Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including Air New Zealand, JetStar and The Warehouse.

It basically facilitates the verification that, as a customer, you have made a payment from your internet banking facility, so that the vendor may immediately complete the transaction.

It is highly attractive, because airlines do not charge a 'payment fee' when using POLi (which usually accounts for between $10 and $20). I am concerned with how it achieves this.

As an ANZ bank customer, after visiting the Air New Zealand website, I chose the 'POLi' payment option, and I was (while still on the Air New Zealand website), presented with my internet banking login page. So, to be clear, the address bar contained "airnewzealand.co.nz", which had an iframe, whose address was pointing to "https://nz00400.apac.paywithpoli.com/IBCS/pgLogin". I was then expected to log in to my internet banking, at which point I was presented with the pre-populated ANZ bank-transfer web page, with some fields disabled (reference code, amount etc).

What was being done is, the POLi server was requesting the bank website from the ANZ server, massaging the HTML, and passing the HTML to me. I then fill out the form, which is submitted back to the POLi server, who then passed that information back on to ANZ again. This was repeated for every page.

Because of this, POLi was able to

  1. pre populate the payment form so that I don't get the reference code or amount wrong
  2. disable fields so that I cannot change them
  3. validate the payment as completed so the transaction can continue.

What, if any, are the technical and social security implications of this technique?

Thanks everyone

share|improve this question

migrated from superuser.com Aug 20 '13 at 4:17

This question came from our site for computer enthusiasts and power users.

    
Welcome to IT Security. If you could limit your question to one specific aspect of security I think you will receive a better response. Perhaps a question about the implications for fraud. –  this.josh Aug 21 '13 at 6:43

1 Answer 1

You are entering your internet banking credentials into an interface owned by a merchant. The iframe comes from POLi, but there's no easy way for an end user to verify that, and the parent page would still have the opportunity to mess with the frame.

So you should not enter your credentials on this interface unless you trust:

  • POLi not to store or misuse the credentials you are giving them;

  • the merchant not to purloin the credentials, through clickjacking or just pointing the frame to some other source (phishing-style);

  • any third-party script providers used by the merchant (eg analytics, advertising) not to inject script content that would purloin the credentials;

  • the merchant to keep their entire web site safe from all XSS vulnerabilities that might let an attacker purloin the credentials.

  • POLi not to have any vulnerabilities where other parties can gain information through including their interface in an iframe and using clickjacking. (This is difficult to fully prevent when your interface must allow iframing.)

POLi are effectively doing a man-in-the-middle attack on your online banking and predictably some banks are upset about that. If you suffer from fraud (whether or not related to use of the POLi service), your bank might be able to argue that you have some liability, for not keeping up your end of the bargain to keep your banking credentials secret from everyone but the bank.

POLi aren't the only party taking this approach—see for example Germany's Sofortüberweisung. I personally consider it an insane idea, but it's hardly the first insane idea to catch on from the financial world.

share|improve this answer
    
Thanks bobince. If people became used to paying by POLi, is there nothing that would stop any malicious person from creating a 'pay by POLi' look-alike on their website, and collecting customer's banking details? –  Adam Aug 20 '13 at 21:33
    
@Adam: quite—nothing whatsoever. Hence you have to have complete trust in the merchant (the owner of the site in the address bar). The model breaks down for the case of the untrusted merchant, and has the side effect of encouraging users to type banking credentials into what could easily be a phishing site (but this is a negative externality that doesn't affect POLi's profitability). –  bobince Aug 21 '13 at 8:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.