31–40 of 64 posts
This is interesting as a lot of initial speculation for this attack focused on the large amount of 3rd party JS being loaded into the BA payment pages as a likely source of compromise. Instead this looks like a fairly well executed "traditional" attack on BAs CMS/Web server infrastructure. It's a good example of why even front-end infrastructure components need good protection...
Earlier quoted context omitted.
After years of watching actual users, my first guesses as to why the crooks went with a "paid certificate from Comodo" would be: 1. They genuinely didn't know about Let's Encrypt 2. Learning some new stuff to get a free cert didn't seem worth it because they're not paying anyway (at corps this is often because they have a bulk deal, or there will just be a Purchase Order so it's not their personal credit card bill, f…
As I remember, a lot of company didn't want to move to LE because their root certificate was not present in a lot of devices and those devices cannot or will not be patched to include it. Due to this, if you were, for example, on a old Android phone, pages with a LE cert would show as being insecure.
There are other examples, the Nintendo Wii U, Internet Explorer on old enough XP (but really old XP can't grok modern TLS anyway and so you're screwed) but we're quickly talking about the minority of a minority.
I'm sure the perception was there though.
Here’s the thing tho’, BA’s website exists solely to provide information on and sell their own services. Why is there third-party anything on it in the first place? Fix that and you’ll fix everything, well almost. Disclaimer: worked on ba.com in the ‘90’s
It's not a third party script. It's a copy of modernizr hosted on their own server. Someone has either hacked their CMS (Teamsite) or it's an insider.
Earlier quoted context omitted.
Although this comment in RisqIQ's report ( https://www.riskiq.com/blog/labs/magecart-british-airways-br... ) is even worse - it suggests that LetsEncrypt certs are less "legitimate" than paid ones: "Interestingly, they decided to go with a paid certificate from Comodo instead of a free LetsEncrypt certificate, likely to make it appear like a legitimate server"
After years of watching actual users, my first guesses as to why the crooks went with a "paid certificate from Comodo" would be: 1. They genuinely didn't know about Let's Encrypt 2. Learning some new stuff to get a free cert didn't seem worth it because they're not paying anyway (at corps this is often because they have a bulk deal, or there will just be a Purchase Order so it's not their personal credit card bill, f…
Earlier quoted context omitted.
It's not a third party script. It's a copy of modernizr hosted on their own server. Someone has either hacked their CMS (Teamsite) or it's an insider.
I love it how big companies still use legacy CMS like Teamsite thinking it is too expensive to move to something modern.
Earlier quoted context omitted.
Although this comment in RisqIQ's report ( https://www.riskiq.com/blog/labs/magecart-british-airways-br... ) is even worse - it suggests that LetsEncrypt certs are less "legitimate" than paid ones: "Interestingly, they decided to go with a paid certificate from Comodo instead of a free LetsEncrypt certificate, likely to make it appear like a legitimate server"
After years of watching actual users, my first guesses as to why the crooks went with a "paid certificate from Comodo" would be: 1. They genuinely didn't know about Let's Encrypt 2. Learning some new stuff to get a free cert didn't seem worth it because they're not paying anyway (at corps this is often because they have a bulk deal, or there will just be a Purchase Order so it's not their personal credit card bill, f…
Even if they are paying, the ROI on spending even a single day on learning new stuff is a long, long time if you're just buying a DV cert.
What I can't get my head around is how they managed to add their code to the .js file. Correct me if I'm wrong, but the file was hosted by BA within their CMS, yet the attackers were able to update this file to include their 22 lines of code. Does this mean the attackers had access to the CMS for BA.com or is there a step I am missing or has been deliberately omitted?
I've worked with CMS tools that allow you to add plain HTML blocks, even stuff inside . If their CMS allows this, and some marketing person had "password123" as their CMS password, and they allow access from the web (instead of intranet/VPN + 2FA requirements)...
Earlier quoted context omitted.
After years of watching actual users, my first guesses as to why the crooks went with a "paid certificate from Comodo" would be: 1. They genuinely didn't know about Let's Encrypt 2. Learning some new stuff to get a free cert didn't seem worth it because they're not paying anyway (at corps this is often because they have a bulk deal, or there will just be a Purchase Order so it's not their personal credit card bill, f…
Crap DNS not supporting CAAA records can be an issue too
As usual in DNS this works fine in the Free implementation your OS vendor included, shame about all the expensive proprietary choices that get this wrong for every single new record type.
Earlier quoted context omitted.
Getting a Comodo cert like as the attackers did is extremely non-trivial (at least for the first time). It took me upwards of 4 weeks plus a trip to an actuary and multiple calls with my CPA.
The certificate in question (for baways.com) is this one: https://crt.sh/?id=649459815 I'm going to generously assume your experience with 4 weeks and two professionals charging you fees was for an Extended Validation certificate, which as the name suggests involves a bunch more paperwork that the ordinary DV cert the article is talking about. But even for EV you've had a bunch of your time wasted by people either be…
Here’s the thing tho’, BA’s website exists solely to provide information on and sell their own services. Why is there third-party anything on it in the first place? Fix that and you’ll fix everything, well almost. Disclaimer: worked on ba.com in the ‘90’s
It's not a third party script. It's a copy of modernizr hosted on their own server. Someone has either hacked their CMS (Teamsite) or it's an insider.