Chat CIMB kena hack?
|
|
 Dec 17 2018, 02:31 PM
Return to original view | Post
#1
|
 
Junior Member
596 posts Joined: Dec 2010 
|
QUOTE(PleaseEnterYourName @ Dec 17 2018, 02:24 PM) cimb legacy system, only can handle 8 characters. So to create a front to able to use 20 characters this code was introduced. but i checked the code the logic says it will accept the password if its more than 8 characters and if the password is less than 8 characters it will take the first 8 chars, or am i wrong?But where seven found it?  |
|
|
|
|
|
Dec 17 2018, 02:38 PM
Return to original view | Post
#2
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(Duckies @ Dec 17 2018, 02:32 PM) There's the checking for special characters as well. yup i noe, then that means even the logic of the code is wrong? suppose if the legacy server side only accept max 8 characters then the client side is only suppose to accept 8 chars n below n substring the pass wif > 8 chars |
|
|
Dec 17 2018, 02:43 PM
Return to original view | Post
#3
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(Duckies @ Dec 17 2018, 02:40 PM) Refer to OldSchoolJoke. ahh ic, got it got it, before dis i thought their backend can only accept 8 chars MAX regardless of special chars n the logic doesnt make sense to meBecause they need to cater for old password format which is without special characters. Because they need to cater for new password with special characters. Thus this retarded logic. |
|
|
Dec 17 2018, 02:48 PM
Return to original view | Post
#4
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(Duckies @ Dec 17 2018, 02:44 PM) Example if your password is 123456789 without special characters, the stupid logic will take the first 8 characters and log you in. That is why any characters after the first 12345678 does not matter. yup, that means their backend got 2 types of verification, 1 for legacy 8 chars pass and the other for newer pass wif special chars, they should reject pass >8 chars n no special chars instead of substring Example if your password is 123456789!@, then the system still logs you in because it has special characters, so the length can be up to 20 as long as it has special characters.  |
|
|
Dec 17 2018, 03:15 PM
Return to original view | Post
#5
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(OldSchoolJoke @ Dec 17 2018, 03:06 PM) its not about conflict, it about the .substring(0, 8) part. that means if i want to attack the site, i only have to keep spamming 9 chars without special chars and the password will be accepted as a legacy 8 chars no special char password and its much easier to brute force 8 chars without special charsmeans if it doesn't satisfy the first condition, it will only take the first 8 characters of the password e.g: your password is 123456789 since it doesn't satisfy the first condition, it will take first 8 characters which is 12345678 logically, 123456789 is not the same as 12345678. even if you plainly compare it is not the same. so those who want to attack the site, just need to guess for 8 characters which lessen the time to guess a correct password what they should do (IMO) is just send the password to server as it is instead of plainly showing to the world the checking. the devs really damn bodo for putting the substring part, it isnt necessary at all |
|
|
Dec 17 2018, 03:45 PM
Return to original view | Post
#6
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(PeinEVO @ Dec 17 2018, 03:28 PM) I noob apa jadi if they use substring? that means the hackers can just aim for the 8 chars legacy password and still go through, because the code take the full password and substring it as 8 characters without special chars the hacker will keep spam > 8 chars without special chars, and it doesnt take very long to brute force alphanumeric 8 charsAnyway changed my password already |
|
|
|
|
|
Dec 17 2018, 08:02 PM
Return to original view | Post
#7
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(okuribito @ Dec 17 2018, 07:54 PM) I guess this code snippet was lifted off the net today? ie current code, right? this was wat i assumed when i read the code too, but i guess the checking for the password length <8 chars is already done before calling this function hence the password will always be more than 8 chars when reach this point and wont come out wif string < 8 chars errorHaven't read all posts here, but remember reading something about a recent change by CIMB to allow longer pw & with special characters? And because some incompetent coder wrote the above snippet, hence the exploit was created? Help me understand the logic... if PW is at least 8char long, and includes special chars, then the entire pw string is passed to encryption function if PW is at least 8char long, and dun include special chars, then the long pw is truncated & the front 8char string is passed to encryption function if PW is < 8char long eg 7char or less, irrespective got special characters or not, then what happens? Won't password = password.substring(0, 8) evaluate to #error? Previously, wasn't there a minimum # of characters for passwords ie 8? PS: i dunno coding. only trying to make sense of the if-then-else which is also used in excel  the logic of the code shows that it will take the first 8 chars and ignore the rests if the password contains no special characters, but it will take the whole password without truncation if it contains special characters This post has been edited by rooney723: Dec 17 2018, 08:02 PM |
|
|
Dec 17 2018, 08:08 PM
Return to original view | Post
#8
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(MiLKTea @ Dec 17 2018, 08:06 PM) Thought different system would have different vendors and bank has so many systems last time they migrate to new account format, accenture was their vendor for that, not sure if accenture is involved in their login module or not |
|
|
Dec 17 2018, 08:51 PM
Return to original view | Post
#9
|
|
Junior Member
596 posts Joined: Dec 2010
|
QUOTE(okuribito @ Dec 17 2018, 08:26 PM) hahaha TQ most likely its redundant, cos if the checking is not done earlier and the password is <8 chars the substring part will return an error n crash the whole function, n u are right about the && operator that both conditions MUST be met before going into the if statement, hence if the password is always >8 (cos its checked earlier) then it only need to meet 1 condition which is the special character condition, and the else statement will not fail cos the password will never be less than 8 characters and the substring will work every timeThanks bro, but can pls help explain the IF statement .... CODE if (format.test(password) && pasword.length >= 8) Doesn't the && operator mean that BOTH conditions must be met in order to use the entire string entered by user? And if "checking for the password length <8 chars is already done before calling this function" then why include the password.length >= 8 condition in this IF statement? Redundant or not? In se7en's article, he also say "IF password CONTAINS SPECIAL CHARCTERS, ACCEPT WHOLE password," implying length already check b4hand..... LOL the coder that dumb ka??? PS: once again, hor, me dunno coding |
| Change to: |  0.0160sec
 0.58
 7 queries
 GZIP Disabled
Time is now: 11th December 2025 - 08:23 PM |
Quote