Study: MasterCard, others unwittingly help 'phishers'

Many financial sites have loosely protected features that scam artists can exploit, report says

Greenhalgh's Web site notes similar flaws in seven other sites, including attacks on search features at reuters.com, Internet payment service WorldPay Ltd. and NatWest, part of The Royal Bank of Scotland PLC.

"In effect what I am doing is using something that is designed to trust user input too much," he said.

Among other things, developers should design Web forms like ATM locators and search engines to validate the data that users enter into the fields and "sanitize" it, removing characters such as brackets (< and >) that are used to render HTML and other computer code.

The flaws are easy to fix, but have been overlooked for years. Still, Greenhalgh doesn't believe that the cross-site scripting holes have been exploited in phishing attacks at the institutions he named, at least not yet.

The cross-site scripting vulnerability is an old exploit that has been around for a long time, but hasn't yet been exploited by scam artists, said Dave Kurzynski, chief technology officer of Internet brand protection firm NameProtect Inc.

Still, the vulnerability could become more common as "low hanging fruit" and easier avenues to trick consumers are closed to scammers, he said.

The cross-site scripting problems at leading financial services sites couldn't be used to distribute malicious code, unlike a recent flaw in Microsoft's Internet Information Services Web server. However, they could be used to fool Web surfers into downloading malicious code, such as ActiveX programs created by scam artists or hackers, he said.

Shoddy coding by Web developers is mostly responsible, but the companies are also to blame, he said.

"I think it's a matter of the attitude that both developers and their employers have to their product and the quality of service that they are giving to customers. Quality of service not just a factor of what the customer perceives. It's a whole package."

Companies from across industries should be looking at their Web sites and Web-based applications carefully with cross-site scripting vulnerabilties in mind, Kurzynski said.

"Any Web site that accepts text input and displays it is possibly vulnerable. Any newly written application should be designed with this in mind and legacy applications in use since this exploit was discovered need to be changed to protect against it," he said.

Greenhalgh did not notify companies mentioned in the report about the problems. Doing so would only allow them to correct the problem without addressing the larger security issues facing their sites, he said.

"It's fixing the symptom and not the problem," Greenhalgh said.

The number of phishing attacks has risen sharply in recent months, according to industry groups.

The number of unique phishing attacks reported to the Anti-Phishing Working Group (APWG) increased 6 percent in May to 1,197, with an average of 38.6 reports each day. Financial services companies are the primary target of the scams, according to the APWG.