Webmail and Online Banks Targeted By Phishing Proxies

An anonymous reader writes "Netcraft confirms a recent increase in the number of malicious proxy auto-config (PAC) scripts being used to sneakily route webmail and online banking traffic through rogue proxy servers. The scripts are designed to only proxy traffic destined for certain websites, while all other traffic is allowed to go direct. If the proxy can force the user to keep using HTTP instead of HTTPS, the fraudsters running these attacks can steal usernames, passwords, session cookies and other sensitive information from online banking sessions."

Comments

Why HTTP?

[AK Marc]

Why bother with HTTP? Plenty of malware gets signed certs. If you are messing with malware, change the root certs on the machine (assuming your malware installing the proxy has root), and use HTTPS to www.citibank.com. The user won't know the difference. It'll show up as a valid cert to the right domain, and the proxy can re-encrypt it and use the unencrypted username and password submitted to it. Plenty of corporates do this and have the ability to sniff 100% of employee traffic, even encrypted, because it's all signed and trusted certs, there will be no warnings, though you can inspect the cert for trusted sites, and you'd have to verify DNS or certs for every secure site, which breaks all the usability models. If it takes root to get the malware on in the first place, the hackers screwed up big if they didn't make it work for HTTPS.

Re:Why HTTP?

[karnal]

Path of least resistance at this point. What's easier, getting a malicious PAC script installed, or getting the same PAC script installed as well as having a user sign off on an invalid certificate?

Admittedly, getting someone to blindly click "yes" to accept the bad certificate isn't difficult, but if it doesn't pop at all - all the better for the malicious person on the other end.

Re:Why HTTP?

[manu0601]

Why bother with HTTP? Plenty of malware gets signed certs.

The attack described here does not involve malware. On WPAD requests seen on DHCP or DNS, just inject a WPAD reply with a malicious PAC script and you are done.

Warhol Billionaires

[retroworks]

In the future, everyone will be a billionaire for 15 minutes, until their ill-gained 15 minute life savings is phished by the next billionaire. The bank account hijack will rotate around and around, shared by everyone in the world, boosting all our credit ratings... momentarily.

DNSSEC would be nice

[Anonymous Coward]

It'd be nice if one could bypass the various CA's and enforce HTTP Strict Transport Security (HSTS) as well. I could then have an unlimited number of certificates for my domain and sub-domains. I would see that owning the .com or whatever domain would go up in price though since Verisign and others still want their money somehow and someone still signs the root somewhere.

It'd just be nice to be my own CA for my own domain anyway.

Re:My problem with session cookies...

[fostware]

A session cookie is just like a case number, it may be used to speed up communication between departments or sections of your website. Whenever I'm in a queue, there's always a ticket I hold to identify where I am in the queue, what my wait time is, possibly referenced by their third party SLA/QA company, and it could be tied to my Account Number when I get to the counter. It's stomached in real life, because it brings order to what could be chaos, and makes our lives that little bit simpler.

Secondly you must be rather naive to think permission is required to monitor your *every* activity. Through various laws, mutual sharing agreements, and straight greed, there's a wealth of information for people to gather and misuse. While they limit "personally identifiable" information, they gather everything they can and assign it their own ID. It then only takes a little homework to link the ID and your real ID together, and its just this last step which is prohibited in these privacy clauses.