Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
How Hackers Hijacked a Bank’s Entire Online Operation
11–20 of 39 posts
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#12Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
Yes, this is exactly the thing that HPKP would prevent from happening.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#13Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
Real time scanning certificate transparency logs (and DNS changes) would probably be a good idea as well. I don't know how much time they lost figuring out it was actually an attack. Oh, and using a domain registrar that's educated about social engineering...though I don't know that you have much choice in the matter for .com.br.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#14Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
Yes, this is exactly the thing that HPKP would prevent from happening.
Not supported in IE or Edge though, right? So it would still catch some end users.
Banrisol currently has a message up on their home banking portal that Firefox isn't supported.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#15Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
It can also be used maliciously by the attackers too: they could set HPKP to their own certificates with a 5 year expiry time, then sell them to the bank after DNS is reverted. The bank might pay to have all those chrome/firefox users back.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#16This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match. Banks should probably be using this. Though none of my 3 banks do, or even use HSTS. https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
HSTS has plenty of issues.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#17This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match. Banks should probably be using this. Though none of my 3 banks do, or even use HSTS. https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
HSTS has plenty of issues.
Care to elaborate?
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#18Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
It can also be used maliciously by the attackers too: they could set HPKP to their own certificates with a 5 year expiry time, then sell them to the bank after DNS is reverted. The bank might pay to have all those chrome/firefox users back.
That is a truly brilliant use of certificate pinning and strict transport policy.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#19Earlier quoted context omitted.
Yes, this is exactly the thing that HPKP would prevent from happening.
Not supported in IE or Edge though, right? So it would still catch some end users. Banrisol currently has a message up on their home banking portal that Firefox isn't supported.
That's right, they don't have a pinning mechanism for site operators. They have something called Certificate Reputation[1] which works alongside SmartScreen and should theoretically be of use for attacks like this, but I haven't heard much about it and I don't know if it helped here.
[1]: https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-r...
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#20This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match. Banks should probably be using this. Though none of my 3 banks do, or even use HSTS. https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
HSTS has plenty of issues.
For sure HPKP has plenty of issues, but with HSTS you just need to commit to using HTTPS for the next X days. That seems pretty doable, especially with free automated certificates or CAs with enterprise support.