[{"content":" While doing some research for Bankdroid during the hot summer days I decided to take a look at the increasingly popular payment app Swish. Swish, developed by HiQ for Sweden\u0026rsquo;s six major banks (Danske Bank, Handelsbanken, Länsförsäkringar Bank, Nordea, SEB and Swedbank/Sparbankerna), lets its users send and receive instant payments without the hassle of bank transfers.\nGetting at the traffic My first thought was to set up a transparent proxy to be able to observe the traffic between the app and the Swish backend, but that didn\u0026rsquo;t go as smooth as I had hoped. It turned out that they were using a self-signed certificate and had therefore implemented certificate pinning (Moxie Marlinspike\u0026rsquo;s1 AndroidPinning to be precise, licensed under the GPLv3 - meaning that Getswish AB is obligated to hand over a copy of the Android app\u0026rsquo;s source code to anyone who requests it) in their apps. Whether planned or not this solution made the app more secure by mitigating man-in-the-middle attacks - it also meant that I had a new obstacle to overcome as I wouldn\u0026rsquo;t be able to simply connect through my proxy.\nAfter a bit of tweaking and tinkering I was finally able to see all the requests in clear text.\nThe API and mobilt BankID At first glance nothing looked out of the ordinary. A simple XML API with a handful of endpoints and, as HiQ boasts on their website2, using Mobilt BankID for authentication:\nBetalningarna godkänns med hjälp av mobilt BankID, vilket gör att lösningen är lika säker som de olika bankernas internettjänster.\nThe way mobilt BankID was implemented was that a request that required authentication would return a BankID reference number and the app would, after the user had successfully signed with mobilt BankID, execute the same request again (this time including the reference number).\nThis seemed like straightforward and secure enough solution.\nThe phone number in the request A thing that caught my attention was that the user\u0026rsquo;s MSISDN/phone number was included in the payment history request: \u0026hellip;/mpc-swish/rest/paymenthistory/46701234567/ALL/0/30/.\nWhy would the server need the MSISDN if we were already authenticated?\nWhat would happen if the MSISDN was changed to another user\u0026rsquo;s?\nAuthentication, but no authorization Apparently, in the case of payment history requests, mobilt BankID was only used for authentication and not for authorization.\nAn authenticated user could retrieve any other users complete transaction history simply by changing the MSISDN in the request. The Swish server never checked whether the user was authorized to make that request or not.\nThe transaction history includes phone numbers, full names, datetimes, amounts and messages for every person you\u0026rsquo;ve ever sent/received a Swish payment to/from.\nAs the developers were completely unaware of this vulnerability it is quite safe to assume that is has existed since Swish was launched nearly 2 years ago (December 2012) and at the time of discovery affected over 1.4 million Swish users3.\nReporting it Getting a hold of someone at Swish was another challenge. There\u0026rsquo;s no contact info on their website (only contact info for the connected banks) and their PR folks on Twitter weren\u0026rsquo;t very helpful.\nAfter emailing all of the affected banks and describing the problem a couple of them actually replied and a day later I was contacted by someone in charge of the project. A short week later the vulnerability was fixed and everyone was happy again.\nTLDR: Vulnerability in Swish let any user access any other user\u0026rsquo;s complete transaction history.\nUpdate regarding use of GPL code in the Swish payments app 31 Oct 2014\nThere has been some discussion regarding the claim that Getswish AB is using GPL licensed code in their application. Getswish AB (via their press managers at The World Loves) are denying4,5,6 that any GPL licensed code is used in the Swish payments app. Myself and others who have examined the app are confident that (a modified version of) AndroidPinning has been used.\nLet\u0026rsquo;s take a look at the code from both projects. PinningTrustManager from AndroidPinning can be found at https://github.com/moxie0/AndroidPinning/blob/master/src/org/thoughtcrime/ssl/pinning/PinningTrustManager.java\nThe code from the Swish app was converted from dex format7 to java .class files with the help of dex2jar and the java code was reconstructed from the .class files using JD Project. The source for the reconstructed code can be found at https://gist.github.com/liato/1e8f11c017353109dd82\nIt\u0026rsquo;s important to note that reconstructing java code from a .class file doesn\u0026rsquo;t always produce the same code that was compiled but all method signatures and string literals are left untouched.\nAs you can see by comparing the two classes there are too many similarities for it to be an original piece of code.\nFor starters, both the class from AndroidPinning and the one from Swish is called PinningTrustManager.\nIdentical method signatures that are not inherited from the X509TrustManager interface8 include:\nprivate byte[] hexStringToByteArray(String) private TrustManager[] initializeSystemTrustManagers() private boolean isValidPin(X509Certificate) Identical field declarations include:\nprivate final List\u0026lt;byte[]\u0026gt; pins private final SystemKeyStore systemKeyStore They even have the same exact exception message for checkClientTrusted(X509Certificate[], String)!\nthrow new CertificateException(\u0026#34;Client certificates not supported!\u0026#34;); The examined apk was downloaded 4th of July 2014 and can be found at http://nullbyte.eu/se.bankgirot.swish_2.0_6023.apk\nhttp://www.thoughtcrime.org/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttp://hiq.se/#kund/CASE/Swish\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttp://www.getswish.se/\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://www.facebook.com/getswish/posts/10152347980456949?comment_id=10152349476451949\u0026amp;offset=0\u0026amp;total_comments=3\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://twitter.com/peppelorum/status/527073721593643009\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://twitter.com/ajtowf/status/527238687701368832\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttps://source.android.com/devices/tech/dalvik/dex-format.html\u0026#160;\u0026#x21a9;\u0026#xfe0e;\nhttp://docs.oracle.com/javase/7/docs/api/javax/net/ssl/X509TrustManager.html\u0026#160;\u0026#x21a9;\u0026#xfe0e;\n","permalink":"https://blog.nullbyte.eu/open-curtains-in-swish-payments-service/","summary":"Vulnerability in Swish let any user access any other user\u0026rsquo;s complete transaction history.","title":"Open curtains in Swish payments service"},{"content":"Here\u0026rsquo;s a small preview of what version 2 of Bankdroid will look like.\nImage is no longer available\nThere\u0026rsquo;s still a ton of work left so don\u0026rsquo;t expect it anytime soon.\n","permalink":"https://blog.nullbyte.eu/bankdroid-v2-sneak-peek/","summary":"A small preview of what version 2 of Bankdroid will look like.","title":"Bankdroid v2 Sneak Peek"},{"content":"The newly released (2012-06-04) Swedbank mobile application is now a real android application and no longer just a website wrapper. What follows is a short documentation of the JSON API used by the app. The API is located at https://auth.api.swedbank.se/ and all requests and responses are JSON objects.\nLogin with username/password POST /TDE_DAP_Portal_REST_WEB/api/v1/identification/personalcode?dsid=Zf0wGfKF HTTP/1.1 Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5 Content-Type: application/json; charset=UTF-8 Content-Length: 43 Host: auth.api.swedbank.se Connection: Keep-Alive User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus Cookie: dsid=Zf0wGfKF Cookie2: $Version=1 {\u0026#34;password\u0026#34;:\u0026#34;123abc\u0026#34;,\u0026#34;userId\u0026#34;:\u0026#34;8105280000\u0026#34;} Nothing unusual about this request except for the dsid and Authorization header. During my short period of testing the Authorization header maintained the same value for all requests, the dsid on the other hand changes with every request and there\u0026rsquo;s no way of telling what the dsid for the next request should be just by looking at the API response. A bit deeper digging will be required to find out how it\u0026rsquo;s generated.\nLogin response HTTP/1.1 201 Created Server: FSB Date: Mon, 04 Jun 2012 23:21:26 GMT Cache-control: no-cache Transfer-encoding: chunked Content-type: application/json; charset=UTF-8 Pragma: no-cache Cache-control: no-cache, no-store, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-language: sv-SE Set-Cookie: mobilsession=1016992778.47873.0000; expires=Mon, 04-Jun-2012 23:41:26 GMT; path=/ { \u0026#34;personalCodeChangeRequired\u0026#34;: false, \u0026#34;links\u0026#34;: { \u0026#34;next\u0026#34;: { \u0026#34;method\u0026#34;: \u0026#34;GET\u0026#34;, \u0026#34;uri\u0026#34;: \u0026#34;/v1/profile/\u0026#34; } }, \u0026#34;serverTime\u0026#34;: \u0026#34;20120605 01:21\u0026#34; } Not a lot of interesting information here. We\u0026rsquo;ve got a URL for our next request so let\u0026rsquo;s continue.\nProfile request POST /TDE_DAP_Portal_REST_WEB/api/v1/profile/private/08999?dsid=6hl9Isv6 HTTP/1.1 Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5 Content-Type: application/json; charset=UTF-8 Content-Length: 0 Host: auth.api.swedbank.se Connection: Keep-Alive User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus Cookie: JSESSIONID=0000XRefgtdh63YPHmwNuITrMTg:16t5rmrdr; SWBTC=gi35jCq1KpGexTaK8FLZIEgVIKk=:LTFhNTQxZDhmOjEzN2I3ODllYTIxOmQyYw==:odwhiQ==; mobilsession=1016992778.47873.0000; dsid=6hl9Isv6 Cookie2: $Version=1 Profile response { \u0026#34;hasSwedbankProfile\u0026#34;: true, \u0026#34;hasSavingbankProfile\u0026#34;: false, \u0026#34;selectedProfile\u0026#34;: { \u0026#34;customerName\u0026#34;: \u0026#34;Firstname Lastname\u0026#34;, \u0026#34;customerNumber\u0026#34;: \u0026#34;username/personnr\u0026#34; }, \u0026#34;menuStructure\u0026#34;: { \u0026#34;menuGroups\u0026#34;: [{ \u0026#34;name\u0026#34;: [\u0026#34;/v1/sign\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/sign/securitytoken/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }, { \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/sign/securitytoken/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }, { \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/sign/bankid/mobile/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }, { \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/sign/bankid/mobile/verify/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/identification\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/identification/personalcode\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/identification\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/identification/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/identification\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/identification/logout\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/identification\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/identification/touch\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/baseinfo\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/registered\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/registered\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/{transferId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/{transferId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/confirmed/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/confirmed\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/recipient\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/recipient/confirmed/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/transfer\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/transfer/{transferId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/profile\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/profile/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/profile\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/profile/{profileId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/profile\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/profile/private/{bankId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/baseinfo\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/registered\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/registered\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/{paymentId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/{paymentId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/confirmed/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/confirmed\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/{paymentId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/einvoice/{einvoiceId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/payee\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/payee/confirmed/{signId}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/payee/{type}/{accountNumber}\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/payment\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/payment/rejected\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/search\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/search/location\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/search\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/search/location\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/marketinfo/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/multimarketinfo/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/marketinfo/{selection}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/securitylist/{listid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/securitylist/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}/{instrumenttype}/{instrumentid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}/{instrumenttype}/{instrumentid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{listid}/{name}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/userlist/{name}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/quickuserlist/{vpsubscriptionid}/{instrumenttype}/{instrumentid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/quickuserlist/{vpsubscriptionid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/quickuserlist/{vpsubscriptionid}/{instrumenttype}/{instrumentid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;PUT\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/subscription/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/subscription/{vpsubscriptionid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/option/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/engagement\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/engagement/overview\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/engagement\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/engagement/transactions/{accountId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/engagement\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/engagement/loandetail/{loanId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/quickbalance\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/quickbalance/subscription/{accountId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/quickbalance\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/quickbalance/subscription/{subscriptionId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/quickbalance\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/quickbalance/{subscriptionId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/quickbalance\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/quickbalance/accounts\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/loan\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/loan/rates/private/{bankid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/v1/loan\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/loan/rates/mortgage/{bankid}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/loan\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/loan/calculation/housingmortgage\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/loan\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/loan/calculation/private\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/v1/prepaidcard\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/prepaidcard/reload\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/prepaidcard\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/prepaidcard/reload\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/custodies\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: false }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/custody\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: false }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/selectcustody\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: false }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/order\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;POST\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/order/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/order\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/order/estimation\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/order\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/order/validation\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/order\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/order/{orderId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/trigger\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;DELETE\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/trigger/{triggerId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/orders\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/issues\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/triggers\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/trades\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/orders/{orderId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/trades/{tradeId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/issues/{issueId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/triggers/{triggerId}\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/securities/orderstatus\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/securities/orderstatus/activity\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/einvoice\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/einvoice/incoming\u0026#34;], \u0026#34;authorized\u0026#34;: false, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/message\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/message/reminders\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/currency\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/currency/exchangerates\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/currency\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/currency/conversion\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }, { \u0026#34;name\u0026#34;: [\u0026#34;/v1/identification/device\u0026#34;], \u0026#34;items\u0026#34;: [{ \u0026#34;requestMethods\u0026#34;: [\u0026#34;GET\u0026#34;], \u0026#34;serviceURIs\u0026#34;: [\u0026#34;/v1/identification/device/\u0026#34;], \u0026#34;authorized\u0026#34;: true, \u0026#34;authorizedIfAuthMethodUpgrade\u0026#34;: true }] }] } } We\u0026rsquo;ve got the user\u0026rsquo;s name and username/personnr, but that\u0026rsquo;s not the most interesting part! The menuStructure object seems to contain all the URIs for this API. As you might imagine this will come in handy later.\nLet\u0026rsquo;s continue with the accounts/engagements request.\nAccounts and engagements GET /TDE_DAP_Portal_REST_WEB/api/v1/engagement/overview?dsid=gNBHkcQm HTTP/1.1 Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5 Content-Type: application/json; charset=UTF-8 Host: auth.api.swedbank.se Connection: Keep-Alive User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus Cookie: JSESSIONID=0000XRefgtPh6dYPHmwNuITrMTg:16t5rmrdr; SWBTC=gi35jCq1KpGexTaK8FLZIEgVIKk=:LTFhNTQxZDhmOjEzN2I3ODllYTIxOmQyYw==:odwhiQ==; mobilsession=1076992778.47873.0000; dsid=gNBHkcQm Cookie2: $Version=1 Accounts response HTTP/1.1 200 OK Server: FSB Date: Mon, 04 Jun 2012 23:21:27 GMT Cache-control: no-cache Transfer-encoding: chunked Content-type: application/json; charset=UTF-8 Pragma: no-cache Cache-control: no-cache, no-store, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-language: sv-SE Set-Cookie: mobilsession=1076992778.47873.0000; expires=Mon, 04-Jun-2012 23:41:27 GMT; path=/ { \u0026#34;transactionAccounts\u0026#34;: [{ \u0026#34;selectedForQuickbalance\u0026#34;: false, \u0026#34;links\u0026#34;: { \u0026#34;next\u0026#34;: { \u0026#34;method\u0026#34;: \u0026#34;GET\u0026#34;, \u0026#34;uri\u0026#34;: \u0026#34;/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a\u0026#34; } }, \u0026#34;name\u0026#34;: \u0026#34;Privatkonto\u0026#34;, \u0026#34;id\u0026#34;: \u0026#34;befef7059a0a16d6c40fcf70a0bc3f22e422617a\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;accountNumber\u0026#34;: \u0026#34;903 000 000-0\u0026#34;, \u0026#34;clearingNumber\u0026#34;: \u0026#34;8327-9\u0026#34;, \u0026#34;balance\u0026#34;: \u0026#34;12 345,67\u0026#34;, \u0026#34;fullyFormattedNumber\u0026#34;: \u0026#34;8327-9,903 000 000-0\u0026#34; }], \u0026#34;transactionDisposalAccounts\u0026#34;: [], \u0026#34;loanAccounts\u0026#34;: [], \u0026#34;savingAccounts\u0026#34;: [{ \u0026#34;selectedForQuickbalance\u0026#34;: false, \u0026#34;links\u0026#34;: { \u0026#34;next\u0026#34;: { \u0026#34;method\u0026#34;: \u0026#34;GET\u0026#34;, \u0026#34;uri\u0026#34;: \u0026#34;/v1/engagement/transactions/3cee0aaad3896cd72210a15142b158d1c51a2c12\u0026#34; } }, \u0026#34;name\u0026#34;: \u0026#34;e-sparkonto\u0026#34;, \u0026#34;id\u0026#34;: \u0026#34;3cee0aaad3896cd72210a15142b158d1c51a2c12\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;accountNumber\u0026#34;: \u0026#34;913 000 000-0\u0026#34;, \u0026#34;clearingNumber\u0026#34;: \u0026#34;8327-9\u0026#34;, \u0026#34;balance\u0026#34;: \u0026#34;123 456,78\u0026#34;, \u0026#34;fullyFormattedNumber\u0026#34;: \u0026#34;8327-9,913 000 000-0\u0026#34; }], \u0026#34;cardAccounts\u0026#34;: [], \u0026#34;cardCredit\u0026#34;: {} } Transaction accounts, saving accounts, loan accounts, card accounts and card credit. That\u0026rsquo;s a lot of useful info with just one request! The last example will be a request for a list of transactions for an account.\nTransactions for \u0026ldquo;Privatkonto\u0026rdquo; GET /TDE_DAP_Portal_REST_WEB/api/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a?dsid=MAccCv1G HTTP/1.1 Authorization: aWlyallxRmpRcTVMY0ZDbDo5YmE2OTkxMzQ2ZjJmOGU5 Content-Type: application/json; charset=UTF-8 Host: auth.api.swedbank.se Connection: Keep-Alive User-Agent: SwedbankMobilbank/3.0.0 (Android; 4.0.2) samsung/Galaxy_Nexus Cookie: JSESSIONID=0000ioFdEvbn3ZpzdjzB3BeGFXvr:16t5rmpto; SWBTC=PWrrZq5yzmlcxYgT+LFMjtDQ+0o=:NTllODMzMGE6MTM3Yjc3OWFjM2Y6MjFmNQ==:ETAIkA==; mobilsession=1026661130.47873.0000; dsid=MAccCv1G Cookie2: $Version=1 Transactions response HTTP/1.1 200 OK Server: FSB Date: Tue, 05 Jun 2012 00:17:16 GMT Cache-control: no-cache Transfer-encoding: chunked Content-type: application/json; charset=UTF-8 Pragma: no-cache Cache-control: no-cache, no-store, max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-language: sv-SE Set-Cookie: mobilsession=1026661130.47873.0000; expires=Tue, 05-Jun-2012 00:37:16 GMT; path=/ { \u0026#34;transactions\u0026#34;: [{ \u0026#34;date\u0026#34;: \u0026#34;2012-06-04\u0026#34;, \u0026#34;description\u0026#34;: \u0026#34;CLAS OHLSON\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;amount\u0026#34;: \u0026#34;-49,00\u0026#34; }, { \u0026#34;date\u0026#34;: \u0026#34;2012-06-04\u0026#34;, \u0026#34;description\u0026#34;: \u0026#34;KONTANTEN DIREKT\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;amount\u0026#34;: \u0026#34;-500,00\u0026#34; }, { \u0026#34;date\u0026#34;: \u0026#34;2012-06-03\u0026#34;, \u0026#34;description\u0026#34;: \u0026#34;CYKLOTEKET\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;amount\u0026#34;: \u0026#34;-480,00\u0026#34; }, ... ], \u0026#34;account\u0026#34;: { \u0026#34;availableAmount\u0026#34;: \u0026#34;12 345,67\u0026#34;, \u0026#34;creditGranted\u0026#34;: \u0026#34;0,00\u0026#34;, \u0026#34;quickbalanceSubscription\u0026#34;: { \u0026#34;id\u0026#34;: \u0026#34;3a249d57ed7263318be7dd0267b073b42e0efd6a\u0026#34;, \u0026#34;active\u0026#34;: false, \u0026#34;links\u0026#34;: { \u0026#34;next\u0026#34;: { \u0026#34;method\u0026#34;: \u0026#34;POST\u0026#34;, \u0026#34;uri\u0026#34;: \u0026#34;/v1/quickbalance/subscription/3a249d57ed7263318be7dd0267b073b42e0efd6a\u0026#34; } } }, \u0026#34;name\u0026#34;: \u0026#34;Privatkonto\u0026#34;, \u0026#34;id\u0026#34;: \u0026#34;befef7059a0a16d6c40fcf70a0bc3f22e422617a\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;accountNumber\u0026#34;: \u0026#34;903 000 000-0\u0026#34;, \u0026#34;clearingNumber\u0026#34;: \u0026#34;8327-9\u0026#34;, \u0026#34;balance\u0026#34;: \u0026#34;12 345,67\u0026#34;, \u0026#34;fullyFormattedNumber\u0026#34;: \u0026#34;8327-9,903 000 000-0\u0026#34; }, \u0026#34;numberOfTransactions\u0026#34;: 100, \u0026#34;reservedTransactions\u0026#34;: [{ \u0026#34;date\u0026#34;: \u0026#34;20120604\u0026#34;, \u0026#34;description\u0026#34;: \u0026#34;SKYDDAT BELOPP\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;amount\u0026#34;: \u0026#34;-140,10\u0026#34; }, { \u0026#34;date\u0026#34;: \u0026#34;20120604\u0026#34;, \u0026#34;description\u0026#34;: \u0026#34;SKYDDAT BELOPP\u0026#34;, \u0026#34;currency\u0026#34;: \u0026#34;SEK\u0026#34;, \u0026#34;amount\u0026#34;: \u0026#34;-600,00\u0026#34; }, ... ], \u0026#34;numberOfReservedTransactions\u0026#34;: 4, \u0026#34;moreTransactionsAvailable\u0026#34;: true, \u0026#34;links\u0026#34;: { \u0026#34;next\u0026#34;: { \u0026#34;method\u0026#34;: \u0026#34;GET\u0026#34;, \u0026#34;uri\u0026#34;: \u0026#34;/v1/engagement/transactions/befef7059a0a16d6c40fcf70a0bc3f22e422617a?transactionsPerPage=100\u0026amp;page=2\u0026#34; } } } Not much to explain here. We\u0026rsquo;ve got a list of the last 100 transactions and another list with all the reserved transactions.\nThat\u0026rsquo;s all I had time for today. I might update this post with additional information about how the dsid is generated and\u0026hellip; other stuff.\n","permalink":"https://blog.nullbyte.eu/swedbank-api/","summary":"A short documentation of the JSON API used by the Swedbank mobile application for Android.","title":"Swedbank API"},{"content":"The updated Handelsbanken app for Android and iPhone uses a new API with a new login method. The login method attempts to increase security by obfuscating some of the data. The custom keyboard matrix for example is sent as an image instead of clear text. This might make things appear more secure to the end user but doesn\u0026rsquo;t provide any significant technical security benefits. The following example will demonstrate how the new login method works.\nRequest to get the custom keyboard GET /app/init-matrix-xml?height=600\u0026amp;width=628 HTTP/1.1 Cache-Control: no-transform X-SHB-DEVICE-CLASS: app User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.2; sv-; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 X-SHB-DEVICE-MODEL: AND-4.0.2, 2.0.2, Galaxy Nexus X-SHB-MCC: 240 X-SHB-MNC: 02 X-SHB-LC: X-SHB-APP-VERSION: 2.0 X-SHB-DEVICE-ID: 123456789012345 Host: m2.handelsbanken.se Connection: Keep-Alive This is the first request that is sent to SHB when a user attempts to login. The height and width parameters define the desired size of the keyboard image returned in the response.\nAll headers starting with X-SHB are sent with every request and mostly contain information about the device that performs the request.\nThe keyboard matrix response HTTP/1.1 200 OK Date: Sat, 25 Feb 2012 20:56:29 GMT Server: Apache Cache-Control: private, proxy-revalidate Content-Language: en-US Connection: close Content-Type: text/html;charset=UTF-8 Content-Length: 10517 \u0026lt;?xml version=\u0026#34;1.0\u0026#34; encoding=\u0026#34;utf-8\u0026#34;?\u0026gt; \u0026lt;response code=\u0026#34;000\u0026#34; label=\u0026#34;OK\u0026#34; \u0026gt; \u0026lt;matrix\u0026gt; \u0026lt;matrixId\u0026gt;009013526\u0026lt;/matrixId\u0026gt; \u0026lt;matrixMetaData\u0026gt;0,5,7,11,13,14\u0026lt;/matrixMetaData\u0026gt; \u0026lt;image type=\u0026#34;png\u0026#34;\u0026gt; \u0026lt;![CDATA[ ... base64 encoded png data, example below ... ]]\u0026gt; \u0026lt;/image\u0026gt; \u0026lt;/matrix\u0026gt; \u0026lt;/response\u0026gt; What we\u0026rsquo;re looking for in the response is the matrixId tag (we\u0026rsquo;ll need to send it back to the api when we\u0026rsquo;re logging in) and the image tag.\nmatrixMetaData tells the Android/iPhone app which buttons on the custom keyboard to make clickable. Not very interesting to us so we\u0026rsquo;ll disregard it.\nMapping a password to matrix positions The image tag contains a base64 encoded transparent png image and looks something like this:\nThe image represents a 44 matrix where the numbers 0 to 9 have been placed randomly, the remaining 6 positions are empty. When a user enters a password their real password isn\u0026rsquo;t sent to the api, instead the indices of the selected numbers (in a transposed 44 matrix) are sent as a concatenated string. Let\u0026rsquo;s say the users password is 1234 and we\u0026rsquo;ve extracted the following matrix from the image:\n968 40 7 52 31 Now the only thing that remains to do is to pick out the corresponding index for every number from the matrix below and send it to the api together with the username and matrixId.\n04812 15913 261014 371115 The user enters the password 1234 and we get the positions 11,14,3,1.\nLogin request GET /bb/glss/servlet/ssco_auth4?deviceid=123456789012345\u0026amp;username=8001010000\u0026amp;matrixPos=11,14,3,1\u0026amp;matrixId=009013526\u0026amp;entryId=privpnrpinse\u0026amp;appAction=doAuthentication\u0026amp;JSP_PATH=ssse\u0026amp;language=sv\u0026amp;country=SE\u0026amp;deviceClass=app HTTP/1.1 Cache-Control: no-transform X-SHB-DEVICE-CLASS: app User-Agent: Mozilla/5.0 (Linux; U; Android 4.0.2; sv-; Galaxy Nexus Build/ICL53F) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 Mobile Safari/534.30 X-SHB-DEVICE-MODEL: AND-4.0.2, 2.0.2, Galaxy Nexus X-SHB-MCC: 240 X-SHB-MNC: 02 X-SHB-LC: X-SHB-APP-VERSION: 2.0 X-SHB-DEVICE-ID: 123456789012345 Host: m2.handelsbanken.se Connection: Keep-Alive We\u0026rsquo;re almost there! But first a short description of some of the parameters: deviceid - the device id from your Android/iPhone. Should be the same as the one in the header. username - the users\u0026rsquo; social security number in the format YYMMDDXXXX. matrixPos - the positions of the numbers we calculated earlier. matrixId - the same id that we got from our first request to the api.\nLogin response HTTP/1.1 200 Document follows Date: Sat, 25 Feb 2012 20:58:41 GMT Server: Apache Cache-Control: private, proxy-revalidate, no-cache=\u0026#34;set-cookie, set-cookie2\u0026#34; Accept-Ranges: bytes Expires: Thu, 01 Dec 1994 16:00:00 GMT Content-Language: en-US Set-Cookie: JSESSIONID=0000Y4saPX4Aq_tCypur61bkzki:C4F1745366942536000007A8000098D000000000; Path=/ Content-Length: 226 Last-Modified: Sat, 25 Feb 2012 20:58:40 GMT Connection: close Content-Type: text/xml;charset=UTF-8 \u0026lt;response code=\u0026#34;X8005\u0026#34; label=\u0026#34;Kontrollera dina uppgifter. Efter tre felaktiga kodförsök spärras koden. I Internettjänsten kan du byta din kod om den har blivit spärrad. Alternativt kan du kontakta närmaste bankkontor.\u0026#34;/\u0026gt; Yea\u0026hellip; well I don\u0026rsquo;t have a SHB account (yet) so I couldn\u0026rsquo;t get any further than this. I\u0026rsquo;ll update this post with more information about the API when I get my login credentials from SHB.\n","permalink":"https://blog.nullbyte.eu/the-new-handelsbanken-api/","summary":"How the new Handelsbanken login method works: the custom keyboard matrix is sent as an image, but that does not add real security.","title":"The new Handelsbanken API"},{"content":"Random musings about Android and other stuff.\nContact info@nullbyte.eu\nFingerprint 8731 8F13 4626 2FAE 943E 3A96 CB51 57AE 8294 673D (Ed25519, created 2015-01-01, expires 2035-01-01)\n-----BEGIN PGP PUBLIC KEY BLOCK----- mDMEVKUdQBYJKwYBBAHaRw8BAQdAK69fTHMNY5k5JL//WaDEHsYh1/UbACoKuQBp XhA8L3i0G051bGxieXRlIDxpbmZvQG51bGxieXRlLmV1Poi1BBMWCgBdFiEEhzGP E0YmL66UPjqWy1FXroKUZz0FAlSlHUAbFIAAAAAABAAObWFudTIsMi41KzEuMTIs MCwzAhsDBQklnp2ABQsJCAcCAiICBhUKCQgLAgQWAgMBAh4HAheAAAoJEMtRV66C lGc9OIsA/0ZExiBTx5UqneWjo6U+i7PfjfEP+zrrJFNETDrhaOT6AQCaK8+yySw4 VQZeBMb4XLwLIfhl1uK/0ISaZTa+uoeEAbg4BFSlHUASCisGAQQBl1UBBQEBB0DT HW0JhLGEqndtQcuOY1IEMDSosPLzmpIS7vMKLhYCfwMBCAeIlAQYFgoAPBYhBIcx jxNGJi+ulD46lstRV66ClGc9BQJUpR1AGxSAAAAAAAQADm1hbnUyLDIuNSsxLjEy LDAsMwIbDAAKCRDLUVeugpRnPQLbAP9f6hQ2sY6M1bhYJ5cyQJBDrIL4tcppqONH zn9DIuA3lQEAxldNk+E02+RLoZMU5rH9zC9nisXK6zfwBpSBnEBU+A4= =APoh -----END PGP PUBLIC KEY BLOCK----- ","permalink":"https://blog.nullbyte.eu/about/","summary":"About Nullbyte blog","title":"About"}]