Hacker News new | ask | show | jobs
by varenc 1262 days ago
I poked around the install page for Citibank's required software and it's pretty fascinating: https://www.citibank.co.kr/CusSecnCnts0100.act?P_name=ASTx

Some quick observations:

- That page intentionally disables right-click! Just by putting `oncontextmenu="return false"` on the <body> tag. This gives me flashbacks to the late 90s when this technique was used to make it harder for users to copy images or inspect HTML source. Browsers all have built in developer tools so pretty silly seeing it now.

- The JS included on that page is a mix of heavily obfuscated code[0] and completely unminified code with all the internal comments left in[1].

- I was impressed that the required software seems to support Fedora and Ubuntu/Debian as well as macOS and Windows.

- One of the installations is checked by making a JSON-P call (another old tech flashback!) to `https://lx.astxsvc.com:55921/ASTX2/hello?...`. This works because lx.astxsvc.com resolves to 127.0.0.1 so you're just hitting your localhost. Presumably the installed software checks the referer header to ensure only citibank is making these requests.

[0] https://www.citibank.co.kr/aB-IFIZu8Pd7Zd1yjboonwGx/uYfEz6Dp...

[1] https://www.citibank.co.kr/3rdParty/wizvera/veraport/install...
2 comments
palant 1262 days ago
Disclaimer: I’m the author of this article.

Did you notice the plain HTTP (no SSL) download URLs for the “security software”? If not, you are missing out!

link
varenc 1261 days ago
I didn't! The download URLs on that page all seemed to be HTTPS for me, though my browser might be forcing the HTTPS connection or something. Or it's just the macOS versions. I'd 100% believe there's plain HTTP requests in there somewhere. I was trying to get the JS to serve me the software for other OSes but was struggling since it seems to do more than just a User-Agent check. Fortunately that JS is the totally unobfuscated kind.

btw, love your article! Such an interesting obscure little corner of the world of technology. Hope to read more.

link
curling_grad 1262 days ago
Disabling right click is kind of a Korean web tradition. Almost every dated websites (including personal blogs) have done that.
link