Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
...or how to grab transaction data out of AIB's online interface, and format it
into OFX
file.
NOTE: Last AIB login update (Feb' 2021) made me realise how brittle the overall machinery here is. The code that works around Web Storage API use is ugly and likely to break. The most likely road forward for this project is to decouple it into ofxstatement plugin and (maybe) Selenium-powered CSV acquisition script. The former will be easy, the latter will most likely be a nightmare to maintain and install, unless you enjoy having your banking details pipe through an arbitrary docker image.
Time will tell.
python3 -mvenv aib2ofx
source aib2ofx/bin/activate
pip3 install aib2ofx
This will create a virtualenv for aib2ofx
, fetch its code then install it with
all dependencies. Once that completes, you'll find aib2ofx
executable in the
bin
directory of this new virtualenv.
Create a ~/.aib2ofx.json
file, with AIB login details.
Set the permission bits to 0600 to prevent other system users from reading it.
touch ~/.aib2ofx.json
chmod 0600 ~/.aib2ofx.json
It has a JSON format, single object with one key per AIB login you want to use.
{
"bradmajors": {
"regNumber": "12345678",
"pin": "12345"
}
}
The fields are as follows:
regNumber
Your AIB registered number.
pin
Your five digit PIN.
You can put more than one set of credentials in the file; the script will download data for all accounts for all logins.
{
"bradmajors": {
"regNumber": "12345678",
"pin": "12345"
},
"janetweiss": {
"regNumber": "87654321",
"pin": "54321"
}
}
Note that there's no comma after the last account details.
Once you've prepared that config file, run:
aib2ofx -d /output/directory
The script should connect to AIB, log in using provided credentials,
iterate through all accounts, and save each of those to a separate
file located in /output/directory
.
There is none.
I've written that script with my best intentions, it's not malicious,
it's not sending the data anywhere, it's not doing anything nasty. I'm
using it day to day to get data about my AIB accounts into a financial
program that I use. It should work for you as good as it works for
me. See the LICENSE
file for more details.
aib2ofx works only with python 3.
In order to set up a dev environment clone the repository, get
poetry
and run poetry install
. This will create a virtualenv with all
dependencies installed. You can activate it with poetry shell
.
FAQs
Download data from aib.ie in OFX format
We found that aib2ofx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.