Santander denies online banking hack

Santander has denied that cybercrooks have hijacked the online banking login page of its Alliance & Leicester unit.

  0 Be the first to comment

Santander denies online banking hack

Editorial

This content has been selected, created and edited by the Finextra editorial team based upon its relevance and interest to our community.

Alarm bells were sounded yesterday when an A&L customer took to technology and programming forums at Stack Overflow and Linode over security concerns with the site.

The customer says he was prompted with a SSL certificate warning for 'www.polycache.com' when attempting to log in to A&L Internet banking via FireFox 4.

Forum members worked to unravel the mystery and decipher the JavaScript. The issue was picked up by Finextra blogger Adam Nybäck who notes that it appeared that at the heart of the matter lies an injection which tries to look like an ordinary web analytics URL.

"It goes to a script at advanced-web-analytics.com which downloads another script from polycache.com which seems to hijack the login part of the site," says Nybäck.

However, Santander has told Finextra that the problem seems to be the result of a "technical failure" at a third party it taps for its online banking systems.

Says a spokesman: "This is currently being investigated further. However, Santander can confirm that neither its website nor the A&L website have been hacked and customer data has not been compromised."

Sponsored [Webinar] Exploring the ethics of AI in banking

Comments: (0)

[New Report] Managing Fraud Risks with Synthetic Data: A Practical Approach for Businesses ServicesFinextra Promoted[New Report] Managing Fraud Risks with Synthetic Data: A Practical Approach for Businesses Services Industry