How Hackers Hijacked a Bank’s Entire Online Operation
1–10 of 39 posts
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#2Oh, that's bad. Shows how critical DNS control is. They had control for some time because they used it to generate Let's Encrypt certs well ahead of the switch.
Nice pitch for Google's cloud service in there though:
"the attackers were able to change the registration simultaneously for all of the bank’s domains, redirecting them to servers the attackers had set up on Google’s Cloud Platform"
They knew switching all the bank's DNS records would bring an unpredictable load, so they went cloud for their phishing sites. Heh.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#3Re: How Hackers Hijacked a Bank’s Entire Online Operation
#4Based on their description of the bank, it appears to have been Banrisul: https://en.wikipedia.org/wiki/Banrisul
It checks all these marks:
"the firm says it’s a major Brazilian financial company with hundreds of branches, operations in the US and the Cayman Islands, 5 million customers, and more than $27 billion in assets"
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#5My bank returns an icon I chose after I enter my username, I think that would have helped me recognize something was wrong.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#6My bank returns an icon I chose after I enter my username, I think that would have helped me recognize something was wrong.
Hijacking dns means that when you connected to the bank's website you would connect to their servers first and then they could have just proxied your connection to the real servers, that image->username check wouldn't have saved you from it since the bank's servers still operated normally
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#7My bank returns an icon I chose after I enter my username, I think that would have helped me recognize something was wrong.
Hijacking dns means that when you connected to the bank's website you would connect to their servers first and then they could have just proxied your connection to the real servers, that image->username check wouldn't have saved you from it since the bank's servers still operated normally
Nginx, in proxy mode, even has a nice sub_filter where you can rewrite the response body. Pick a tag that generally occurs once, like , and replace it with arbitary text. Like maybe "".
That would be perfect...no need to recreate the target site's look and feel. Just whatever js you need to scrape the credentials.
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#8So to protect against this, don't have all your domains registered at the same place?
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#9Oh, that's bad. Shows how critical DNS control is. They had control for some time because they used it to generate Let's Encrypt certs well ahead of the switch. Nice pitch for Google's cloud service in there though: "the attackers were able to change the registration simultaneously for all of the bank’s domains, redirecting them to servers the attackers had set up on Google’s Cloud Platform" They knew switching all t…
I don't know where they got the information about the certificate being issued 5 months prior to the attack, but that's not what Certificate Transparency shows. Here's the certificate that was issued on the day of the attack[1]. Let's Encrypt hasn't issued any certificates prior to that[2].
Another fun fact: It took them about a month to revoke the certificate in question. They didn't even bother revoking a second certificate[3] (valid for a subdomain). Heh, at least this will make a good example when discussion the pros of short-lived certificates.
[1]: https://crt.sh/?id=47675898
[2]: https://crt.sh/?Identity=%25.banrisul.com.br&iCAID=16418
Re: How Hackers Hijacked a Bank’s Entire Online Operation
#10This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match.
Banks should probably be using this. Though none of my 3 banks do, or even use HSTS.
https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning
https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security