Sophisticated heist compromised major bank’s entire DNS infrastructure.
KASPERSKY SECURITY SUMMIT 2017 – St. Maarten – Cybercriminals for five hours one day last fall took over the online operations of a major bank and intercepted all of its online banking, mobile, point-of-sale, ATM, and investment transactions in an intricate attack that employed valid SSL digital certificates and Google Cloud to support the phony bank infrastructure.
The attackers compromised 36 of the bank’s domains, including its internal email and FTP servers, and captured electronic transactions during a five-hour period on Oct. 22, 2016. Researchers estimate that hundreds of thousands or possibly millions of the bank’s customers across 300 cities worldwide, including in the US, may have been victimized during the hijack window when customers accessing the bank’s online services were hit with malware posing as a Trusteer banking security plug-in application. The malware harvested login credentials, email contact lists, and email and FTP credentials, and disabled anti-malware software on the victim’s machine to avoid detection.
Dmitry Bestuzhev, director of Kaspersky Lab’s research and analysis team in Latin America, says the attackers were able to pull off the heist by compromising the bank’s Domain Name Service (DNS) provider Registro.br and gained administrative control of the bank’s DNS account. The attackers also obtained valid digital certificates for their poser bank’s servers via Let’s Encrypt, a legitimate HTTPS certificate provider, to dupe customers who, when they logged into their online accounts, were redirected to the phony systems. Meanwhile, the bank, which has $25 billion in assets, 5 million customers worldwide, and 500 branches in Brazil, Argentina, the US, and the Cayman Islands, was locked out of its own network and systems during the attack.
Read the full story on Dark Reading