FlyerTalk Forums - View Single Post - LY Blows It Again On the Web
View Single Post
Old Aug 1, 2006 | 2:38 am
  #11  
hnussbacher
10 Countries Visited
20 Countries Visited
30 Countries Visited
15 Years on Site
 
Join Date: Jun 2006
Location: Israel
Programs: Elal Silver, AirCanada Aeroplan, AA AAdvantage, KLM Flying Blue, Continental OnePass, Delta Skymiles
Posts: 559
Originally Posted by badatz
I tried accessing the El Al site using a bookmark and got a page saying that I can't access the site because I am using a bookmark
Anyone else experience this?
Only when I retyped elal.co.il did I get the site
What gives?????
This happens on sites that are generally poorly coded and they wish to protect themselves from hackers. What hackers can do is capture the HTML code, say to an eticket page where you are asked to pay $1200 for a ticket and then they replay the page back with a modified amount - of say $400. The application doesn't check that the amount being returned in the web form is different from what it just sent to the user and then it stupidly goes ahead and does the transaction. This trick has been closed for a while in many sites but many poorly coded sites still suffer this style of attack. One way to mitigate this type of attack if you are not sure if all your HTML apps are properly coded is to not allow bookmarking deep into your app and then allowing jumping to there. It would appear Elal is taking that preventative measure.

-Hank
hnussbacher is offline