This question already has an answer here:

I came across this scenario recently, where a mobile application used for banking is sending HTTP requests for GIF images and HTTPS requests for all other transactions. But the requests to the GIF images are sent to a different domain and requests to bank related transactions are sent to another different domain. Does this behavior of this application pose any security risks?

I mean, can the http request & response be tampered to perform any kind of attacks?

If possible, how can this be exploited?

marked as duplicate by Stephane, WhiteWinterWolf, Steve, schroeder, Mark Jun 5 '15 at 1:02

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.


On top of the issues exposed by other answers, consider the fact that an attacker could impersonate the content delivery network used by the bank (ARP spoofing, DNS spoofing, IP spoofing...), and send crafted images, possibly including:

  • images with active JS (against old or poorly coded browsers that still accept JS in SVG files, and if the bank's same-origin-policy configuration includes the CDN as a trusted origin for the main domain)
  • images with exploits against the rendering engine of the browser; even if the attacker only gains the ability to run arbitrary code in the sandboxed process, that process happens to allow the attacker to perform bank transactions...
  • This does not apply when it is a native android or iOS right?? So can we say that it is not harmful to have http and https elements in the same application? – shriram pugazendhi Jun 8 '15 at 4:55
  • Of course it does. If data is delivered via the Internet on an insecure channel, then it applies. Most resources in native apps would be contained in the app package, but you could still retrieve images on the Internet to implement a banner that advertises current offers, for instance. – Steve Dodier-Lazaro Jun 8 '15 at 11:40
  • The only thing is the exploit should target an issue in the app sandbox of iOS/Android rather than the web rendering sandbox of a browser. – Steve Dodier-Lazaro Jun 8 '15 at 11:41

If HTTP resources are loaded into an HTTPS page, then the padlock icon will disappear from the client's browser because the page isn't secured properly.

This is very bad because users will be unable to distinguish between the real banking site and a phishing website. (Hopefully most users will notice the absence of a padlock and exit straight away.)


If they transfer those blinking chipTAN images also over HTTP is is possible to extract transaction details from that image. This would break the security goal confidentiality.

By modifying the image you could trick someone into generating a TAN for a transaction of your choice. However, this would require the victim to not verify the data on their chipTAN device.

Not the answer you're looking for? Browse other questions tagged or ask your own question.