Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

British Airways: Suspect code that hacked fliers ‘found’

bbc.co.uk

Post reply on HN
Print view View original

51–60 of 64 posts

Re: British Airways: Suspect code that hacked fliers ‘found’

#51

Post by strictnein »

bobthedino wrote: post #5
jsty wrote: post #2

"According to RiskIQ, they even went so far as to acquire a Secure Socket Layer (SSL) certificate - which suggests to web browsers that a web page is safe to use." The BBC's technology reporting usually isn't that bad for a mainstream audience, but this is just egregious. On the one hand, perpetuating the myth that "anything I do on this page must be super safe because there's a green padlock", and on the other compl…

Although this comment in RisqIQ's report ( https://www.riskiq.com/blog/labs/magecart-british-airways-br... ) is even worse - it suggests that LetsEncrypt certs are less "legitimate" than paid ones: "Interestingly, they decided to go with a paid certificate from Comodo instead of a free LetsEncrypt certificate, likely to make it appear like a legitimate server"

Ehhh... very few (if any?) major orgs that take credit cards use Letsencrypt. Many, many malicious actors do. It's the go to cert for securing malicious sites

A security team reviewing that baways.com site would definitely make note of the fact that it was using letsencrypt.

Re: British Airways: Suspect code that hacked fliers ‘found’

#52

Post by bradvl »

Marcus Greenwood (Founder of UB.IO) put out some good analysis of this at https://medium.com/the-automator/so-about-that-ba-hack-a82e5...

And there's more analysis at http://huagati.blogspot.com/2018/05/things-you-probably-dont...

And the fake BAWAYs server is still up - https://twitter.com/inventur_es/status/1039519364733497344

Re: British Airways: Suspect code that hacked fliers ‘found’

#53

Post by tialaramex »

Zarel wrote: post #45
tialaramex wrote: post #32

Earlier quoted context omitted.

That's a pretty old/ crappy Android phone though, either Froyo (or older) or a Gingerbread without patches. There are other examples, the Nintendo Wii U, Internet Explorer on old enough XP (but really old XP can't grok modern TLS anyway and so you're screwed) but we're quickly talking about the minority of a minority. I'm sure the perception was there though.

Wow, the Wii U is one? No wonder I had a bunch of Wii U users reporting my site stopped working when I started forcing HTTPS. "Minority of a minority", maybe, but I still got around five tweets about it when it happened; more than most other changes I make.

Just to be clear, you're serious right? Because yes, the Wii U has a browser, it hasn't been updated (because the Wii U is basically abandoned at this point) and it never did trust DST Root CA X3, which is the root via which trust to Let's Encrypt was bootstrapped in older browsers. Don't happen to have links for any of those tweets do you? I'd be happy to have an actual example of a user who ran into this for real (nobody can fix it, but it's good to be reminded they exist)

Re: British Airways: Suspect code that hacked fliers ‘found’

#54

Post by strictnein »

bradvl wrote: post #52

Marcus Greenwood (Founder of UB.IO) put out some good analysis of this at https://medium.com/the-automator/so-about-that-ba-hack-a82e5... And there's more analysis at http://huagati.blogspot.com/2018/05/things-you-probably-dont... And the fake BAWAYs server is still up - https://twitter.com/inventur_es/status/1039519364733497344

Ehh, Marcus's analysis is off on some of the details and his prediction of a 3rd party JS (which he strangely originally kept referring to as XSS, which makes me question his thoughts even more) ended up being wrong.

Re: British Airways: Suspect code that hacked fliers ‘found’

#55

Post by strictnein »

strictnein wrote: post #51
bobthedino wrote: post #5

Earlier quoted context omitted.

Although this comment in RisqIQ's report ( https://www.riskiq.com/blog/labs/magecart-british-airways-br... ) is even worse - it suggests that LetsEncrypt certs are less "legitimate" than paid ones: "Interestingly, they decided to go with a paid certificate from Comodo instead of a free LetsEncrypt certificate, likely to make it appear like a legitimate server"

Ehhh... very few (if any?) major orgs that take credit cards use Letsencrypt. Many, many malicious actors do. It's the go to cert for securing malicious sites A security team reviewing that baways.com site would definitely make note of the fact that it was using letsencrypt.

Really not understanding the downvotes here. This isn't a judgement on letsencrypt. It's a reflection of reality.

Letsencrypt certs are widely used by malicious actors. Thus one not being used is noteworthy and why RiskIQ made note of it.

If someone who's downvoting me would like to show some examples of major websites from Fortune 100s or large international firms (like BA) using letsencrypt certs to collect payment info, then by all means, please do.

Re: British Airways: Suspect code that hacked fliers ‘found’

#56

Post by dcbadacd »

scandox wrote: post #34
tialaramex wrote: post #24

Earlier quoted context omitted.

After years of watching actual users, my first guesses as to why the crooks went with a "paid certificate from Comodo" would be: 1. They genuinely didn't know about Let's Encrypt 2. Learning some new stuff to get a free cert didn't seem worth it because they're not paying anyway (at corps this is often because they have a bulk deal, or there will just be a Purchase Order so it's not their personal credit card bill, f…

Crap DNS not supporting CAAA records can be an issue too

Speaking of crap DNS, OVH's webUI does not have DNS CAA support and their support claims they don't support it but their API is able to add the record and it works.

It's a pity it isn't just a TXT record.

Re: British Airways: Suspect code that hacked fliers ‘found’

#57

Post by slow_donkey »

jsty wrote: post #2

"According to RiskIQ, they even went so far as to acquire a Secure Socket Layer (SSL) certificate - which suggests to web browsers that a web page is safe to use." The BBC's technology reporting usually isn't that bad for a mainstream audience, but this is just egregious. On the one hand, perpetuating the myth that "anything I do on this page must be super safe because there's a green padlock", and on the other compl…

>According to RiskIQ, they also acquired a Secure Socket Layer (SSL) certificate - which suggests to web browsers, not always accurately, that a web page is safe to use

Looks like the article got updated

Re: British Airways: Suspect code that hacked fliers ‘found’

#58

Post by blacksmith_tb »

ID1452319 wrote: post #20

What I can't get my head around is how they managed to add their code to the .js file. Correct me if I'm wrong, but the file was hosted by BA within their CMS, yet the attackers were able to update this file to include their 22 lines of code. Does this mean the attackers had access to the CMS for BA.com or is there a step I am missing or has been deliberately omitted?

I see BA is using Google Tag Manager, which is another handy way to inject $RANDOM_JS into a site.

Re: British Airways: Suspect code that hacked fliers ‘found’

#59

Post by jandrese »

ID1452319 wrote: post #31
raesene9 wrote: post #7

This is interesting as a lot of initial speculation for this attack focused on the large amount of 3rd party JS being loaded into the BA payment pages as a likely source of compromise. Instead this looks like a fairly well executed "traditional" attack on BAs CMS/Web server infrastructure. It's a good example of why even front-end infrastructure components need good protection...

Indeed. Also, don't store JavaScript files within your CMS.

But if someone adds a element to some template in your CMS and it doesn't get filtered out...

It would be nice if browsers implemented an tag and refuse to parse anything below it as a script. It would raise the bar on injection attacks for very little additional complexity. Slightly troublesome in that all of your buttons and similar would have to just call already defined functions (no inline code), but that's a reasonable tradeoff I think.

Re: British Airways: Suspect code that hacked fliers ‘found’

#60

Post by detaro »

jandrese wrote: post #59
ID1452319 wrote: post #31

Earlier quoted context omitted.

Indeed. Also, don't store JavaScript files within your CMS.

But if someone adds a element to some template in your CMS and it doesn't get filtered out... It would be nice if browsers implemented an tag and refuse to parse anything below it as a script. It would raise the bar on injection attacks for very little additional complexity. Slightly troublesome in that all of your buttons and similar would have to just call already defined functions (no inline code), but that's a re…

Content Security Policy can do things very close to that. You can't say "don't load anything after this", but you can whitelist script sources and forbid inline code.
Post reply on HN