7 ms·

How Hackers Hijacked a Bank’s Entire Online Operation

62 points by bjxrn 9y ago

tyingq 9y ago
Oh, that's bad. Shows how critical DNS control is. They had control for some time because they used it to generate Let's Encrypt certs well ahead of the switch. Nice pitch for Google's cloud service in there though: "the attackers were able to change the registration simultaneously for all of the bank’s domains, redirecting them to servers the attackers had set up on Google’s Cloud Platform" They knew switching all the bank's DNS records would bring an unpredictable load, so they went cloud for their phishing sites. Heh.
- pfg 9y ago
  I don't know where they got the information about the certificate being issued 5 months prior to the attack, but that's not what Certificate Transparency shows. Here's the certificate that was issued on the day of the attack[1]. Let's Encrypt hasn't issued any certificates prior to that[2]. Another fun fact: It took them about a month to revoke the certificate in question. They didn't even bother revoking a second certificate[3] (valid for a subdomain). Heh, at least this will make a good example when discussion the pros of short-lived certificates. [1]: https://crt.sh/?id=47675898 https://crt.sh/?id=47675898 [2]: https://crt.sh/?Identity=%25.banrisul.com.br&iCAID=16418 https://crt.sh/?Identity=%25.banrisul.com.br&iCAID=16418 [3]: https://crt.sh/?id=47630635 https://crt.sh/?id=47630635
based2 9y ago
https://www.theregister.co.uk/2017/04/05/hackers_take_over_banks_dns_system/ https://www.theregister.co.uk/2017/04/05/hackers_take_over_b... https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...
tyingq 9y ago
Based on their description of the bank, it appears to have been Banrisul: https://en.wikipedia.org/wiki/Banrisul https://en.wikipedia.org/wiki/Banrisul It checks all these marks: "the firm says it’s a major Brazilian financial company with hundreds of branches, operations in the US and the Cayman Islands, 5 million customers, and more than $27 billion in assets"
emondi 9y ago
My bank returns an icon I chose after I enter my username, I think that would have helped me recognize something was wrong.
- elsombrero 9y ago
  Hijacking dns means that when you connected to the bank's website you would connect to their servers first and then they could have just proxied your connection to the real servers, that image->username check wouldn't have saved you from it since the bank's servers still operated normally
  - tyingq 9y ago
    Nginx, in proxy mode, even has a nice sub_filter where you can rewrite the response body. Pick a tag that generally occurs once, like </head>, and replace it with arbitary text. Like maybe "</head><script src="whatever"></script>". That would be perfect...no need to recreate the target site's look and feel. Just whatever js you need to scrape the credentials.
    - gcb0 9y ago
      and now the bank just have to block Google's cloud ip range.
      - tyingq 9y ago
        The idea is the bank may not notice, since the site would be functional and serving customers. Certainly, there's ways to see this is going on, but you could, for example, round robin the DNS and only attack a percentage of traffic.
  - bhtp 9y ago
    Although, if the bank realized what was happening, they could shutdown their servers immediately instead of needing to regain control of their DNS.
chiph 9y ago
So to protect against this, don't have all your domains registered at the same place?
- contingencies 9y ago
  Interesting line of thought. I suppose in theory for the sacrifice of some latency and processing overhead you could treat SSL/X.509 as busted, explicitly include multiple domains in a given page, cryptographically validate a signature supplied by each to the other (potentially both server side and in javascript), and thereby replace the SSL/X.509 assumptions of trust within the browser. All this would do is raise the bar for the attacker so they had to hijack all domains at once. By varying them dynamically you could further frustrate. You could potentially SaaS this (eg. expose an SCP/SFTP endpoint, from which you automatically deploy across disparate domain infrastructure including signatures) and/or provide a passive content-based pinning mechanism as standard, wherein the included JS or HTML raises hell if the version of a site you've received does not match that observed elsewhere. Inefficient as all hell, already attempted at different layers of the stack, but perhaps an idea whose time has come. If you do this and make lots of money buy me a beer :)
bckygldstn 9y ago
This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match. Banks should probably be using this. Though none of my 3 banks do, or even use HSTS. https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security
- user5994461 9y ago
  HSTS has plenty of issues.
  - daveguy 9y ago
    Care to elaborate?
    - user5994461 9y ago
      If there is any issue with the certificate. Your site will be entirely inaccessible: - Let's say that the certificate expire too soon (every year if you don't pay attention) and you didn't replace on time. - a domain doesn't match (it's fun with CDN, aliases and international sites with domains by countries) - a subdomain doesn't match (if you enable strict sub domains) - you test a new certificate and it's not set up right - it's broken for all non-public certificates, so never try that on test domains, internal domains or private cert chains. The issue with HSTS is that if any of this happens. Your site is entirely locked down and gives a very scary error to ALL your users. (There is no "ignore certificate" button, HSTS certs errors have a special page). It gets worse from there. HSTS is IMPOSSIBLE to disable. The only way to stop it is to send a "HSTS header: 0 duration" header along the page, that you cannot send because all connections are dropped before they are established. You are fucked! (speaking from experience :D). Last but not least: The HSTS is cached by browsers in a special way. Asking your customers to clear the cache has no effect.
      - 9y ago
btown 9y ago
Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.
- pfg 9y ago
  Yes, this is exactly the thing that HPKP would prevent from happening.
  - tyingq 9y ago
    Not supported in IE or Edge though, right? So it would still catch some end users. Banrisol currently has a message up on their home banking portal that Firefox isn't supported.
    - pfg 9y ago
      That's right, they don't have a pinning mechanism for site operators. They have something called Certificate Reputation[1] which works alongside SmartScreen and should theoretically be of use for attacks like this, but I haven't heard much about it and I don't know if it helped here. [1]: https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates/ https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-r...
- tyingq 9y ago
  Real time scanning certificate transparency logs (and DNS changes) would probably be a good idea as well. I don't know how much time they lost figuring out it was actually an attack. Oh, and using a domain registrar that's educated about social engineering...though I don't know that you have much choice in the matter for .com.br.
- bckygldstn 9y ago
  It can also be used maliciously by the attackers too: they could set HPKP to their own certificates with a 5 year expiry time, then sell them to the bank after DNS is reverted. The bank might pay to have all those chrome/firefox users back.
speeder 9y ago
Question: can bank defends themselves when the DNS attacked is client-side? I am from Brazil, and many, MANY, MAAAANY times I saw my bank webpage be slightly off, and I noticed it was fake, every single time after tracking down the problem was some DNS interception, for example once was a virus on my PC, another time was a virus on my router, another time someone used a bug on my modem to change its DNS configuration without knowing the password, another time the local ISP got hacked and their DNS servers polluted with fake IPs for all major banks. So, can the bank somehow defend itself from that? (not that they care... from what I've seen so far banks just tell the costumer that he lost the money due to his own fault...)
- pfg 9y ago
  HTTPS with HSTS would be a mitigation for the attack you describe. An attacker would not be able to obtain a valid certificate for the bank's domain, and HSTS would block SSL stripping attacks as well as prevent users from bypassing any SSL warning pages. To prevent it on the server-side (i.e. hijacked DNS or web servers) and/or to prevent rogue CAs from issuing certificates for their domain, they would need to use key pinning (for example via HPKP).
- deleted 9y ago
  [deleted]
mirages 9y ago
Instead of the cert key pinning as it's easy to obtain an SSL cert (with LE) coudn't we imagine that as banks do own EV certificates that the browser remembers them. In case the browser sees a new non-EV certificate on a site that was previously EV-certed then it throws an error/warning ?

62 points by bjxrn 9y ago

Oh, that's bad. Shows how critical DNS control is. They had control for some time because they used it to generate Let's Encrypt certs well ahead of the switch. Nice pitch for Google's cloud service in there though: "the attackers were able to change the registration simultaneously for all of the bank’s domains, redirecting them to servers the attackers had set up on Google’s Cloud Platform" They knew switching all the bank's DNS records would bring an unpredictable load, so they went cloud for their phishing sites. Heh.

pfg 9y ago
I don't know where they got the information about the certificate being issued 5 months prior to the attack, but that's not what Certificate Transparency shows. Here's the certificate that was issued on the day of the attack[1]. Let's Encrypt hasn't issued any certificates prior to that[2]. Another fun fact: It took them about a month to revoke the certificate in question. They didn't even bother revoking a second certificate[3] (valid for a subdomain). Heh, at least this will make a good example when discussion the pros of short-lived certificates. [1]: https://crt.sh/?id=47675898 https://crt.sh/?id=47675898 [2]: https://crt.sh/?Identity=%25.banrisul.com.br&iCAID=16418 https://crt.sh/?Identity=%25.banrisul.com.br&iCAID=16418 [3]: https://crt.sh/?id=47630635 https://crt.sh/?id=47630635

based2 9y ago

https://www.theregister.co.uk/2017/04/05/hackers_take_over_banks_dns_system/ https://www.theregister.co.uk/2017/04/05/hackers_take_over_b... https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions https://en.wikipedia.org/wiki/Domain_Name_System_Security_Ex...

tyingq 9y ago

Based on their description of the bank, it appears to have been Banrisul: https://en.wikipedia.org/wiki/Banrisul https://en.wikipedia.org/wiki/Banrisul It checks all these marks: "the firm says it’s a major Brazilian financial company with hundreds of branches, operations in the US and the Cayman Islands, 5 million customers, and more than $27 billion in assets"

emondi 9y ago

My bank returns an icon I chose after I enter my username, I think that would have helped me recognize something was wrong.

elsombrero 9y ago
Hijacking dns means that when you connected to the bank's website you would connect to their servers first and then they could have just proxied your connection to the real servers, that image->username check wouldn't have saved you from it since the bank's servers still operated normally
- tyingq 9y ago
  Nginx, in proxy mode, even has a nice sub_filter where you can rewrite the response body. Pick a tag that generally occurs once, like </head>, and replace it with arbitary text. Like maybe "</head><script src="whatever"></script>". That would be perfect...no need to recreate the target site's look and feel. Just whatever js you need to scrape the credentials.
  - gcb0 9y ago
    and now the bank just have to block Google's cloud ip range.
    - tyingq 9y ago
      The idea is the bank may not notice, since the site would be functional and serving customers. Certainly, there's ways to see this is going on, but you could, for example, round robin the DNS and only attack a percentage of traffic.
- bhtp 9y ago
  Although, if the bank realized what was happening, they could shutdown their servers immediately instead of needing to regain control of their DNS.

chiph 9y ago

So to protect against this, don't have all your domains registered at the same place?

contingencies 9y ago
Interesting line of thought. I suppose in theory for the sacrifice of some latency and processing overhead you could treat SSL/X.509 as busted, explicitly include multiple domains in a given page, cryptographically validate a signature supplied by each to the other (potentially both server side and in javascript), and thereby replace the SSL/X.509 assumptions of trust within the browser. All this would do is raise the bar for the attacker so they had to hijack all domains at once. By varying them dynamically you could further frustrate. You could potentially SaaS this (eg. expose an SCP/SFTP endpoint, from which you automatically deploy across disparate domain infrastructure including signatures) and/or provide a passive content-based pinning mechanism as standard, wherein the included JS or HTML raises hell if the version of a site you've received does not match that observed elsewhere. Inefficient as all hell, already attempted at different layers of the stack, but perhaps an idea whose time has come. If you do this and make lots of money buy me a beer :)

bckygldstn 9y ago

This is what Public Key Pinning is designed to mitigate: you send hashes of your certificate chain with responses, and the browser will disallow subsequent requests for the same domain if the hashes don't match. Banks should probably be using this. Though none of my 3 banks do, or even use HSTS. https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Public_Key_Pinning https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security

user5994461 9y ago
HSTS has plenty of issues.
- daveguy 9y ago
  Care to elaborate?
  - user5994461 9y ago
    If there is any issue with the certificate. Your site will be entirely inaccessible: - Let's say that the certificate expire too soon (every year if you don't pay attention) and you didn't replace on time. - a domain doesn't match (it's fun with CDN, aliases and international sites with domains by countries) - a subdomain doesn't match (if you enable strict sub domains) - you test a new certificate and it's not set up right - it's broken for all non-public certificates, so never try that on test domains, internal domains or private cert chains. The issue with HSTS is that if any of this happens. Your site is entirely locked down and gives a very scary error to ALL your users. (There is no "ignore certificate" button, HSTS certs errors have a special page). It gets worse from there. HSTS is IMPOSSIBLE to disable. The only way to stop it is to send a "HSTS header: 0 duration" header along the page, that you cannot send because all connections are dropped before they are established. You are fucked! (speaking from experience :D). Last but not least: The HSTS is cached by browsers in a special way. Asking your customers to clear the cache has no effect.
    - 9y ago

btown 9y ago

Could certificate pinning have mitigated the damage? Although service would have been denied until the DNS was back under control, that's better than leaking credentials and cards and security questions and account balances.

pfg 9y ago
Yes, this is exactly the thing that HPKP would prevent from happening.
- tyingq 9y ago
  Not supported in IE or Edge though, right? So it would still catch some end users. Banrisol currently has a message up on their home banking portal that Firefox isn't supported.
  - pfg 9y ago
    That's right, they don't have a pinning mechanism for site operators. They have something called Certificate Reputation[1] which works alongside SmartScreen and should theoretically be of use for attacks like this, but I haven't heard much about it and I don't know if it helped here. [1]: https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-reputation-a-novel-approach-for-protecting-users-from-fraudulent-certificates/ https://blogs.msdn.microsoft.com/ie/2014/03/10/certificate-r...
tyingq 9y ago
Real time scanning certificate transparency logs (and DNS changes) would probably be a good idea as well. I don't know how much time they lost figuring out it was actually an attack. Oh, and using a domain registrar that's educated about social engineering...though I don't know that you have much choice in the matter for .com.br.
bckygldstn 9y ago
It can also be used maliciously by the attackers too: they could set HPKP to their own certificates with a 5 year expiry time, then sell them to the bank after DNS is reverted. The bank might pay to have all those chrome/firefox users back.

speeder 9y ago

Question: can bank defends themselves when the DNS attacked is client-side? I am from Brazil, and many, MANY, MAAAANY times I saw my bank webpage be slightly off, and I noticed it was fake, every single time after tracking down the problem was some DNS interception, for example once was a virus on my PC, another time was a virus on my router, another time someone used a bug on my modem to change its DNS configuration without knowing the password, another time the local ISP got hacked and their DNS servers polluted with fake IPs for all major banks. So, can the bank somehow defend itself from that? (not that they care... from what I've seen so far banks just tell the costumer that he lost the money due to his own fault...)

pfg 9y ago
HTTPS with HSTS would be a mitigation for the attack you describe. An attacker would not be able to obtain a valid certificate for the bank's domain, and HSTS would block SSL stripping attacks as well as prevent users from bypassing any SSL warning pages. To prevent it on the server-side (i.e. hijacked DNS or web servers) and/or to prevent rogue CAs from issuing certificates for their domain, they would need to use key pinning (for example via HPKP).
deleted 9y ago
[deleted]

mirages 9y ago

Instead of the cert key pinning as it's easy to obtain an SSL cert (with LE) coudn't we imagine that as banks do own EV certificates that the browser remembers them. In case the browser sees a new non-EV certificate on a site that was previously EV-certed then it throws an error/warning ?