$150K Stolen by Amazon DNS BGP Hijack

HUP cikkturkáló

The attackers used BGP — a key protocol used for routing internet traffic around the world — to reroute traffic to Amazon’s Route 53 service, the largest commercial cloud provider who count major websites such as Twitter.com as customers.

So far the only known website to have traffic redirected was to MyEtherWallet.com, a cryptocurrency website. This traffic was redirected to a server hosted in Russia, which served the website using a fake certificate — they also stole the cryptocoins of customers.

via

5:19 AM PDT We are investigating reports of problems resolving some DNS records hosted on Route53 using the third party DNS resolvers 8.8.8.8 and 8.8.4.4 . DNS resolution using other third-party DNS resolvers or DNS resolution from within EC2 instances using the default EC2 resolvers are not affected at this time.

via

Woke up today, Put my computer on, went on to myetherwallet and saw that myetherwallet had a invalid connection certificate in the corner. I thought this was odd. https://i.imgur.com/2x9d7bR.png . So I double checked the url address, tripple checked it, went on google, got the url . Used EAL to confirm it wasn't a phisihing site. And even though every part of my body told me not to try and log in, I did. As soon as I logged in, there was a countdown for about 10 seconds and A tx was made sending the available money I had on the wallet to another wallet " 0x1d50588C0aa11959A5c28831ce3DC5F1D3120d29 "

via

  • 3318 megtekintés

( toMpEr | 2018. 04. 24., k – 22:09 )

Így belegondolva letsencrypt-től akár valid certet is szerezhettek volna...

- myetherwallet.com: hsts: off, dnssec: off, caa: off

Összehasonlításképpen megnéztem pár domaint:
- coinbase.com: hsts: +, dnssec: -, caa: -
- bistamp.com: hsts: -, dnssec: -, caa: -
- bitfinex.com: hsts: -, dnssec: -, caa: -
- kraken.com: hsts: -, dnssec: +, caa: -
- paypal.com: hsts: +, dnssec: +, caa: +
- otpbank.hu: hsts: -, dnssec: -, caa: -
- raiffeisen.hu: hsts: -, dnssec: -, caa: -
- cib.hu: hsts: -, dnssec: -, caa: -

Akkor legyenek itt ezek is a HSTS mellett:
X-Frame-Options: SAMEORIGIN Protects against Clickjacking attacks. ref.: https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
X-XSS-Protection: 1; mode=block https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-h…
X-Content-Type-Options: nosniff https://www.veracode.com/blog/2014/03/guidelines-for-setting-security-h…
Referrer-Policy: strict-origin Prevents from leaking referrer data over insecure connections. ref.: https://scotthelme.co.uk/a-new-security-header-referrer-policy/

És érdemes lehet CSP-t is beállítani: http://content-security-policy.com/ tesztelő: https://csp-evaluator.withgoogle.com/
--
https://naszta.hu

( toMpEr | 2018. 04. 24., k – 22:34 )

https://www.etherchain.org/account/1d50588C0aa11959A5c28831ce3DC5F1D312…
https://www.etherchain.org/account/0xf203a3B241deCAFD4BdEBBb557070db337…

Alapján kicsit nagyobb összegről van szó 524 ETH * 703USD = 368k USD (202 usertől)

A myetherwallet kommunikációja: "This can happen to any org & is not due to a lack of security on the MEW platform, but due to criminal hackers finding vulnerabilities in public-facing DNS servers. Your security & privacy is ALWAYS priority." - via

Ami egyértelműen nem igaz, mert a HSTS és a DNSSEC is védelmet nyújtott volna ez ellen.

Update: van egy 3. cím is amire a lopott coinok mentek ezen kicsit nagyobb összeg van: 24,583 ETH = $16,087,155

Viszont ennek nagy része már korábban érkezett, szóval valószínű nem ez volt az egyetlen akciója a hackernek: https://www.etherchain.org/account/0xb3aaaae47070264f3595c5032ee94b620a…

( toMpEr | 2018. 04. 25., sze – 10:42 )

Cloudflare report: BGP leaks and cryptocurrencies

Is there somebody to blame?
As there are many actors involved, it is hard to determine fault. Actors involved:
The ISP that announced a subnet it did not own.
The transit providers that did not check the announcement before relaying it.
The ISPs that accepted the route.
The lack of protection on the DNS resolvers and authority.
The phishing website hosted on providers in Russia.
The website that did not enforce legitimate TLS certificates.
The user that clicked continue even though the TLS certificate was invalid.

https://blog.cloudflare.com/bgp-leaks-and-crypto-currencies/

> Itt meg csóka belép a jelszóval és már hussan is el a pénze...de a myetherwallet-nél a biztonság a legfontosabb :)

2fa nem lehetséges ilyen helyzetben: A myetherwallet nem tárol semmi adatot, minden a kliens oldalon működik és tárolódik. (mondjuk szerintem faszság a böngészőre bízni ilyen adatokat, de mindegy)

A BGP nem használ DNS-t, de a DNS használ BGP-t...
A cikkben elég egyszerűen le van írva:

> This IP space is allocated to Amazon (AS16509). But the ASN that announced it was eNet Inc (AS10297) to their peers and forwarded to Hurricane Electric (AS6939).
> Those IPs are for Route53 Amazon DNS servers. When you query for one of their client zones, those servers will reply.
> Any DNS resolver that was asked for names handled by Route53 would ask the authoritative servers that had been taken over via the BGP leak. This poisoned DNS resolvers whose routers had accepted the route.

Certificate transparency bevezetése óta minden cert kiállító köteles publikus listát vezetni a kibocsátott certekről (különben a chrome nem fogadja el validnak), így könnyen ellenőrizhető a dolog.

Itt kereshető domain alapján (akár évekre visszamenőleg, subdomaineket listázva is): https://transparencyreport.google.com/https/certificates