Feeds

Shifty scripts on Santander site prompt security fears

Alliance & Leicester bothered by unknown Javascript

Security for virtualized datacentres

Updated Parent firm Santander is reassuring customers that the website of its banking subsidiary Alliance & Leicester is secure despite the presence of JavaScript on its login pages served up from recently created sites of unknown provenance.

Reg reader Matt Freeman said he was prompted with a SSL certificate warning from a domain called 'www.polycache.com' when attempting to log in to Alliance & Leicester's online banking Internet using FireFox 4.

Alarmed by the incident, Matt did some digging and discovered that the warning stemmed from a script from advanced-web-analytics.com that, in turn, downloads another script from polycache.com.

Polycache.com was only registered a few weeks ago and is hosted by virtual server hosting firm lineode.com, a legitimate firm but not one normally associated with hosting e-commerce systems for high street banks. Domain registration details for polycache are hidden. In addition, polycache.com doesn't have a home page.

All this looks rather suspicious if not necessarily malicious. Rik Ferguson, a security consultant at Trend Micro said: "This doesn't look like the infrastructure for a bank."

Ferguson said the set-up more closely resembles the prelude to a possible attack. He said nothing has been stolen as of Tuesday afternoon but the set-up "looks suspicious and it would take only one additional script to do something bad".

Freeman and others have begun debating the issue on Linode.com forums and elsewhere. Freeman has posted a detailed explanation of his worries here. Other Reg readers have separately been in touch with their concerns.

Santander blamed the glitch on a "technical failure" at an unnamed third party online banking partner, which has since been resolved. It stressed that customer data was never at risk, saying that worries to the contrary were "unfounded".

Santander's internet banking systems utilise a number of third parties and one of these appears to have had a technical failure. This has been investigated fully and rectified.

Santander can confirm that neither its website nor the A&L website have been hacked. Customer data has not been compromised.

We asked Santander for a clearer explanation of what the "technical failure" might be. A spokeswoman told us that since this covered a fraud and security issue they were not going to say what it is, but she was able to repeat the assurance that customer data was safe.

Which is nice. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
NASTY SSL 3.0 vuln to be revealed soon – sources (Update: It's POODLE)
So nasty no one's even whispering until patch is out
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
FBI boss: We don't want a backdoor, we want the front door to phones
Claims it's what the Founding Fathers would have wanted – catching killers and pedos
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Win a year’s supply of chocolate
There is no techie angle to this competition so we're not going to pretend there is, but everyone loves chocolate so who cares.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.