Secure Banking Zone Module (BankPage)

1. Overview

The Secure Banking Zone module provides protection against phishing and fraudulent banking websites by managing a curated list of known legitimate banking domains.

The module retrieves its primary data from a remote JSON source (by default a MISP Warninglist) and allows the user to:

  • Manually update the banking domain list
  • Enable or disable automatic updates every 6 hours
  • Maintain a local whitelist of trusted domains
  • Deploy the validated list to a system-wide location

The module is UI-driven and delegates network and update operations to the backend layer.

2. User Interface Structure

2.1 Header

The page uses a security-themed header consistent with other protection modules.

  • Container: Gtk::Box with CSS class secure-headerbar
  • Centered title label with CSS class secure-header-title

Displayed title:

🏦 Secure Banking Zone

2.2 Source URL Configuration

The module provides a configurable URL input field used as the source for the banking domain list.

Default value:

https://raw.githubusercontent.com/MISP/misp-warninglists/main/lists/bank-website/list.json

This URL can be modified by the user to point to an alternative compatible JSON source.

2.3 Manual Update Control

A manual refresh button allows the user to explicitly download and update the list.

  • Label: 🔄 Update list
  • Action handler: on_refresh_clicked()

During an update operation, the button is temporarily disabled to prevent concurrent executions.

2.4 Automatic Update Toggle

The module includes a toggle switch to enable or disable automatic list updates every 6 hours.

When enabled:

  • A recurring GLib timer is started
  • The update status is reflected in the UI
  • The preference is persisted to disk

When disabled, any active timer is disconnected.

2.5 Whitelist Controls

The whitelist allows the user to explicitly trust selected domains.

  • Text entry for domain insertion
  • Add button to persist the domain

Whitelisted domains are excluded from the main banking list display.

2.6 List Display Areas

The module renders two read-only text areas:

  • Known banking domains
  • User whitelist

Both views are scrollable, non-editable, and word-wrapped.

3. Manual Update Workflow

When the user triggers a manual update:

  1. The UI displays a download-in-progress status
  2. The refresh button is disabled
  3. The backend update routine is executed in a worker thread
  4. UI updates are marshaled back to the GTK main loop

The update operation is performed through:

Backend::instance().updateBankListFromURL(url)

4. Automatic Update Workflow

Automatic updates are managed via a GLib timeout scheduled every 6 hours.

Each execution:

  • Invokes the same backend update routine as a manual refresh
  • Updates the local cache
  • Refreshes the UI
  • Updates the status label with a timestamp

The timer remains active as long as the feature is enabled.

5. Bank List Processing

5.1 Local Cache

The banking list is read from a user-level cache file:

~/.local/share/BastionGuard/banks.json

The JSON format is expected to contain an array of domain values.

5.2 Normalization and Filtering

Before display:

  • Leading dots (.) are removed from domain names
  • Domains present in the whitelist are excluded

The final count of visible domains is displayed at the end of the list.

6. System Deployment

After a successful update, the module attempts to deploy the list to a system-wide data directory:

/usr/share/BastionGuard/data/bank/banks.json

This operation requires elevated privileges and is performed using pkexec.

A version metadata file is also written, containing the source URL and update timestamp.

7. Whitelist Persistence

The whitelist is stored locally as a JSON array:

~/.config/BastionGuard/whitelist.json

Whitelist changes are immediately persisted and reflected in the UI.

8. Settings Persistence

The automatic update preference is stored in:

~/.config/BastionGuard/settings.json

Stored key:

"auto_update": true | false

9. Threading and UI Safety

  • Network and file operations are executed in background threads
  • All UI updates are scheduled on the GTK main loop
  • Timers are explicitly managed to avoid duplicate executions

10. Security Considerations

  • The trusted banking list is advisory and intended to reduce phishing risk
  • Privilege escalation is limited to controlled file copy operations
  • The whitelist represents an explicit user trust decision
  • Failure to elevate privileges does not interrupt application execution
Published on:
Last updated on: