Cybercriminals Seized Control of Brazilian Bank for 5 Hours

itman · Apr 4, 2017

Sophisticated heist compromised major bank's entire DNS infrastructure.

KASPERSKY SECURITY SUMMIT 2017 – St. Maarten – Cybercriminals for five hours one day last fall took over the online operations of a major bank and intercepted all of its online banking, mobile, point-of-sale, ATM, and investment transactions in an intricate attack that employed valid SSL digital certificates and Google Cloud to support the phony bank infrastructure.

The attackers compromised 36 of the bank's domains, including its internal email and FTP servers, and captured electronic transactions during a five-hour period on Oct. 22, 2016. Researchers estimate that hundreds of thousands or possibly millions of the bank's customers across 300 cities worldwide, including in the US, may have been victimized during the hijack window when customers accessing the bank's online services were hit with malware posing as a Trusteer banking security plug-in application. The malware harvested login credentials, email contact lists, and email and FTP credentials, and disabled anti-malware software on the victim's machine to avoid detection.

Dmitry Bestuzhev, director of Kaspersky Lab's research and analysis team in Latin America, says the attackers were able to pull off the heist by compromising the bank's Domain Name Service (DNS) provider Registro.br and gained administrative control of the bank's DNS account. The attackers also obtained valid digital certificates for their poser bank's servers via Let's Encrypt, a legitimate HTTPS certificate provider, to dupe customers who, when they logged into their online accounts, were redirected to the phony systems. Meanwhile, the bank, which has $25 billion in assets, 5 million customers worldwide, and 500 branches in Brazil, Argentina, the US, and the Cayman Islands, was locked out of its own network and systems during the attack.

"As far as we know, this type of attack has never happened before on such a big scale," Bestuzhev says. Kaspersky Lab did not disclose the name of the victim bank.
Click to expand...

http://www.darkreading.com/attacks-...of-brazilian-bank-for-5-hours/d/d-id/1328549?

itman · Apr 4, 2017

A footnote to this attack is that if you are not using something akin to EMET's certificate pinning where you pin your bank's web site URL to its valid root CA store certificate, you should always visually verify that the certificate chain of the bank's web site points to correct root CA store certificate upon access to the bank's web site. You can get the thumbprint of the bank's root CA store certificate here: https://www.grc.com/fingerprints.htm?domain=store.www.href.com . Store the thumbprint and use it to compare it to the one shown for bank's root CA store certificate upon access to the bank's web site

plat1098 · Apr 4, 2017

Jeez, sort of like armed robbery in real life with a huge haul, right? Funding what agenda, I wonder. My smaller bank is based in the Caribbean, surprising that such a large banking conglomerate fell victim to this. I use a dumb phone--no online banking ever. Shameful security for such a large bank with such assets.

itman · Apr 7, 2017

A bit more on this attack from Kaspersky:

Pulling the malware apart, the researchers found eight modules, including configuration files with bank URLs, update modules, credential-stealing modules for Microsoft Exchange, Thunderbird, and the local address book, and internet banking control and decryption modules. All of the modules, the researchers said, were talking to a command and control server in Canada.

One of the modules, called Avenger, is a legitimate penetration testing tool used to remove rootkits. But in this case, it had been modified to remove security products running on compromised computers. It was through Avenger that the researchers determined that nine other banks around the world were similarly attacked and owned.

“The bad guys wanted to use that opportunity to hijack operations of the original bank but also drop malware with the capacity to steal money from banks of other countries,” Bestuzhev said.
Click to expand...

https://threatpost.com/lessons-from-top-to-bottom-compromise-of-brazilian-bank/124770/

What is really pathetic is this abuse of Avenger was well known dating back to 2008. The latest alert I could find on it was here: https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=395 . Also Avenger only works as best as I could determine on pre-Win 8 OS versions implying the target bank was running Win 7 on its endpoints.

-EDIT- OMG! Not the first time a legit anti-rootkit tool was abused by malware. It happen in 2009 using GMER. You can read about that here: http://news.softpedia.com/news/Bank...ootkit-Tool-to-Kill-Security-App-124891.shtml .

Now get this. The attack was also done against a Brazilian bank. Want to bet its the same bank the current attack was successful against?

Log in or Sign up

Cybercriminals Seized Control of Brazilian Bank for 5 Hours

itman Registered Member

itman Registered Member

plat1098 Guest

itman Registered Member

Log in or Sign up

Cybercriminals Seized Control of Brazilian Bank for 5 Hours

itman Registered Member

itman Registered Member

plat1098 Guest

itman Registered Member

Useful Searches