Attacks/Breaches

4/4/2017
10:20 AM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Cybercriminals Seized Control of Brazilian Bank for 5 Hours

Sophisticated heist compromised major bank's entire DNS infrastructure.

KASPERSKY SECURITY SUMMIT 2017 – St. Maarten – Cybercriminals for five hours one day last fall took over the online operations of a major bank and intercepted all of its online banking, mobile, point-of-sale, ATM, and investment transactions in an intricate attack that employed valid SSL digital certificates and Google Cloud to support the phony bank infrastructure.

The attackers compromised 36 of the bank's domains, including its internal email and FTP servers, and captured electronic transactions during a five-hour period on Oct. 22, 2016. Researchers estimate that hundreds of thousands or possibly millions of the bank's customers across 300 cities worldwide, including in the US, may have been victimized during the hijack window when customers accessing the bank's online services were hit with malware posing as a Trusteer banking security plug-in application. The malware harvested login credentials, email contact lists, and email and FTP credentials, and disabled anti-malware software on the victim's machine to avoid detection.

Dmitry Bestuzhev, director of Kaspersky Lab's research and analysis team in Latin America, says the attackers were able to pull off the heist by compromising the bank's Domain Name Service (DNS) provider Registro.br and gained administrative control of the bank's DNS account. The attackers also obtained valid digital certificates for their poser bank's servers via Let's Encrypt, a legitimate HTTPS certificate provider, to dupe customers who, when they logged into their online accounts, were redirected to the phony systems. Meanwhile, the bank, which has $25 billion in assets, 5 million customers worldwide, and 500 branches in Brazil, Argentina, the US, and the Cayman Islands, was locked out of its own network and systems during the attack.

"As far as we know, this type of attack has never happened before on such a big scale," Bestuzhev says. Kaspersky Lab did not disclose the name of the victim bank.

The operation actually began at least five months prior to the actual hijack on Saturday, Oct. 22. Bestuzhev says it's unclear just how the attackers were able to compromise the DNS provider, but notes that Registro.br in January of this year patched a cross-site request forgery flaw on its website. "Maybe they [the attackers] exploited the vulnerability on that website and got control. Or … We found several phishing emails targeting employees of that registrar, so they could have spear-phished them," he says. "We don't know how exactly they originally compromised" the DNS provider, he says.

The bank didn't deploy the two-factor authentication option offered by Registro.br, which left the financial institution vulnerable to an authentication-type attack as well as authentication-type flaws such as CSRF, Fabio Assolini, a Kaspersky Lab researcher said here today during a presentation about the bank hijack discovered by Kaspersky.

More Banks at Risk

The attackers also dropped on banking customer machines malware that targets a specific list of other banks in Brazil, the UK, Japan, Portugal, Italy, China, Argentina, the Cayman Islands, and the US, apparently in hopes of nabbing their accounts there as well. There were eight components of the malware, including the one that disabled or removed anti-malware software, all written in JAR and able to run on Windows and Mac systems. "Once executed, the malware detection rate was very low," he says. "Even if they failed at removing anti-virus, they were able to partially disable it."

A phishing campaign targeting specific bank clients also was set in motion in order to steal payment card information, and during the five-hour heist, the bank was unable to access its email system and alert its customers. "The hijackers had complete control of the bank," Bestuzhev says.

The attackers routed stolen credentials and other information to a server in Canada, likely a "disposable" hosting setup, he says.

Bestuzhev says there's no way to defend against this type of targeted attack against infrastructure. "It's the fragility of the Internet," he says. Most banks in Latin America rely on a third-party DNS provider for their infrastructure, and at least half of the top 20 largest banks in the world use DNS providers for some or all of their DNS infrastructure, he notes.

The bank ultimately regained control of its DNS infrastructure, but the victim machines could remain infected with the malware. "The malware is persistent," Bestuzhev says. "It stays on the computers and can keep causing damage to the victim."

Kaspersky Lab doesn't identify hacker groups, but believes the attackers were a sophisticated Brazilian cybercrime group.

"They spent five months just waiting. This is not someone who is a newbie," Bestuzhev says.

Kaspersky Lab identified the malware used in the attack as Trojan-Downloader.Java.Agent; Trojan.BAT.Starter; not-a-virus:RiskTool.Win32.Deleter; and Trojan-Spy.Win32.Agent.

Related content:

 

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Russia Hacked Clinton's Computers Five Hours After Trump's Call
Robert Lemos, Technology Journalist/Data Researcher,  4/19/2019
Tips for the Aftermath of a Cyberattack
Kelly Sheridan, Staff Editor, Dark Reading,  4/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-11358
PUBLISHED: 2019-04-20
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.
CVE-2019-11359
PUBLISHED: 2019-04-20
Cross-site scripting (XSS) vulnerability in display.php in I, Librarian 4.10 allows remote attackers to inject arbitrary web script or HTML via the project parameter.
CVE-2018-20817
PUBLISHED: 2019-04-19
SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern W...
CVE-2019-11354
PUBLISHED: 2019-04-19
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for QtApplication QDesktopServices ...
CVE-2019-11350
PUBLISHED: 2019-04-19
CloudBees Jenkins Operations Center 2.150.2.3, when an expired trial license exists, allows Cleartext Password Storage and Retrieval via the proxy configuration page.