your bank’s digital side door - def con con 26/def con 26 presentations/def… ·...
TRANSCRIPT
![Page 1: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/1.jpg)
1
Your Bank’s Digital Side Door@sdanndev
![Page 2: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/2.jpg)
2
“Because that’s where the money is.”Willie Sutton, Bank Robber
![Page 3: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/3.jpg)
3
Why does my bank website require my 2-factor token, but
pulling my transactions into Quicken does not?
![Page 4: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/4.jpg)
4
Personal Financial ManagementPFM
![Page 5: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/5.jpg)
5
Personal Financial Management (PFM)
![Page 6: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/6.jpg)
![Page 7: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/7.jpg)
7
![Page 8: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/8.jpg)
8
![Page 9: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/9.jpg)
9
![Page 10: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/10.jpg)
10
![Page 11: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/11.jpg)
11
![Page 12: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/12.jpg)
12
![Page 13: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/13.jpg)
13
Quicken/Quickbooks Connection Types
Web Connect
• Unidirectional• Manual• Download a file• OFX file format
Express Web Connect
• Unidirectional• Programmatic• Screen scrape• Private web
service
Direct Connect
• Bidirectional• Programmatic• Structured query• OFX protocol
![Page 14: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/14.jpg)
14
Web Connect
ExpressWeb Connect
Direct Connect
Desktop Application Middle-Man Financial Institution
OFX
OFX
OFX
![Page 15: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/15.jpg)
15
Account Aggregation Service / API
![Page 16: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/16.jpg)
16
Web Application Middle-Man Financial Institution
OFX
OFX
CSV
![Page 17: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/17.jpg)
18
Lack of Least Privilege
• Users have 1 set of bank credentials• Full read / write access to all accounts at financial institution
• Plain text password is shared with and stored by aggregators
• Tokenized application-based access control (OAuth) is needed
![Page 18: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/18.jpg)
19
Open Financial Exchange (OFX)aka Direct Connect
![Page 19: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/19.jpg)
20
www.ofx.org
![Page 20: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/20.jpg)
21
Banking
• Checking• Savings• CDs• Loans
Investment
• IRA• 401k• Holdings• Equity
Prices
Credit Cards
• Transactions
Transfers
• Bill Pay• Intrabank• Interbank• Wire Funds
OFX Functionality - Financial
![Page 21: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/21.jpg)
22
OFX Functionality - Miscellaneous
• Enrollment• Setup online access• Password Reset
• FI Profile• Like a homepage
• Email• Messages and Notifications
• Synchronization• Ensure multiple clients receive
1-time messages
• Image download• JPEG, TIFF, PNG, PDF
• Bill Presentment• For 3rd parties
![Page 22: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/22.jpg)
POST /cgi/ofx HTTP/1.1Accept: */* Content-Type: application/x-ofxDate: Fri, 16 Jun 2018 21:12:27 GMTUser-Agent: InetClntApp/3.0Content-Length: 570Connection: close
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRQV1>
<SONRQ><DTCLIENT>20060321083010<USERID>12345<USERPASS>MyPassword<LANGUAGE>ENG<FI>
<ORG>ABC<FID>000111222
</FI><APPID>MyApp
</SONRQ></SIGNONMSGSRQV1>... <!--Other message sets-->
</OFX>
HTTP/1.1 200 OKDate: Fri, 16 Jun 2018 21:12:30 GMTContent-Type: application/x-ofxConnection: Keep-AliveContent-Length: 2399
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRSV1>
<SONRS><STATUS>
<CODE>0<SEVERITY>INFO<MESSAGE>Success
</STATUS><DTSERVER>20060321083445<LANGUAGE>ENG<FI>
<ORG>ABC<FID>000111222
</FI></SONRS>
</SIGNONMSGSRSV1>... <!--All other transaction responses-->
</OFX>
Request Response
![Page 23: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/23.jpg)
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRQV1>
<SONRQ><DTCLIENT>20060321083010<USERID>12345<USERPASS>MyPassword<LANGUAGE>ENG<FI>
<ORG>ABC<FID>000111222
</FI><APPID>MyApp
</SONRQ></SIGNONMSGSRQV1>... <!--Other message sets-->
</OFX>
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRSV1>
<SONRS><STATUS>
<CODE>0<SEVERITY>INFO<MESSAGE>Success
</STATUS><DTSERVER>20060321083445<LANGUAGE>ENG<FI>
<ORG>ABC<FID>000111222
</FI></SONRS>
</SIGNONMSGSRSV1>... <!--All other transaction responses-->
</OFX>
Request Response
![Page 24: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/24.jpg)
25
OFX
![Page 25: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/25.jpg)
26
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRQV1>
... <!--Anonymous sign on--></SIGNONMSGSRQV1><PROFMSGSRQV1>
<PROFTRNRQ><TRNUID>5A59A330-7CEC-1000-A761 <PROFRQ>
<CLIENTROUTING>MSGSET<DTPROFUP>19900101
</PROFRQ></PROFTRNRQ>
</PROFMSGSRQV1></OFX>
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX>... <!--Anonymous sign on success--><BANKMSGSET>
<BANKMSGSETV1><MSGSETCORE>
<URL>https://o.bank.org/ofx.asp<LANGUAGE>ENG<SPNAME>Corillian Corp
</MSGSETCORE><XFERPROF>
<PROCENDTM>235959[0:GMT]<CANSCHED>Y<CANRECUR>N<CANMODXFERS>N
</XFERPROF></BANKMSGSETV1>
</BANKMSGSET></OFX>
Request Response
![Page 26: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/26.jpg)
27
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX><SIGNONMSGSRQV1>
... <!--Anonymous sign on--></SIGNONMSGSRQV1><PROFMSGSRQV1>
<PROFTRNRQ><TRNUID>5A59A330-7CEC-1000-A761 <PROFRQ>
<CLIENTROUTING>MSGSET<DTPROFUP>19900101
</PROFRQ></PROFTRNRQ>
</PROFMSGSRQV1></OFX>
OFXHEADER:100DATA:OFXSGMLVERSION:103SECURITY:NONEENCODING:USASCII
<OFX>... <!--Anonymous sign on success--><PROFMSGSRSV1>
<PROFTRNRS><PROFRS>
<FINAME>Bank<ADDR1>123 Muholland Drive<CITY>Las Vegas<STATE>NV<POSTALCODE>89109<COUNTRY>USA<CSPHONE>206-439-5700<URL>http://www.bank.org<EMAIL>[email protected]
</PROFRS></PROFTRNRS>
</PROFMSGSRSV1></OFX>
Request Response
![Page 27: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/27.jpg)
28
OFX Protocol Specification
![Page 28: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/28.jpg)
31
Multi-Factor Authentication (MFA)
Know
• Password• PIN• Security
Question
Have
• Token• Hardware• Software
• PKI Certificate• Smart Card
Are
• Biometric• Behavior
![Page 29: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/29.jpg)
32
2-Step Authentication
• Password + out-of-band mechanism• 6 digit string
• SMS• Push notification• Software token
![Page 30: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/30.jpg)
33
OFX “MFA”
Security Question• <USERCRED1>
• Free form field required by server
• Server defines label• Ex: “Mother’s maiden
name”
• <MFACHALLENGE>• Security questions• Hard coded list• Ex: “Favorite color”
![Page 31: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/31.jpg)
![Page 32: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/32.jpg)
35
OFX “MFA”
Static String• <CLIENTUID>
• Client generated ID• Checked by Server
• TOFU• Static
• <AUTHTOKEN>• Server generated• Provided to client out-of-
band• Implied static• Could be used for 2-step
auth
![Page 33: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/33.jpg)
36
76%
20%
4% 0%Frequency of OFX Header: Version
102103202203
![Page 34: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/34.jpg)
37
Financial InstitutionsFIs
![Page 35: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/35.jpg)
38
The Big Names
![Page 36: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/36.jpg)
39
The Smaller Names
![Page 37: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/37.jpg)
![Page 38: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/38.jpg)
41
There Are A Lot of Banks!
7,000 OFX FIs
2,000 Public
OFX FIs
400Public
Servers
15,000 FIs
7,000Commercial
Banks
(USA & Canada)
![Page 39: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/39.jpg)
42
Investigation
![Page 40: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/40.jpg)
43
OFX Survey
• What FI’s are running an OFX server?• Find them and talk to them
• What software is providing this service?• Ask them simple questions
![Page 41: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/41.jpg)
44
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• Typical URL• https://ofx.bank.com/ofx/ofxsrvr.dll
• User Community• ofxhome.org• wiki.gnucash.org
• Commercial Clients• Branding Services
• DNS for FIs• Name to OFX URL translation
![Page 42: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/42.jpg)
45
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• DNS• Stale A records?
• TLS• Is server certificate expired?
![Page 43: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/43.jpg)
46
Stale DNS
![Page 44: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/44.jpg)
47
Stale TLS
![Page 45: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/45.jpg)
48
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• HTTP GET /• HTTP GET /path/ofx• HTTP POST /path/ofx
• Fingerprint• Web server• Web application framework• OFX server
![Page 46: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/46.jpg)
49
HTTP GET /
![Page 47: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/47.jpg)
51
HTTP GET/path/ofx
![Page 48: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/48.jpg)
52
HTTP GET/path/ofx
![Page 49: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/49.jpg)
53
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• HTTP POST /path/ofx• <OFX></OFX>
• Fingerprint• Framework errors• OFX errors
![Page 50: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/50.jpg)
54
OFXHEADER:100DATA:OFXSGMLVERSION:102SECURITY:NONEENCODING:USASCII
<OFX></OFX>
Request ResponseError 500: java.lang.NullPointerException
HTTP POST /path/ofx
![Page 51: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/51.jpg)
55
OFXHEADER:100DATA:OFXSGMLVERSION:102SECURITY:NONEENCODING:USASCII
<OFX></OFX>
Request ResponseOFXHEADER<OFX><SIGNONMSGSRSV1><SONRS><STATUS><CODE>2000<SEVERITY>ERROR<MESSAGE>FID not found in file SQL State 02000
</STATUS><DTSERVER>20180324234025<LANGUAGE><FI><ORG>
</FI></SONRS>
</SIGNONMSGSRSV1></OFX>
HTTP POST /path/ofx
![Page 52: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/52.jpg)
56
OFXHEADER:100DATA:OFXSGMLVERSION:102SECURITY:NONEENCODING:USASCII
<OFX></OFX>
Request Response<b>Stack Trace:</b> <br><br>
<table width=100% bgcolor="#ffffcc"><tr><td><code><pre>
[ArgumentOutOfRangeException: Length cannot be less than zero.Parameter name: length]
System.String.Substring(Int32 startIndex, Int32 length) +12518387OFX.OFX.ProcessRequest(HttpContext context) in
C:\Environment\directconnect\OFX\OFX\OFX.ashx.cs:43System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() +188
System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) +69
</pre></code></td></tr>
</table>
HTTP POST /path/ofx
![Page 53: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/53.jpg)
57
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• POST /path/ofx• <PROFRQ>
• Fingerprint• Spacing• In-house vs service provider
• Info Disclosure• More verbose errors• Long lived sessions• Password policy
![Page 54: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/54.jpg)
OFXHEADER:100DATA:OFXSGMLVERSION:103
<OFX><SIGNONMSGSRQV1><SONRQ><DTCLIENT>20180319054443.123[-7:MST]<USERID>anonymous00000000000000000000000<USERPASS>anonymous00000000000000000000000
</SONRQ></SIGNONMSGSRQV1><PROFMSGSRQV1><PROFTRNRQ><PROFRQ><DTPROFUP>19900101
</PROFRQ></PROFTRNRQ>
</PROFMSGSRQV1></OFX>
Request ResponseOFXHEADER:100DATA:OFXSGMLVERSION:103
<OFX><SIGNONMSGSRSV1><SONRS><STATUS><CODE>0<SEVERITY>INFO<MESSAGE>SUCCESS
</STATUS><DTSERVER>20180319014447.551[-4:EDT]<TSKEYEXPIRE>20190319120000.000[-4:EDT]<DTPROFUP>20081116120000.000[-5:EST]
</SONRS></SIGNONMSGSRSV1><PROFMSGSRSV1>...
</PROFMSGSRSV1></OFX>
HTTP POST /path/ofx <PROFRQ>
![Page 55: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/55.jpg)
OFXHEADER:100DATA:OFXSGMLVERSION:103
<OFX><SIGNONMSGSRQV1><SONRQ><DTCLIENT>20180319054443.123[-7:MST]<USERID>anonymous00000000000000000000000<USERPASS>anonymous00000000000000000000000
</SONRQ></SIGNONMSGSRQV1><PROFMSGSRQV1><PROFTRNRQ><PROFRQ><DTPROFUP>19900101
</PROFRQ></PROFTRNRQ>
</PROFMSGSRQV1></OFX>
Request ResponseOFXHEADER:100DATA:OFXSGMLVERSION:103
<OFX>...<PROFMSGSRQV1><PROFRQ><SIGNONINFOLIST><SIGNONINFO><MIN>4<MAX>4<CHARTYPE>ALPHAORNUMERIC<CASESEN>N<SPECIAL>N<SPACES>N
</SIGNONINFO></SIGNONINFOLIST>
</PROFRQ></PROFMSGSRQV1>></OFX>
HTTP POST /path/ofx <PROFRQ>
![Page 56: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/56.jpg)
61
Recon
ENUM HOSTSTLS PINGWEB SERVEROFX SERVEROFX PROFILEOFX ACCOUNT
• POST /path/ofx• <ACCTINFORQ>
• Fingerprint• Error message
![Page 57: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/57.jpg)
62
OFXHEADER:100DATA:OFXSGMLVERSION:103
<OFX><SIGNONMSGSRQV1><SONRQ><USERID>anonymous00000000000000000000000<USERPASS>anonymous00000000000000000000000
</SONRQ></SIGNONMSGSRQV1><SIGNUPMSGSRQV1><ACCTINFOTRNRQ><ACCTINFORQ><DTACCTUP>19900101
</ACCTINFORQ></ACCTINFOTRNRQ>
</SIGNUPMSGSRQV1></OFX>
Request
HTTP POST /path/ofx <ACCTINFORQ>
![Page 58: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/58.jpg)
63
Response(s)
HTTP POST /path/ofx <ACCTINFORQ>
<MESSAGE>SUCCESS
<MESSAGE>Signon invalid
<MESSAGE>Unsupported operation for anonymous user
<MESSAGE>Please contact your financial institution to enroll.
<MESSAGE>General error (ERROR) The server encountered an error.
<MESSAGE>Could not process request
<MESSAGE>General Error
<MESSAGE><FI> Missing or Invalid in <SONRQ>
<MESSAGE>Unable to retrieve FI configuration.
<MESSAGE>There was a problem verifying the UserId/Password
<MESSAGE>User id password combination incorrect
<MESSAGE>Account information request could not be completed at this time. Please contact your financial institution for assistance.
<MESSAGE>Invalid FID sent in Request
<MESSAGE>No Accounts Returned
<MESSAGE>Account Not Found
<MESSAGE>Invalid session
<MESSAGE>UserID/PIN is incorrect.
<MESSAGE>Client up to date
<MESSAGE>Signon VALUES (for example, USER ID or Password) invalid.
![Page 59: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/59.jpg)
64
Financial Software Vendors
![Page 60: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/60.jpg)
https://www.sibanking.com/improved-core-banking-software/
![Page 61: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/61.jpg)
66
Where Do I Buy?
• No shrink wrapped boxes• No ‘apt install’• No app store• No open source
![Page 62: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/62.jpg)
![Page 63: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/63.jpg)
68
Software Vendors
![Page 64: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/64.jpg)
69
![Page 65: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/65.jpg)
71
OFX Hosting
ofx.netteller.com
ofxdi.diginsite.comofxdc.prd1.ncr.com
pfm.metavante.com
ofx.lanxtra.com
![Page 66: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/66.jpg)
72
020406080
100120140160180
Frequency of HTTP Servers
![Page 67: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/67.jpg)
73
Acquisition and Atrophy
https://www.fisglobal.com/about-us/about-our-company
![Page 68: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/68.jpg)
74
Vulnerabilities
![Page 69: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/69.jpg)
75
650 Page OFX specification
34 Implementations
x 10 Technology Stacks
221,000 Vulnerabilities
![Page 70: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/70.jpg)
76
Found in Production
• Web server disclosure• Web framework disclosure• OFX server version disclosure• Backend DB disclosure• Full stack trace on errors• Full server file paths in errors• Out-of-date software• Unhandled exceptions• Long lived session keys
• MFA ignored• SSN used as usernames• Internal IP disclosure• Valid user enumeration• Personal email disclosure• Unmaintained servers• Null values returned• Unregistered URL referenced• Reflected XSS
• I know it’s not a web page, and yet…
![Page 71: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/71.jpg)
77
Demo
![Page 72: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/72.jpg)
78
ofxpostern
• Fingerprint OFX Server• Show capabilities• Scan for vulnerabilities
https://github.com/sdann/ofxpostern
![Page 73: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/73.jpg)
79
![Page 74: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/74.jpg)
80
![Page 75: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/75.jpg)
81
![Page 76: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/76.jpg)
82
Conclusions
![Page 77: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/77.jpg)
https://media-cdn.tripadvisor.com/media/photo-s/01/13/d9/9b/side-door.jpg
![Page 78: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/78.jpg)
84
Neglect
![Page 79: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/79.jpg)
85
Planning for Retirement
• Inventory your assets• How much money public facing services do you have?
• Pick an age to retire• How old do you want your TLS certs to be?• When will you your software stop working?
• Do quarterly check-ins• Are you saving enough? Is your software up to date?
• Protect your assets• With insurance MFA
• Invest• The earlier the better, but it is never too late to start!
![Page 81: Your Bank’s Digital Side Door - DEF CON CON 26/DEF CON 26 presentations/DEF… · Quicken/Quickbooks Connection Types Web Connect •Unidirectional •Manual •Download a file](https://reader034.vdocuments.site/reader034/viewer/2022052019/6032cfadc779744732123b97/html5/thumbnails/81.jpg)
87
Glossary
• FI - Financial Institution• A bank, brokerage, or credit card provider.
• PFM - Personal Financial Management• Client software for viewing and managing their financial accounts