<<< Date Index >>>     <<< Thread Index >>>

Banks (Wellsfargo.com) using CDNs to deliver Javascript: enables password theft by anyone compromising or controlling the CDN



In a recent chnage, wellsfargo.com started to include javascript delivered by 
akamai.net within sensitive pages, such as their login page.

Since any script loaded by the page has access to all the page data, that 
script could steal passwords very easily.  Loading the script via a CDN reduces 
the banks security to the level of security provided by the CDN.  I doubt that 
banking regulators would approve.

An attack on akamai or an insider there could access all wellsfargo.com bank 
accounts.

This is the equivalent of noticing that the bank's vault has another door and 
connects to the candy shop next door.   Sure the candy shop is owned by a nice 
guy who locks his door at the end of the day, but I don't expect my bank to 
rely on him for security.

This was reported to wellsfargo security on November 17.  They assure me that 
the padlock icon on the browser means everything is just fine.