My OperaImproving online banking security with Opera
Saturday, January 7, 2012 3:19:47 PM
Abstract
This post describes how Opera users can improve online banking security using a second, hardened profile. In general this can be done on all platforms, you just need to create a second profile. Creating a second profile can be done in different ways and there are many guides out there, handling this topic. I'll describe an (in my opinion) very simple way to get this done with Windows 7 on NTFS.
In a first step, we'll harden Opera using the urlfilter.ini as a whitelist.
Afterwards, we'll tune some Opera settings to improve the security further.
Creating a second profile
By default the Opera profile is located in the directory %AppData%\Opera\<Name of Opera installation directory>. We'll use this fact to get a second profile by creating a symlink to the Opera installation directory. To do this, open a command prompt as an administrator and enter the command
The benefit of this technique is that on the one hand, you don't need to mess around with command line switches to use different profiles, since the profile is chosen in the "natural" way. On the other hand, you stay with one single installation on your computer which need to be updated.
urlfilter.ini as a whitelist
Now we'll change the configuration in the newly generated Opera profile, such that only your online banking pages will be accessible if this profile is used. To reach this goal, we need to edit the urlfilter.ini in %AppData%\Opera\<New Opera Folder>. It is a text file consisting of two sections: One is named include, the second exclude. The include section has by default one entry: *. This means, that all addresses may be accessed by Opera. The =UUID:... parts may be ignored. They are created automatically by Opera and are used for Opera Link.
The easy ones are the addresses, you can read directly in the address bar. Use your default Opera installation and open your online banking site. As Opera uses address bar highlighting, simply copy the black part of the address and include the lines
Secondly, Opera needs to communicate with the Certificate Authority who has signed your bank's certificate, to check if the certificate is valid. To get the needed addresses, click on the security indicator, click on Details and change to the Certificate tab. Expand the Certificate node and the Extensions node beyond. In the sections X509v3 CRL Distribution Points and Authority Information Access you'll find addresses for OCSP and CRL verification. You need to allow them to be accessed. For example, for VeriSign, I've added
And last, but not least, you should add
If the validation fails, the connection will be displayed as not secure in spite of using SSL encryption. So, it's pretty easy to see if you did it right. But the validation results are cached for some time, so the results displayed may not refer to your actual include list if the verification failed/succeeded short time before.
If you did all right, you should be able to access your banking sites, see the green EV security indicators and all other sites should be blocked from being accessed.
Settings in Opera
To enhance the security, we can change some settings in Opera:
What's the benefit
If you're using this profile for online banking, you can be sure, that your data can't be phished by XSS (Cross Site Scripting) attacks, because internet traffic is limited to your banking sites. It can't be compromised by sites, opened in other tabs using unknown security flaws in Opera. Also, if an attacker succeeds in compromising your bank's server and manipulating the homepage, Opera won't send data to other servers than the bank server.
What still can happen
Through DNS poisoning, it's still possible to get Opera to communicate with other servers. But if you keep an eye on the security indicator, this is very very unlikely to happen, since also valid certificates would be needed. Also you are not protected from keyloggers or other malware installed on your computer, which phishes your keyboard input or manipulates your browser process.
This post describes how Opera users can improve online banking security using a second, hardened profile. In general this can be done on all platforms, you just need to create a second profile. Creating a second profile can be done in different ways and there are many guides out there, handling this topic. I'll describe an (in my opinion) very simple way to get this done with Windows 7 on NTFS.
In a first step, we'll harden Opera using the urlfilter.ini as a whitelist.
Afterwards, we'll tune some Opera settings to improve the security further.
Creating a second profile
By default the Opera profile is located in the directory %AppData%\Opera\<Name of Opera installation directory>. We'll use this fact to get a second profile by creating a symlink to the Opera installation directory. To do this, open a command prompt as an administrator and enter the command
mklink /D <New Opera Folder> <Opera Installation Folder>Running Opera from the newly created "folder" will create a fresh profile %AppData%\Opera\<New Opera Folder>.
The benefit of this technique is that on the one hand, you don't need to mess around with command line switches to use different profiles, since the profile is chosen in the "natural" way. On the other hand, you stay with one single installation on your computer which need to be updated.
urlfilter.ini as a whitelist
Now we'll change the configuration in the newly generated Opera profile, such that only your online banking pages will be accessible if this profile is used. To reach this goal, we need to edit the urlfilter.ini in %AppData%\Opera\<New Opera Folder>. It is a text file consisting of two sections: One is named include, the second exclude. The include section has by default one entry: *. This means, that all addresses may be accessed by Opera. The =UUID:... parts may be ignored. They are created automatically by Opera and are used for Opera Link.
- Make sure that Opera is closed
- Remove the * entry in the include section
- and include a list of addresses, that will be the only accessible ones. This is depending on the online banking pages you like to use.
The easy ones are the addresses, you can read directly in the address bar. Use your default Opera installation and open your online banking site. As Opera uses address bar highlighting, simply copy the black part of the address and include the lines
https://<black part of the address>/* https://*.<black part of the address>/*This will allow secure communication with this domain and all of it's sub domains. So Opera will be allowed to communicate with your bank.
Secondly, Opera needs to communicate with the Certificate Authority who has signed your bank's certificate, to check if the certificate is valid. To get the needed addresses, click on the security indicator, click on Details and change to the Certificate tab. Expand the Certificate node and the Extensions node beyond. In the sections X509v3 CRL Distribution Points and Authority Information Access you'll find addresses for OCSP and CRL verification. You need to allow them to be accessed. For example, for VeriSign, I've added
http://*.verisign.com/*to the include list.
And last, but not least, you should add
https://certs.opera.com/* http://*.digicert.com/*to allow updates to the Opera certificate store and to allow Opera to verify the certificate of certs.opera.com.
If the validation fails, the connection will be displayed as not secure in spite of using SSL encryption. So, it's pretty easy to see if you did it right. But the validation results are cached for some time, so the results displayed may not refer to your actual include list if the verification failed/succeeded short time before.
If you did all right, you should be able to access your banking sites, see the green EV security indicators and all other sites should be blocked from being accessed.
Settings in Opera
To enhance the security, we can change some settings in Opera:
- Disable plugins: Plugins aren't affected by Opera's urlfilter.ini, so it may be possible, that they can be used to communicate with other sites.
- Disable Cache and History: For privacy reasons you should disable these features if you share your computer with other people.
- Security Protocols: Disable all protocols with smaller keylength if your bank supports this to make sure a more secure key is used for encryption (i.e. disable the 128bit protocols). Since 128bit AES/MD5 needs to be implemented to fulfill the standard, this shouldn't be done in general. If afterwards an SSL connection isn't possible anymore, undo this change.
- Disable Turbo and Unite
What's the benefit
If you're using this profile for online banking, you can be sure, that your data can't be phished by XSS (Cross Site Scripting) attacks, because internet traffic is limited to your banking sites. It can't be compromised by sites, opened in other tabs using unknown security flaws in Opera. Also, if an attacker succeeds in compromising your bank's server and manipulating the homepage, Opera won't send data to other servers than the bank server.
What still can happen
Through DNS poisoning, it's still possible to get Opera to communicate with other servers. But if you keep an eye on the security indicator, this is very very unlikely to happen, since also valid certificates would be needed. Also you are not protected from keyloggers or other malware installed on your computer, which phishes your keyboard input or manipulates your browser process.
