Slashdot Mirror
Hacked Bank of India Site Labeled Trustworthy
SkiifGeek writes "When the team at Sunbelt Software picked up on a sneaky hack present on the Bank of India website, it became a unique opportunity to see how anti-phishing and website trust verification tools were handling a legitimate site that had been attacked. Unfortunately, not one of the sites or tools identified that the Bank of India website was compromised and serving malware to all visitors The refresh time on a trust-brokering site is too long to be useful when a surf-by attack on a trusted site can take place in a matter of seconds, with a lifetime of hours, and with a victim base of thousands or greater."
That's the problem, how many consumers are sophisticated enough to even ask the right questions. They simply trust that their financial organization or any major web retailer has a secured site. Obviously there should be strict standards but who is going to enforce it. What authority would the agency actually have. As I have said before, there is still a lot to be said to walking into your local bank and being helped by a clerk that you see every week that you can shoot the shit with as they handle your transaction.
There are very few instances when I actually need to rdesktop in and use a Windows machine.
One of those is when I've actually got to visit one of my online banking sites, which requires some obscure activex "security" extension to work. For someone who uses FF, noscript and occasional peeks at firebug, it really pisses me off when I have to disable all my own security checks to enable a site to "secure" itself.
This is just another instance where I'd have been hit if I had been a user of the said bank (and had to use IE to browse it).
Quidquid latine dictum sit, altum videtur
never trust sites that use different domains to show pictures, provide logins, tracker pixels etc...
... seem to be nothing but trouble. Does anyone know of a legitimate use for them (especially cross-server) that could not be done with a bit of easy server-side including? On a related note, does anyone know of a firefox addon that can warn you if any page you visit contains an iframe tag?
As stated, when someone like Doubleclick, Akamai or some other cache serving company gets compromised, then I will worry about things more.
For some unknown reason, I hoped that financial institutions would have more online security than Doubleclick or Akamai.
hacked site labels YOU trustworthy.
Why's that? Akamai probably handles multiple foundational financial systems' networking, so if they got compromised it could be a much bigger deal.
Having worked for a bank, I'd be floored if financial systems' defenses ever caught up with technical systems'. The problem is that in a financial organization financial skills are valued on a cultural level rather than technical skills. This is quite different from a technical company, at least one in its early to mid life. (in, of course, my experience and readings. Perhaps this is not completely true)
My little site.
Anti-phishing tools shouldn't be used to determine which sites are good, they should be used to determine which sites are bad.
These tools might have picked up thousands of shoddily done, fly by night phishing scams. It doesn't reflect badly on them if one well done, sophisticated cracked server can fool them. There is still going to be errors. These tools allow people to discount the most obvious hacks, and use their time on the 1% of most dangerous hacks.
Hopefully I didn't put any [] around my words.
..like it only affects Windows users.
More than 60,000 Windows programs won't run on Linux.
... I would implement the one-time password sent to mobile phone which is the method my internet banking site uses: you log in with card number, customer selcted pin and password
the login page also has BIG warnings: do not click on any links (relating to your banking or purporting to be) or give your banking details to anyone on the internet or in an e-mail since the bank or it's employees will never ask for it
then when you are on your profile page, before you can do any transaction at all, the site sends an SMS to your mobile with a one-time password only after entering this password are you allowed into your main account and can start banking i.e verifying your physical presence as well as being good security measure for online banking sessions
of course you need to set all this up with your bank beforehand, but with new financial regulations in south africa you go through a long process of verifying your identity and proof of address in person in a bank each year, so from the beginning this type of scheme has robust security
this has worked very well and i need to hear of an instance of it being circumvented other than criminals holding a gun to your head while you do your banking, which puts the whole thing in another category altogether
people who get scammed by clicking on links and falling for Nigerian type fund relocation schemes only has their own stupidity and greed to blame
only my 0.02
Move along now, nothing to see here! Go on!
How aggressive should systems be about downgrading ratings for web sites? We've been struggling with this for SiteTruth. In addition to SiteTruth's main function, checking business identity, we have some basic phishing checks. We download the PhishTank database every few hours. PhishTank has lists of bad URLs, but now that the smarter phishing sites change URL and even subdomain in each spam e-mail, blocking by URL is no longer effective. So we now flag the entire base domain.
This can have broad effects. Right now, we're blacklisting all of AOL (SiteTruth report) and all of "live.com" (SiteTruth report). Both AOL and Microsoft Live have redirectors which are being actively exploited by phishing sites. We can't tell their safe URLs from their unsafe URLs, so we have to blacklist the whole domain.
When a site with an open redirector plugs the hole, PhishTank will downgrade those "active phishes" to inactive. We'll then pick that up and rerate them within hours. But until they do, they're in the tank. The whole site.
Too harsh? Realistic? Evolution in action? Comments?
Serious?
Akamai is a tech company. They know their networks extremely well. I would expect that they were more competent with regards to security threats to their servers than a financial institution, whose main business is not running a computer network...
Siteadvisor says the site has been fixed and it is giving a green tag for it now.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Akamai not just does the networking for banks, but I'm pretty sure they handle a lot of high volume services that if tampered with would mean a lot of damage. Microsoft Update/Windows update is hosted on their network, for example.
Most banks pay attention to their IT infrastructure, and if a compromise happened, heads would roll. However, almost always, there would be some way of showing due diligence [1] so nobody goes to prison or major lawsuits don't get filed. On the other hand Akamai's whole line of business is dependent on how secure their servers are, so I'm pretty sure they have a lot more manpower and resources dedicated to that (as a percentage), compared to a bank or credit union. Security is Akamai's reputation, where a breach with them would be as catastrophic and company destroying as having Verisign end up with its root signing private keys for anyone to download on a FTP server.
From what I read, Akamai does a very good job of keeping their stuff locked down.
[1]: HIPAA/SOX/other regs are another can of worms, and are almost as daunting (if not more so) for IT departments as keeping the infrastructure maintained.
We did some consulting work involving two large banks. The managers at one said that their bank had NO technically knowledgeable people who worked for the bank, on contractors. I talked to one of the contractors, and he had very little technical knowledge, also. (How would a bank with no technical knowledge choose which contractors were technically knowledgeable.)
The other bank seemed to have very, very little interest in technical issues, also.
We have accounts with several online banks, including an extremely large international bank. All have web sites with major design problems.
I suppose that is one of the reasons that bank web sites are often IE only.
BankRate.com is terrible, in my opinion, but it seems to be the best bank information web site available.
But that's not what anti-phishing tools are they for. They should flag fake sites, not legit sites serving spyware. Regardless of the hack, the site itself was still the Bank of India site, and not a phished site. An iframe embedded in legit source is not a phishing scam. A toolbar that only checks for URL legitimacy would be correct in not flagging the site.
This message is posted on the BoI website: "This site is under temporary maintenance till further notice. Kindly bear with us."
Nearly all links have been removed.
I also noticed that it's "best viewed with IE 4.01 at 800x600. Who the hell is still using that crummy browser?
LinkScanner from Exploit Prevention Labs protected against this. http://explabs.blogspot.com/ How? It looks only for known exploits, and it stops the driveby download from occuring. Solutions like this are the only way to reliably stop driveby downloads from sites like Bank of India, because a trusted site can be clean one minute and dirty the next. Reputation filters can't react in real time. You need an anti-exploit scanner.
Google Desktop 5 would in fact block the iframe from loading, since it's in the Google blacklist.i z&btnG=Search
http://www.google.com/search?q=site%3Agoodtraff.b
Google search did not flag the site itself; As suggested by others, the site was probably compromised and cleaned up between Google's indexing cycle.
Google does expose an API (search for 'safe browsing API') that contains these known bad hosts (goodtraff, etc), so incidents like these can still be prevented even before Google checks the compromised sites themselves. Google Desktop 5 uses this API, and mozilla developers blogged about possibly including this in Firefox 3.
There still remains a problem with relying on blacklists (what if the attackers did not use an iframe and instead hosted all the exploits on the site itself), but I am just stating that the article did not cover Google Desktop, which in fact protected its users in this case.
Could someone please tell me about this bank? I had not heard of it until now. Is it really a bank? What would be the estimated customer base?
Looks like these guys at Sunnet Berkerming didn't do their homework right... This http://blogs.zdnet.com/security/?p=487 article at ZDNet (who I have at least heard of before) mention the same incident, with a pretty screenshot showing how the plugin from Finjan correctly detected the malicious code on the website.
Sounds to me a bit far from providing "accurate, non-biased synopsis of security-focussed technology trends" as they claim on their site...