# Trackers leaking bank account data

DevFeed: [Trackers leaking bank account data](<https://devfeed.tech/articles/trackers-leaking-bank-account-data-21643.md>)

Original publisher: [Read original article](<https://www.windytan.com/2015/04/trackers-and-bank-accounts.html>)

Author: Oona Räisänen (noreply@blogger.com)

Published: 2015-04-14T17:17:00Z

Content type: article

Language: en

Sources: [Oona Räisänen](<https://devfeed.tech/sources/oona-raisanen.md>)

Topics: [data](<https://devfeed.tech/topics/data.md>), [HTTP](<https://devfeed.tech/topics/http.md>), [Google](<https://devfeed.tech/topics/google.md>), [Database](<https://devfeed.tech/topics/database.md>), [C](<https://devfeed.tech/topics/c.md>)

Tags: [breach](<https://devfeed.tech/tags/breach.md>), [c](<https://devfeed.tech/tags/c.md>), [customer](<https://devfeed.tech/tags/customer.md>), [data](<https://devfeed.tech/tags/data.md>), [database](<https://devfeed.tech/tags/database.md>), [encryption](<https://devfeed.tech/tags/encryption.md>), [financial](<https://devfeed.tech/tags/financial.md>), [financial-services](<https://devfeed.tech/tags/financial-services.md>), [google](<https://devfeed.tech/tags/google.md>), [http](<https://devfeed.tech/tags/http.md>), [programming](<https://devfeed.tech/tags/programming.md>), [security](<https://devfeed.tech/tags/security.md>)

## AI overview

The article investigates a Finnish online bank's use of a US-based third-party analytics script. It reports that tracking requests exposed users' IP addresses, visited URLs, transaction archive codes, and an unsalted SHA-1 hash of a bank account number that could be reversed using a short C program.

## Source excerpt

A Finnish online bank used to include a US-based third-party analytics and tracking script in all of its pages. Ospi first wrote about it (in Finnish) in February 2015, and this caused a bit of a fuss. The bank responded to users' worries by claiming that all information is collected anonymously: But is it true? As Ospi notes, a plethora of information is sent along the HTTP request for the tracker script. This includes, of course, the IP address of the user; but also the full URL the user is browsing. The bank's URLs reveal quite a bit about what the user is doing; for instance, a user planning to start a continuous savings contract will send the url continuousSavingsContractStep1.do. I logged in to the bank (using well-known demo credentials) to record one such tracking request. The URL sent to the third party tracker contains a cleartext transaction archive code that could easily be used to match a transaction between two bank accounts, since it's identical for both users. But there's also a hex string called accountId (highlighted in red). Remote Address: 80.***.***.***:443 Request URL: https://www.google-analytics.com/collect?v=1&_v=j33&a=870588619&t =pageview&_s=1&dl=https%3A%2F%2Fonline.********.fi%2Febank%2Facco unt%2FinitTransactionDetails.do%3FbackLink%3Dreset%26accountId%3D 69af881eca98b7042f18e975e00f9d49d5d5ee64%26rowNo%3D0%26type%3Dtra ns%26archivecode%3D20150220123456780002&ul=en-us&de=windows-1252& dt=Tilit%C2%A0%7C%C2%A0Verkkopankki%20%7C%20S-Pankki&sd=24-bit&sr =1440x900&vp=1440x150&je=1&fl=16.0%20r0&_u=QACAAQQBI~&jid=&cid=18 39557247.1424801770&uid=&tid=UA-37407484-1&cd1=&cd2=demo_accounts &cd3=%2Ffi%2F&z=2098846672 Request Method: GET Status Code: 200 OK It's 40 hex characters long, which is 160 bits. This happens to be the length of an SHA-1 hash. Could it really be a simple hash of the user's bank account number? Surely they would at least salt it. Let's try! The demo account's IBAN code is FI96 3939 0001 0006 03, but this doesn't give us the a