Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

British Airways: Suspect code that hacked fliers ‘found’

bbc.co.uk

Post reply on HN
Print view View original

11–20 of 64 posts

Re: British Airways: Suspect code that hacked fliers ‘found’

#11

Post by tomalpha »

raesene9 wrote: post #7

This is interesting as a lot of initial speculation for this attack focused on the large amount of 3rd party JS being loaded into the BA payment pages as a likely source of compromise. Instead this looks like a fairly well executed "traditional" attack on BAs CMS/Web server infrastructure. It's a good example of why even front-end infrastructure components need good protection...

The write-up is a little unclear, at least to me. I read it as being that it was a third-party JS attack. At least of a sort - e.g. a compromised third-party package downloaded and then used by BA? [0]

[0] https://cdn.riskiq.com/wp-content/uploads/2018/09/Webp.net-r...

Re: British Airways: Suspect code that hacked fliers ‘found’

#12

Post by jackweirdy »

jspash wrote: post #8

Genuine question... Why the scare quotes around the word "found"? I'm assuming "hacked fliers" refers to the people who had their details stolen. So how exactly did they "find" the "suspect code"? English is my first language, but I'm really struggling to grok this headline.

From the BBC:

> Quotation marks should be single:

> in headlines and cross-heads (eg: UK ‘to leave EU’); in promo text and for quotes within quotes (eg: Tom Bone said: “They say, ‘The Labour Party is finished’ before every election”) and inside quote boxes (eg: They sprayed ‘go home’ on our front door – Sandra Harris).

> In headlines where the attribution is clear, do not include unnecessary quote marks (eg Britain won’t hold referendum, says PM rather than Britain "won’t hold referendum", says PM).

> They should be double:

> outside the categories listed above - on the ticker, in regular text, summaries and picture captions. Also, at first use of phrases such as “mad cow disease” or “road rage”. (But quotation marks will be single if the phrase comes inside a direct quotation (eg: The minister said: “The spread of ‘mad cow disease’ had ruined thousands of lives.”) Either way, no punctuation is required after the first reference.

https://www.bbc.co.uk/academy/en/articles/art201307021121335...

Re: British Airways: Suspect code that hacked fliers ‘found’

#13

Post by gaius »

Here’s the thing tho’, BA’s website exists solely to provide information on and sell their own services. Why is there third-party anything on it in the first place? Fix that and you’ll fix everything, well almost.

Disclaimer: worked on ba.com in the ‘90’s

Re: British Airways: Suspect code that hacked fliers ‘found’

#14

Post by invalidusernam3 »

gaius wrote: post #13

Here’s the thing tho’, BA’s website exists solely to provide information on and sell their own services. Why is there third-party anything on it in the first place? Fix that and you’ll fix everything, well almost. Disclaimer: worked on ba.com in the ‘90’s

I would guess third party payment gateway and tracking/analytics. It's doubtful that BA would undertake the task of creating bespoke systems for either of those

Re: British Airways: Suspect code that hacked fliers ‘found’

#15

Post by mpclark »

jspash wrote: post #8

Genuine question... Why the scare quotes around the word "found"? I'm assuming "hacked fliers" refers to the people who had their details stolen. So how exactly did they "find" the "suspect code"? English is my first language, but I'm really struggling to grok this headline.

It's because they are reporting that somebody thinks they've found the dodgy code, rather than a statement of fact that the dodgy code has been found.

Re: British Airways: Suspect code that hacked fliers ‘found’

#16

Post by daddylonglegs »

raesene9 wrote: post #7

This is interesting as a lot of initial speculation for this attack focused on the large amount of 3rd party JS being loaded into the BA payment pages as a likely source of compromise. Instead this looks like a fairly well executed "traditional" attack on BAs CMS/Web server infrastructure. It's a good example of why even front-end infrastructure components need good protection...

Previous attacks by this Magecart group did go through third parties:

https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac...

I think the underlying problems are the same either way. In all these attacks the customer loads a page with dozens of scripts from at least a dozen servers and he or she has to trust them all.

Speaking as someone who frequently has to reload the checkout page five or more times while authorising successive waves of third party servers in Request Policy and NoScript - there is no way to tell. Any one could be the source of an attack or the destination for malicious exfiltration.

Should I do a geoip lookup on every sever on a page when shopping on-line? Baways.com looks like a perfectly plausible server for yet another piece of cruft, or analytics, or some baroque chain of payment services providers.

Since the customer has no way of telling we are depending on the suppliers noticing that the website they are serving has changed. Otherwise it's up to the banks to find the common thread in each new wave of fraudulent payments, oops.

The current sorry state of security online can only be fixed by the suppliers. I think that doing things properly will necessarily involve more respect for customers and less adtech/ spyware so that payment processes are better separated from everything else on the web

Re: British Airways: Suspect code that hacked fliers ‘found’

#17

Post by robjan »

gaius wrote: post #13

Here’s the thing tho’, BA’s website exists solely to provide information on and sell their own services. Why is there third-party anything on it in the first place? Fix that and you’ll fix everything, well almost. Disclaimer: worked on ba.com in the ‘90’s

It's not a third party script. It's a copy of modernizr hosted on their own server. Someone has either hacked their CMS (Teamsite) or it's an insider.

Re: British Airways: Suspect code that hacked fliers ‘found’

#18

Post by cm2187 »

kevingadd wrote: post #9
jsty wrote: post #2

"According to RiskIQ, they even went so far as to acquire a Secure Socket Layer (SSL) certificate - which suggests to web browsers that a web page is safe to use." The BBC's technology reporting usually isn't that bad for a mainstream audience, but this is just egregious. On the one hand, perpetuating the myth that "anything I do on this page must be super safe because there's a green padlock", and on the other compl…

Getting a Comodo cert like as the attackers did is extremely non-trivial (at least for the first time). It took me upwards of 4 weeks plus a trip to an actuary and multiple calls with my CPA.

You are referring to an extended validation certificate I presume? A regular certificate you can get in a few minutes with a credit card and an email validation unless things have changed in the last two years.

Re: British Airways: Suspect code that hacked fliers ‘found’

#19

Post by fabiosussetto »

How's that modified modernizerjs script ended up in there? I mean, it must have been included directly from the BA website? I also wonder how can BA be so sure about the dates this was stealing payment data, since this was apparently a frontend attack. Maybe they somehow know when that js script had been modified?

Re: British Airways: Suspect code that hacked fliers ‘found’

#20

Post by ID1452319 »

What I can't get my head around is how they managed to add their code to the .js file.

Correct me if I'm wrong, but the file was hosted by BA within their CMS, yet the attackers were able to update this file to include their 22 lines of code.

Does this mean the attackers had access to the CMS for BA.com or is there a step I am missing or has been deliberately omitted?

Post reply on HN