I came across this scenario recently, where a mobile application used for banking is sending HTTP requests for GIF images and HTTPS requests for all other transactions. But the requests to the GIF images are sent to a different domain and requests to bank related transactions are sent to another different domain. Does this behavior of this application pose any security risks?

I mean, can the http request & response be tampered to perform any kind of attacks?

If possible, how can this be exploited?


On top of the issues exposed by other answers, consider the fact that an attacker could impersonate the content delivery network used by the bank (ARP spoofing, DNS spoofing, IP spoofing...), and send crafted images, possibly including:

  • images with active JS (against old or poorly coded browsers that still accept JS in SVG files, and if the bank's same-origin-policy configuration includes the CDN as a trusted origin for the main domain)
  • images with exploits against the rendering engine of the browser; even if the attacker only gains the ability to run arbitrary code in the sandboxed process, that process happens to allow the attacker to perform bank transactions...
  • This does not apply when it is a native android or iOS right?? So can we say that it is not harmful to have http and https elements in the same application? Jun 8 '15 at 4:55
  • Of course it does. If data is delivered via the Internet on an insecure channel, then it applies. Most resources in native apps would be contained in the app package, but you could still retrieve images on the Internet to implement a banner that advertises current offers, for instance. Jun 8 '15 at 11:40
  • The only thing is the exploit should target an issue in the app sandbox of iOS/Android rather than the web rendering sandbox of a browser. Jun 8 '15 at 11:41

If HTTP resources are loaded into an HTTPS page, then the padlock icon will disappear from the client's browser because the page isn't secured properly.

This is very bad because users will be unable to distinguish between the real banking site and a phishing website. (Hopefully most users will notice the absence of a padlock and exit straight away.)


If they transfer those blinking chipTAN images also over HTTP is is possible to extract transaction details from that image. This would break the security goal confidentiality.

By modifying the image you could trick someone into generating a TAN for a transaction of your choice. However, this would require the victim to not verify the data on their chipTAN device.

Not the answer you're looking for? Browse other questions tagged or ask your own question.