Security issue in Mashreq Bank Official Website

DISCLAIMER: IT’S MY PERSONAL VIEW POINT. THIS ARTICLE IS NOT INTEND FOR DECISION MAKING. PLEASE CONSULT YOUR SECURITY ADVISOR OR CONTACT ME IN PERSON FOR DETAILS.

Mashreq Bank official website may look perfect when entered URL http://www.mashreqbank.com or googled for “Mashreq Bank”.

What’s the problem with Mashreq Bank Official Website?

But is the Mashreq Bank website secure? Not really! 

Security is an essential factor for bank websites. Banks and most sensitive information websites are highly recommended to use a secure layer called TLS (SSL was officially deprecated – read more) to transfer information. Such HTTPS communication will prevent eavesdropping, man-in-the-middle attacks that may lead to Phishing attacks to steal customer internet banking username and password information.

HTTPS (Secured Hyper Text Transfer Protocol) provides the maximum protection from the most notorious hacker attacks for banking websites like phishing and sniffing.

What happens when you try https://www.mashreqbank.com?

Invalid Certificate Notice

I am curious, so what happens when you hit Continue to this website (which was not recommended!)?

Note: Typing the full URL of the website (when known) with https is the safest way to access websites.

What is the Problem (Technically)?

The Mashreq Bank official website (www.mashreqbank.com) SSL Certificate is mapped to a wrong certificate that was issued to the Mashreq Bank’s Career portal (careers.mashreqbank.com).

Note: Unfortunately, the career portal is also down.

CERTIFICATE PATH

Besides, the certificate signature has algorithm is a very weak SHA-1 algorithm which needs to be updated to SHA256 as soon as possible. Read more about SHA-1 Sunset.

Is my Mashreq Online Banking unsafe? 

No, not really! The Net Banking is still safe and well secured. The potential risk is only when you are redirected from Official Website to Net Banking site and other potential attacks such as Phishing and zero-day attacks. 

Besides, Mashreq Bank is a reputed financial institution. You may expect for the best support from the bank during such unfortunate situations.

How am I affected?

Mashreq Bank official website has potential security risk. But the Online Banking portal https://netbanking.mashreq.com is safe and configured with good security systems.

• Though you cannot do much on the server side, you can protect yourself by not accessing your bank website on public wifi in cafes, public transportation, etc., and securing your home/office wifi networks. 

Mashreq Online Banking Portal - Certificates

Read about Security Attacks

• Phishing Attack
• https://en.wikipedia.org/wiki/Phishing
• Spoofing Attack
• https://en.wikipedia.org/wiki/Spoofing_attack 
• HTTPS
• https://en.wikipedia.org/wiki/HTTPS

HTTPS protects the integrity of your website

By Google:

HTTPS helps prevent intruders from tampering with the communications between your websites and your users’ browsers. Intruders include intentionally malicious attackers, and legitimate but intrusive companies, such as ISPs or hotels that inject ads into pages.

Intruders exploit unprotected communications to trick your users into giving up sensitive information or installing malware, or to insert their own advertisements into your resources. For example, some third-parties inject advertisements into websites that potentially break user experiences and create security vulnerabilities.

Intruders exploit every unprotected resource that travels between your websites and your users. Images, cookies, scripts, HTML… they’re all exploitable. Intrusions can occur at any point in the network, including a user’s machine, a Wi-Fi hotspot, or a compromised ISP, just to name a few.

--

Hope Mashreq will take action very soon.
Cheers!

Arun Ramachandran

Please reach me or leave your comments in the comment section. I'll get back to you as soon as possible.

Mashreq Bank eStatement does not download with Download Accelerator

If you're a Mashreq Bank customer, you must already be enjoying a fabulous basket of online banking services. But if you face issue with downloading e-statement from the Mashreq Internet Banking website and you are using Internet Exporer (tested on IE version 10 and above), it is most likely due to Internet Download Accelerators (eg: Download Accelerator Plus / DAP, Internet Download Manager, etc). Turn off / Disable the download acceleration to download e-statement from Mashreq Internet Banking website.

Download Bar - Screen Shot

@Mashreq: Please fix this issue for a better internet banking experience.

FAQs

Q: I am offered a JSP file to download. What is it?
A: The JSP file stands for Java Server Pages which is the software program that pulls your statement details from the Mashreq Servers and provides you in a human readable format, for example in a PDF document.

Q: How to disable the Download Accelerator Plus?
A: Check the system tray for the DAP icon (Yellow thunder icon). Just right-click and select Disable DAP.

Who could innovate better?

Today, I came across an activity "Search for Social Advocate" inside the organization.

When organizations around the world hunting for social media specialist and writers on job boards and social networks, I am amazed with this idea of searching the advocates inside the organization.

"Social Advocates" - Interesting term!

It is better to that somebody who understand, live and experience the organization, writes about it on the social platforms. It is a Great thought, Isn't it?

I believe it brings in better productivity and usefulness of the content shared.

I am not aware of the internals or plans for the "Social Advocates". But I believe there should be a  team of Social Advocates, who could the organization co-ordinate and form a team (Virtual?). Train them with products, policies and basic writing strategies with marketing touch. I believe, the organization by their values and policies, will never intervene on the creativity of the individuals.

The team could be formed with experts, interested people from every group and product team to share thought and happenings in the markets/industry, technology and strategies.

We could always depend on the professional marketing team for promotions through advertisements and campaign activities. But for content, definitely this is the right way. Millions can't be wrong. Content is the KING, always.

Honestly, I un-follow people and pages that kills my interest with repeats and spams.There would be no chance for such scenario here, I believe.

Organization?? Who else? It is EMC - The Strong and Innovative Storage Giant of All Times.

Good Laser Multi-Function All-In-One Network/Wireless Printers To Buy in India

Couple of days before, a friend asked me suggestion for good multi-function (All-In-One) Laser printer with Wireless feature. I did some study and filtered the below printers. Hope it would be helpful for others too.

Note: Prices updated on 13-June-2013

1. HP LaserJet Pro M1136 Multifunction Printer
   Print - Scan - Copy / B&W Laser
   Product Page: http://h10010.www1.hp.com/wwpc/in/en/ho/WF06b/18972-18972-3328064-3328082-3328082-5094778-4075453.html?dnr=1
   [Market Price: INR 10600/- Approximately]
   
2. HP LaserJet Pro M1213NF Multifunction Printer
   Print - Scan - Copy - Fax / B&W Laser
   Product Page: http://www8.hp.com/in/en/products/printers/product-detail.html?oid=4075460
   [Market Price: INR 15500/- Approximately]
   
   
3. HP Laserjet M1522N Multifunction Printer
   Print - Scan - Copy / B&W Laser
   Product Page: http://h10010.www1.hp.com/wwpc/us/en/sm/WF06b/18972-18972-3328064-12004-3328083-3442750-3442751-3442753.html?dnr=1
   
   
4. Canon imageCLASS MF4350D Multifunction Printer
   Print - Scan - Copy - Fax / B&W Laser
   Product Page: http://www.usa.canon.com/cusa/support/consumer/printers_multifunction/imageclass_series/imageclass_mf4350d
   [Market Price: INR 16250/- Approximately]
   
   
5. Samsung SCX 3206W Multifunction Laser Wireless Printer
   Print - Scan - Copy / B&W Laser
   Product Page: http://www.samsung.com/in/consumer/pc-peripherals-printer/laser-printer-multifunction/mono-laser-mfp/SCX-3206W/XIP
   [Market Price: INR 11000/- Approximately]
   

Personal, Small & Home Office, Non-profits and Education Institutions contact me for margin free price and further consulting.

Google to introduce Semantic Search with AI touch

AI is not new at Google but this is a major roll out of search mechanism and result presentation. Many sites may pushed down where Google to display content or in other words answers to user searched queries.

For instance, query "what is the time in Chennai now" will display the actual time followed by list of websites related to the keywords (time, Chennai, etc). But not just this AI but Semantics where it relates every important word to each other to identify relations and present results more meaningfully like a human.

Google revised its search logics with AI (Semantic Search)

Possibly, Google want to increase time-on-site and compete with its next level competitors like Facebook and Twitter which claims more time-on-site.

Prior search results were delivered based on keyword as primary aspect with many other aspects. Now, Semantics will be the primary aspect and others will continue to contribute.

But list of search results vary because of the major change in the primary aspect. Now uncivilized! (non-standardized) HTML codes should be re-coded to adhere semantic structure to get listed on Google Search Result Pages (SERP). HTML5 comes with out-of-the-box solution for Semantic document.

Few of the AI algorithms are rolled out already the above screen shot is an example of the same. However the full roll-out is expected to be a major revision in the search engine and Amit Singhal of Google said it is estimated as a year-long process.

Read more about Semantic Web:
http://www.w3.org/standards/semanticweb/
http://semanticweb.org/wiki/Main_Page
http://www.lrmi.net/

IRCTC Website could do some improvements

IRCTC (www.irctc.co.in) is one of the busiest websites in India. It is ticket booking portal of one of the most popular and worlds largest Railways, The Indian Railways.

Besides all the popularity and red ribbons it has some glitches. I am sharing a few that I found.

To increase loading speed & delivery performance:

1. IRCTC should consider having a light weight alternative page during peak hours like between 8:00 AM to 8:30 AM
2. IRCTC should consider having CDN or Cloud to provide more optimized delivery

To increase user experience:

1. In the login screen, after loading the page and before setting focus to the username field, the username field has to be checked for any content has been typed. If some content typed no focus should be set or focus should be set to password field. This will avoid accidently revealing passwords.