Now here is an IT hacking horror story for you! Kaspersky's blog tells the tale of a bank in Brasil who lost their full online presense and had all of its 36 domains, corporate email and DNS seized by a criminal hacker group who then used the websites to drop malware on the unsuspecting bank customers. Ouch.
Once Kaspersky Lab researchers Fabio Assolini and Dmitry Bestuzhev dug under the covers of this attack, they discovered that the attackers had extended their operations to nine other institutions worldwide.
At the outset, this looked like a site hijacking, but Assolini and Bestuzhev quickly discovered that much more was happening. The caper was uncovered last Oct. 22 when it was apparent the bank’s website was serving malware to each of its visitors. The malware was a Java file tucked inside a .zip archive loaded into the index file.
The depths of the compromise quickly became apparent. All 36 bank domains were under the attackers’ control, including the online, mobile, point-of-sale, financing and acquisitions, and more. Digging deeper, the researchers found the homepage was displaying a valid SSL certificate from Let’s Encrypt, a free Certificate Authority.
The researchers also reported finding phishing pages loaded onto bank domains trying to induce victims to enter payment card information.
“Imagine if one employee is phished and the attackers had access to the DNS tables, man that would be very bad,” Bestuzhev said. “If DNS was under control of the criminals, you’re screwed.”
The researchers stressed the importance of securing the DNS infrastructure and the need to take advantage of features such as two-factor authentication, which most registrars offer, but few customers use, the researchers said. “That’s exactly what happened with this bank,” Assolini said.
Their line of thought then follows that the cybercriminals used a spearphishing attack targeting an employee who had access to the banks DNS tables using the name of the certificate authority. Even IT people can get caught out now and then, and need advanced security awareness training to keep them alert.
Here is the whole story at Threatpost. Interesting reading to say the least.
