates

Read about Security Attacks

• Phishing Attack
• https://en.wikipedia.org/wiki/Phishing
• Spoofing Attack
• https://en.wikipedia.org/wiki/Spoofing_attack 
• HTTPS
• https://en.wikipedia.org/wiki/HTTPS

HTTPS protects the integrity of your website

By Google:

HTTPS helps prevent intruders from tampering with the communications between your websites and your users’ browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages.

Intruders exploit unprotected communications to trick your users into giving up sensitive information or installing malware, or to insert their own advertisements into your resources. For example, some third-parties inject advertisements into websites that potentially break user experiences and create security vulnerabilities.

Intruders exploit every unprotected resource that travels between your websites and your users. Images, cookies, scripts, HTML… they’re all exploitable. Intrusions can occur at any point in the network, including a user’s machine, a Wi-Fi hotspot, or a compromised ISP, just to name a few.

--

Hope Mashreq will take action very soon.
Cheers!

Arun Ramachandran

Please reach me or leave your comments in the comment section. I'll get back to you as soon as possible.

SHA-1 Sunset by January, 2017

SHA-1 is a weaker cryptographic hash function and more than 12 years old now. (Time to retire!) All major web browsers have officially announced to SHA-1 Sunset from January, 2017.

• Google (Chrome)
• http://blog.chromium.org/2014/09/gradually-sunsetting-sha-1.html 
• https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/2-R4XziFc7A/YO0ZSrX_X4wJ
• Apple (Safari)
• Status unknown. No much news from Apple on this topic but they have added SHA256 from Yosemite release
• Microsoft (Internet Explorer)
• http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx 
• http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx 
• Mozilla (Firefox)
• https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/ 

Why I should migrate from SHA-1 to SHA-2 now?

All server certificates that expire on/after 1st January, 2017, and which contain SHA-1-based signatures in the validated chain, will be shown the insecure site notification icon in Google Chrome and similar warning notice in other major browsers, with text indicating that the site will cease working in future versions of the browser. This may affect the brand and reputation of the organization among the customers. (Effect on Google SERP is unclear at this point of time. But Google has given clear indication that HTTPS will be a ranking signal.)

Read more about SHA-1 and Future

• SHA-1
• https://en.wikipedia.org/wiki/SHA-1
• Comparison of Cryptographic Hash Algorithms
• https://en.wikipedia.org/wiki/Comparison_of_cryptographic_hash_functions

How to force redirect all HTTP requests to HTTPS in IIS through Web.Config setting?

Web.config configuration setting to force redirect all http requests to https with all query string parameters in IIS 7.5 / 8.0 on Windows Servers.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <clear />
                <rule name="Redirect to https" stopProcessing="true">
                    <match url="(.*)" />
                    <conditions>
                        <add input="{HTTPS}" pattern="off" ignoreCase="true" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}{REQUEST_URI}" redirectType="Permanent" appendQueryString="false" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

Notes:

1. The above solution will work well with all hosts including shared hosting servers
2. Ensure your https URL is functioning properly

JavaScript: console.log() - Best Practice

JavaScript developers, must be well aware of the console.log() function to log messages to the console window.

Today, I share my experience to write a wrapper function for console.log().

Simple Code 1: Ignore log message if the console object is missing


<script type="text/javascript" language="javascript">
    window.console = window.console || { log: function (d) {} };
    
    /* write your JavaScript code below this line */
    console.log("Message: Testing Console.log");

</script>


Simple Code 2: Modified to show log message as alert if the console object is missing and the global variable for debug is set to true. You can turn it off when you publish to production.


<script type="text/javascript" language="javascript">

    var debug = true;

    window.console = window.console || { log: function (d) 
        {if(debug){alert("Sorry! Logger not available on this 
            browser. \n\n" + d);} } };


    /* write your JavaScript code below this line */
    console.log("Message: Testing Console.log");

</script>


Simple Code 3: Same as above but with JQuery.


<script type="text/javascript" language="javascript">

    var debug = true;

    $(function(){
      window.console = window.console || { log: function (d) 
        {if(debug){alert("Sorry! Logger not available on this 
            browser. \n\n" + d);} } };
    });


    /* write your JavaScript code below this line */
    console.log("Message: Testing Console.log");

</script>

More Info:

This is a best practice to avoid errors with browsers that don't handle console.log missing object by default. For example, Internet Explorer don't handle the missing object and ignores all scripts following the error. Unfortunately, IE will not throw any error on this condition and eat your time debugging and tracing for the invisible error.

Note 1: console object is not a standard object in ECMA Script. However, it is one of the most widely used objects by developers for debugging JavaScript programs.

Note 2: In Internet Explorer 8 and Internet Explorer 9, console object is exposed only when Developer Tools (Shortcut - F12) are opened for the active tab.

Happy Coding!

Utilizing Public CDN for common scripts like JQuery

Are you in a dilemma to use public CDN or go with self-hosting for common scripts?

Take a quick and bold decision to go with public CDN. Using Public CDN is the best way to provide optimal experience to web users.

Some people think Google like enterprises don’t maintain servers as we do! Some time they are proven to be rite!!

Best practice to use Public CDN for common scripts

1. Always use minified version on production
2. First pull your script from the CDN
3. Check for the script availability
4. If script download fail, load script from your host

Example implementation:

Google CDN

<script
src=" http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js" >  < /script>

<script >  

!window.jQuery && document.write(' < script src="js/jquery-1.7.1.min.js" > < \/script > ')

</script>

Other Popular Public CDN

MICROSOFT

http://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.7.1.min.js

JQUERY

http://code.jquery.com/jquery-1.7.1.min.js

Do you want know why? Want to know what's under the hood? Never settle, go ahead and dig deeper, I am of your kind..

Why? What is the benefit of using a public CDN?

To understand this you need to know the basics of Internet and Browsers.

Let’s start with internet connection standards defined on HTTP 1.1 specification by W3C.

Browsers limit the number connections to the same domain irrespective of no. of tabs opened. Following are some findings from the internet for maximum number of connection limits.

Firefox 2.x       : 2
Firefox 3.x       : 6
IE 6/7               : 2
IE 8                  : 2 on dialup,
IE 8                  : 6 on broadband
Chrome            : 2
Safari               : 2
Opera 9.x         : 4

This is as per the HTTP 1.1 specification (which is currently live on 20^th March, 2012) in the RFC 2616 Section 8 (Connections) under 8.1.4 (Practical Considerations) in the last paragraph.

“Clients that use persistent connections SHOULD limit the number of simultaneous connections that they maintain to a given server. A single-user client SHOULD NOT maintain more than 2 connections with any server or proxy. A proxy SHOULD use up to 2*N connections to another server or proxy, where N is the number of simultaneously active users. These guidelines are intended to improve HTTP response times and avoid congestion.”

Link to RFC Document: http://www.w3.org/Protocols/rfc2616/rfc2616-sec8.html

So when you load a page, browsers make only specified no. of concurrent connections to the server to pull resources. So serving static content from different domain origin will save your domain quota on same domain origin. I’ll explain more on improving performance in a separate post.

The next big advantage of using public CDN is from the Browser behaviour / feature. Most browsers support strong cache mechanism to optimize network usage and improve user experience.

Caching is a mechanism to capture and store the recent or most commonly accessed static content in a small storage space. The storage space mentioned here is a browser cache in the client machine. It could probably be a temporary internet folder.

For example if an image or script file is downloaded from the internet it is preserved in a temporary internet folder with its origin for a span of time. The span could be determined by the headers. Defining headers go beyond the scope of this topic so we’ll discuss it in a different post. So when next time the same file is requested, it is available to the browser from the local machine cache instead of downloading from the server.

Assume, the user visited a site, say SiteA which use public CDN for JQuery script file. Now the user visits your site and we assume you use the same CDN for JQuery script file as the SiteA used. This time the JQuery will be available to the user from his local machine cache and it is instant. This makes your site work faster.

Let’s go back to Advantage of Internet. It is on CDN technology. CDN is an abbreviation for Content Delivery Network. You can treat this like a server backed by many number of servers from geographically diverse locations. When you seek a resource the server helps to serve it from the geographically closest server. For the any file copied to the host server will be replicated to servers inside the provider CDN all over the world. Basically if time of travel reduces speed of delivery increases.

10 Valuable Points for you Corporate Website

1. Post photos of real people
2. Provide physical contact address and phone number
3. Provide quick, flexible response to visitor queries
4. Make site useful to the visitors
5. Publish information that is easily verifiable
6. Update site on regular basis
7. Design site professionally and aesthetically
8. Provide handy access to contact link on top right corner
9. Promote products cautiously
10. Errors of all types must be avoided