This is a good advert for using sub-resource integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
British Airways: Suspect code that hacked fliers ‘found’
41–50 of 64 posts
Re: British Airways: Suspect code that hacked fliers ‘found’
#42Earlier quoted context omitted.
It's not a third party script. It's a copy of modernizr hosted on their own server. Someone has either hacked their CMS (Teamsite) or it's an insider.
I love it how big companies still use legacy CMS like Teamsite thinking it is too expensive to move to something modern.
Uhh, yeah, it wasn’t such a bad choice 20 years ago. I had no idea they were still using it lol. Interwoven we called it back then.
Re: British Airways: Suspect code that hacked fliers ‘found’
#43Earlier quoted context omitted.
The certificate in question (for baways.com) is this one: https://crt.sh/?id=649459815 I'm going to generously assume your experience with 4 weeks and two professionals charging you fees was for an Extended Validation certificate, which as the name suggests involves a bunch more paperwork that the ordinary DV cert the article is talking about. But even for EV you've had a bunch of your time wasted by people either be…
This was a domain that didn't previously exist, right? Hence this falls just into the general category of phishing domains, rather than anything malicious happening to get a cert issued.
Yes, the crooks probably "legitimately" owned this name (given that their line of work is stealing credit card details it seems plausible they'd have used stolen cards to buy the domain, but maybe not)
It probably wouldn't have tripped as "phishing" unless the crooks were dumb enough to host false BA branding on it, rather than just an API to accept the stolen credentials.
Because "BA" is so short and non-specific I'm doubtful that tools like Facebook's Certificate Transparency based "phishing warning" would have been useful here. And if you were an over-worked BA employee given 500 CT "phishing" warnings a day, what would you do? Visit the site in Chrome maybe? Then you see it has a generic holding page, no sign of phishing, you file it as a false positive, move on? How are you supposed to know it's being used by crooks?
Re: British Airways: Suspect code that hacked fliers ‘found’
#44Re: British Airways: Suspect code that hacked fliers ‘found’
#45Earlier quoted context omitted.
As I remember, a lot of company didn't want to move to LE because their root certificate was not present in a lot of devices and those devices cannot or will not be patched to include it. Due to this, if you were, for example, on a old Android phone, pages with a LE cert would show as being insecure.
That's a pretty old/ crappy Android phone though, either Froyo (or older) or a Gingerbread without patches. There are other examples, the Nintendo Wii U, Internet Explorer on old enough XP (but really old XP can't grok modern TLS anyway and so you're screwed) but we're quickly talking about the minority of a minority. I'm sure the perception was there though.
Wow, the Wii U is one? No wonder I had a bunch of Wii U users reporting my site stopped working when I started forcing HTTPS.
"Minority of a minority", maybe, but I still got around five tweets about it when it happened; more than most other changes I make.
Re: British Airways: Suspect code that hacked fliers ‘found’
#46Maybe some sort of one use creditcard numbers should be used so that if hackers steal them they're worthless, and have a centralized service for providing those one use generated numbers...
Re: British Airways: Suspect code that hacked fliers ‘found’
#47Genuine question... Why the scare quotes around the word "found"? I'm assuming "hacked fliers" refers to the people who had their details stolen. So how exactly did they "find" the "suspect code"? English is my first language, but I'm really struggling to grok this headline.
From the BBC: > Quotation marks should be single: > in headlines and cross-heads (eg: UK ‘to leave EU’); in promo text and for quotes within quotes (eg: Tom Bone said: “They say, ‘The Labour Party is finished’ before every election”) and inside quote boxes (eg: They sprayed ‘go home’ on our front door – Sandra Harris). > In headlines where the attribution is clear, do not include unnecessary quote marks (eg Britain w…
Thanks for the clarification. I've re-read this headline a dozen times and it finally makes sense.
By removing the phrase "that hacked fliers" you're left with "Suspect code 'found'". Which is the core of the statement. But that doesn't give enough context so the reference to the fliers was added.
I also think they wanted to lead with "British Airways" so a bit of contortion was necessary.
Re: British Airways: Suspect code that hacked fliers ‘found’
#48What I can't get my head around is how they managed to add their code to the .js file. Correct me if I'm wrong, but the file was hosted by BA within their CMS, yet the attackers were able to update this file to include their 22 lines of code. Does this mean the attackers had access to the CMS for BA.com or is there a step I am missing or has been deliberately omitted?
CMSes get hacked every day now. It's the new entry level thing to probe for and hack into. Then the fact that most CMSes these days allow some form of creating code blocks in the content or injecting code into the templates, and it's not very hard to believe.
Re: British Airways: Suspect code that hacked fliers ‘found’
#49Why not a quick scan twice a day if all static content looking for ip addresses and domains against a whitelist of allowed domains? This would have found the issue same day.
Re: British Airways: Suspect code that hacked fliers ‘found’
#50If I had had the developer console open in chrome while going through the booking, would I have seen in the network tab the posting to baways.com...
I think the answer is yes.
So I wonder why this issue was not reported earlier by some techie guy who's just booked a flight