4

nwolb.com the site for Natwest Online Banking (a UK based bank) makes two requests to non existent resources. For example:

enter image description here

https://82.13.77.77:4531/NonExistentImage20297.gif https://127.0.0.1:4817/NonExistentImage25060.gif

What is the purpose of this? Is it some kind of webapp security hardening? It seems the port numbers and image numbers change but the ip addresses (external and loopback) do not.

  • 3
    I don't want to post an answer as I am not sure about this, but in theory, this may be to check for MITM attacker that intercepts all connections. It is possible such MITM attacker would unknowingly accept the connection before checking the pictures actually exist, so he would reveal himeslf. – Peter Harmann May 3 '18 at 21:32
  • It appears capital one does this too – AndrolGenhald May 3 '18 at 21:45
  • 2
    From the source it looks like it has more to do with fingerprinting than anything – AndrolGenhald May 3 '18 at 22:12
  • @PeterHarmann I think that sounds like a plausible explanation. There has also been some malware that has used a similar technique to identify if they are being run in a protected environment typically used by researchers. If a request to a known non-existing resource returns, then you know that the environment is not as expected. – Hans Kristian Mar 21 at 10:31
  • @AndrolGenhald can you give an example of that using something from the source? I would be fascinated to know. Thanks for taking the time to post originally. – AJP Mar 21 at 10:37
0

I agree with the others that this is probably not web app hardening but instead per this forum post

https://www.wilderssecurity.com/threads/strange-links-from-my-banking-website.361064/

Is probably

"... just plain visitor tracking evilness..."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.