Security issue in Mashreq Bank Official Website

DISCLAIMER: IT’S MY PERSONAL VIEW POINT. THIS ARTICLE IS NOT INTEND FOR DECISION MAKING. PLEASE CONSULT YOUR SECURITY ADVISOR OR CONTACT ME IN PERSON FOR DETAILS.

Mashreq Bank official website may look perfect when entered URL http://www.mashreqbank.com or googled for “Mashreq Bank”.

What’s the problem with Mashreq Bank Official Website?

But is the Mashreq Bank website secure? Not really! 

Security is an essential factor for bank websites. Banks and most sensitive information websites are highly recommended to use a secure layer called TLS (SSL was officially deprecated – read more) to transfer information. Such HTTPS communication will prevent eavesdropping, man-in-the-middle attacks that may lead to Phishing attacks to steal customer internet banking username and password information.

HTTPS (Secured Hyper Text Transfer Protocol) provides the maximum protection from the most notorious hacker attacks for banking websites like phishing and sniffing.

What happens when you try https://www.mashreqbank.com?

Invalid Certificate Notice

I am curious, so what happens when you hit Continue to this website (which was not recommended!)?

Note: Typing the full URL of the website (when known) with https is the safest way to access websites.

What is the Problem (Technically)?

The Mashreq Bank official website (www.mashreqbank.com) SSL Certificate is mapped to a wrong certificate that was issued to the Mashreq Bank’s Career portal (careers.mashreqbank.com).

Note: Unfortunately, the career portal is also down.

CERTIFICATE PATH

Besides, the certificate signature has algorithm is a very weak SHA-1 algorithm which needs to be updated to SHA256 as soon as possible. Read more about SHA-1 Sunset.

Is my Mashreq Online Banking unsafe? 

No, not really! The Net Banking is still safe and well secured. The potential risk is only when you are redirected from Official Website to Net Banking site and other potential attacks such as Phishing and zero-day attacks. 

Besides, Mashreq Bank is a reputed financial institution. You may expect for the best support from the bank during such unfortunate situations.

How am I affected?

Mashreq Bank official website has potential security risk. But the Online Banking portal https://netbanking.mashreq.com is safe and configured with good security systems.

• Though you cannot do much on the server side, you can protect yourself by not accessing your bank website on public wifi in cafes, public transportation, etc., and securing your home/office wifi networks. 

Mashreq Online Banking Portal - Certificates

Read about Security Attacks

• Phishing Attack
• https://en.wikipedia.org/wiki/Phishing
• Spoofing Attack
• https://en.wikipedia.org/wiki/Spoofing_attack 
• HTTPS
• https://en.wikipedia.org/wiki/HTTPS

HTTPS protects the integrity of your website

By Google:

HTTPS helps prevent intruders from tampering with the communications between your websites and your users’ browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages.

Intruders exploit unprotected communications to trick your users into giving up sensitive information or installing malware, or to insert their own advertisements into your resources. For example, some third-parties inject advertisements into websites that potentially break user experiences and create security vulnerabilities.

Intruders exploit every unprotected resource that travels between your websites and your users. Images, cookies, scripts, HTML… they’re all exploitable. Intrusions can occur at any point in the network, including a user’s machine, a Wi-Fi hotspot, or a compromised ISP, just to name a few.

--

Hope Mashreq will take action very soon.
Cheers!

Arun Ramachandran

Please reach me or leave your comments in the comment section. I'll get back to you as soon as possible.

SHA-1 Sunset by January, 2017

SHA-1 is a weaker cryptographic hash function and more than 12 years old now. (Time to retire!) All major web browsers have officially announced to SHA-1 Sunset from January, 2017.

• Google (Chrome)
• http://blog.chromium.org/2014/09/gradually-sunsetting-sha-1.html 
• https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/2-R4XziFc7A/YO0ZSrX_X4wJ
• Apple (Safari)
• Status unknown. No much news from Apple on this topic but they have added SHA256 from Yosemite release
• Microsoft (Internet Explorer)
• http://social.technet.microsoft.com/wiki/contents/articles/32288.windows-enforcement-of-authenticode-code-signing-and-timestamping.aspx 
• http://blogs.technet.com/b/pki/archive/2013/11/12/sha1-deprecation-policy.aspx 
• Mozilla (Firefox)
• https://blog.mozilla.org/security/2014/09/23/phasing-out-certificates-with-sha-1-based-signature-algorithms/ 

Why I should migrate from SHA-1 to SHA-2 now?

All server certificates that expire on/after 1st January, 2017, and which contain SHA-1-based signatures in the validated chain, will be shown the insecure site notification icon in Google Chrome and similar warning notice in other major browsers, with text indicating that the site will cease working in future versions of the browser. This may affect the brand and reputation of the organization among the customers. (Effect on Google SERP is unclear at this point of time. But Google has given clear indication that HTTPS will be a ranking signal.)

Read more about SHA-1 and Future

• SHA-1
• https://en.wikipedia.org/wiki/SHA-1
• Comparison of Cryptographic Hash Algorithms
• https://en.wikipedia.org/wiki/Comparison_of_cryptographic_hash_functions

Insert a Line of Text or Record to the Beginning of a Text File Using Windows Batch Script

I would like to share a Windows batch script that would add a line of text / record to the beginning of a text file.

Text File: example.txt
Text to be inserted: Hello World!

Script:
COPY example.txt temp.txt
ECHO Hello World!>example.txt
TYPE temp.txt >>example.txt
DEL temp.txt

Explanation:
1) Copy the example.txt content to a temporay file
COPY example.txt temp.txt

2) Overwrite the example.txt content with new text we need to add to the beginning
ECHO Hello World!>example.txt

3) Append  the content of temp.txt to example.txt
TYPE temp.txt >>example.txt

4) Delete the temp.txt file
DEL temp.txt

It worked well! Share your comments for queries, improvements and suggestions.

How to Host a Web Site on laptop!

This article is a step-by-step guide to host a website or a web application on your laptop with Windows 7 operating system. Sorry I didn't have time to write for other operating systems.

You may read the article from the beginning to end or if you directly want to kick-start implementing the web server jump to Steps directly.

OS: Windows 7

Introduction

In plain words, a website is a software that runs inside another software called web server. It is a two way communication system. We have web browser as client side software at our end to request web pages and a software called web server that runs at the server side to respond our requests. We know how to surf webpages with a web browser. In this article I have tried to explain how you can setup your own webserver in your laptop!

LAN and WAN

LAN is an acronym for Local Area Network and WAN is an acronym for Wide Area Network. To understand in simple way: LAN is a network you use inside your home, office, school, colleges etc. WAN is a very large network like the one your ISPs (Internet Service Provider) have to provide you internet connections.

Wireless LAN

Wireless LAN allows you to access your LAN without wires. It requires a wireless adapter in your laptop or any device from which you want to access the network (Most laptops come with built-in wireless adapters) Wireless LAN could be established with a simple wireless router. You can buy one for Rs.1000 ($20). Once you purchase one, you can call your ISP provider to setup it for you. If you need a guide for setting up wireless LAN post a request on the comment space. I'll try to write one if there are more requests.

Intranet and Internet

There are two types of common classifications in website. Intranet, which are used by people inside a company or any group. Internet, is all known public website which is accessible to all public audience. 

Intranet are mostly hosted inside the company to provide fast access to its employees and to ensure security from threats of public internet.

IP Address

IP address are numerical address to access any network device like computers, printers, etc. Though there are many technicalities, I'll keep it simple. 127.0.0.1 is a fixed IP address to access local computers  (It is called as local loop). In other words, you can type 127.0.0.1 in the web browser in your machine to access the web server hosted in your machine. It is scoped only to the local computer itself. This is useful for testing your website hosted inside your computer during development etc,.

The IP addresses ranging 10.0.0.0 - 10.255.255.255, 172.16.0.0 - 172.31.255.255 and 192.168.0.0 - 192.168.255.255 are local network IP addresses. That is, you could use it to access network resources inside your LAN. Assigning IP address to devices is out of scope of this article. If you need help, you can post your requests on the comment section.

Web Server

As a first step, you need to install a software (web server) to respond to web requests sent from other computers. You can understand the webserver in simple way: it is a software at your end that responds to requests made by software at other end. Here, Internet Information Services (IIS) is the server software and Web Browsers are the are client software on other computers.

Steps:

Following are the steps:

1. Install IIS as Web Server
2. Create a Website / Web Application or Download Sample
3. Host Website to the IIS Root Directory
4. Configure IP Address for Your Machine
5. Test the Website

1. Install IIS as Web Server

Note: You must be a member of the Administrators group (Windows Admin user) to install IIS. 

By default, IIS is not installed on Windows® 7. You can install IIS by clicking Windows Features in Advanced Options under Programs in Control Panel.

Click Start and then click Control Panel.



In Control Panel, click Programs and then click Turn Windows features on or off.

In the Windows Features dialog box, check Internet Information Services and then click OK.

2. Create a Website / Web Application or Download Sample

You may create your own website or download the sample from the following URL

http://www.risingperfection.com/demo/apps/fb/FileBox.zip

Download the sample web application - FileBox, from the below url.   FileBox is a single page simple web application written on ASP.NET C# to upload photos. You may write your own applications or static HTML web pages as well.

3. Host Website to the IIS Root Directory

Open the following folder location and delete all files and folders inside.
C:\inetpub\wwwroot\

Unzip all the files and folders in FileBox to the IIS root folder.
C:\inetpub\wwwroot\

4. Configure IP Address for Your Machine

Now you need to assign an IP address to your machine, if it doesn't exists already.

First, let's check whether you are connected to the LAN network. You may check that in various ways. But the simple way is to ping your switch or router IP address. Usually, but not necessarily, it would be 192.168.1.1. To ping and test open the start menu and type ping 192.168.1.1 -t (replace the ip with your switch or router ip). You must be able to get response as follow:

If you get any other response then something is wrong with your network. You need to fix that first!
Note: Numerical values of bytes, time, TTL will change for every computer and networks

If the network is working well, check whether you have an IP address assigned. In the command prompt, type ipconfig -all and press enter. You will see information about the network ip addresses configured to your machine as below.

IPv4 Address is your local machine IP address. If you don't see screen like this, IP is not configured for your machine. You need to configure it manually by following steps below.

Assign IP Address Manually

Step 1: Go to Start menu and search for View Network Connections
or navigate to Control Panel\Network and Internet\Network and Sharing Center

Step 2: Click on Local Area Connection or Wireless Network

Step 3: Click Properties

Step 4: Select Internet Protocol Version 4 (TCP/IPv4) and Click Properties

Step 5: Select User Configured and enter your desired local IP address within the LAN IP range and click Ok to save and close all open windows.

Example / Typical Configuration:

IP Address: 192.168.1.2
Subnet Mask: 255.255.255.0
Default Gateway: 192.168.1.1

Preferred DNS: 8.8.8.8
Secondary DNS: 8.8.4.4

5. Test the Website

Test on Local Machine

First, let us test the website from the local machine. Open your webbrowser and navigate to http://localhost/ or http://127.0.0.1/. You must be able to see the   FileBox homepage.

Test from a Remote Machine

You need another computer or a mobile phone or a tablet connected to the same LAN network to test our webpage. To test the page, open a web browser and navigate to http://<your machine ip address> (eg: http://192.168.1.2). You must be able to see the   FileBox homepage.

If it fails, you need to go through the steps 1 through 3 again or if you are not able to solve, post your problem in the comment section below to seek solution from me and peer readers.

Hint: If you buy a static IP from your ISP vendor and configure it you can access this website from internet. A static IP would typically cost you Rs.2000 ($40 approx) per year. Also note, this could be useful only for your personal use.


Hope this article would be useful to you. Please share your comments below.

How to install FTP on Windows Server 2008 R2

Step-by-Step Guide

1. On the Windows Start menu, click Administrative Tools, and then click Server Manager.
2. In the Server Manager Pane, in the Roles Summary section, click Web Server (IIS).
3. In the Web Server (IIS) section, click Add Role Services.
4. Under Role services, select FTP Publishing Service. This will install the FTP service and the FTP management console.
5. Click Next, and then click Install.
   
   Now you may go to IIS Manager and add FTP Publishing to your existing website or you may create a new FTP Site pointing its root folder to the website root.
   
   Note: If your IIS Manager is already open, close the window and open again to see FTP option in the IIS Manager.