Industry sign banking hawaii living will online
you all know that for well as long as online banking exists basically we have attacks against individual users we read about that there's a lot of cases you probably get email every day trying to someone trying to hustle you into giving them you're a Barclays bank account account which you never use which you don't even you're not even customer of the bank but this is like something that's been going on and it's really past present thing the present thing maybe you notice that we get more and more attacks against corporate users because that's more interesting there's more money there now it's not just the future it's already present attacks against direct against online banking servers and in the future we can expect two attacks against the backend systems because that's where really the money is now individual users so the massive methods are known the goal is to steal the user's identity right so the attackers are using many methods like her phishing cross-site scripting see serve they install malware on users computers we're not going to be talking about that today this is just like an intro so the attackers have many problems because banks and users are fighting back and they're making this more and more difficult next thing corporate users more interesting because there's more money there it won't be a surprise to a bank to see a couple of million euros being trained being sent from the bank account of a corporation to another corporation because that's just daily business it would be suspicious if an individual user did that but not a company so the organized crime is now going after the corporations as well and they have another problem because if you want to attack individual users you can just spam everyone you just buy an email list of 1 million emails and just spam everyone so I get spammed with an attack that is aimed against users of a specific bank that I never even heard of but they don't care with the corporate users you want to be more targeted so how do they find their targets you have to know who to attack in it in a specific company who is the person doing the online banking well one thing that is very useful for the attackers are the online public public directories of issued digital certificates I don't know about the whole world but in Europe digital certificates are being mainly used for online banking for corporations so if you are a corporation you are going to be using a smart card or the digital certificate to do the online banking now these online these digital certificates are published in online directories so anyone can find information on who in a specific company is has been issued a certificate by one of the certificate authorities that are being used for online banking let me show you an example in our country so yeah we found a lot of public directories of issued digital certificates and even specifically in our country if you want to attack the company that's listed below you can find the name of the person having issued a digital certificate for that company company and also his email address and that's all you need if you want to attack the company just don't attack these guys if you want to attack a company you can get this information you know exactly who to target inside that company but that's not the topic of our talk the topic of our talk is here some online banking servers now in contrast to attacking users and corporations where the goal was to steal their identity and then do whatever the application the banking application allows any legitimate users to do here the attacker is interested in finding vulnerabilities and exploiting them in the in the online banking server so the method is hacking and there is additional problem here the attacker does not know of the vulnerabilities yet so he has to try to find them so there's an additional stage where the attacker can be detected now the advantages are obvious there's well basically all the money is in the bank right and not just all the money even more money than all the money what I mean what I mean by that you can actually create new money because banks do that all the time banks creating your money every day and destroy money every day we just don't see that and it since the money is digital it's just a matter of a couple of bits and bytes in databases and the advantage for the attacker is that there is no social engineering required here you don't have to hustle or trick anyone into doing something you're just attacking the server directly now let's just move on to a couple of a couple of vulnerability types and attack types that I've prepared for you this will be somewhat simplified to make them more generic but if you're familiar with how banks work you will it will be it will be easy for you to just translate that tutorial case now direct resource access who knows Oh ASP everyone probably well this is one of the top vulnerabilities in all web applications and online banking is mostly web-based even if you have a thick client there's usually HTTP going in the background so let's see what can happen here this is a really lame example you wouldn't believe that this would really exist in the real world so we have a bank we have a URL and the user ID in the URL so when I log in to the bank and I click on this URL I get my account balance data but if I change the ID to something else I get someone else's account balance data who doesn't believe that this actually exists in real world well this really happened in Citibank this exact thing how lame is this so this is the actual state of security today in the largest banks some of them not not those that we've been tested that I'm sorry but it's not usually the case usually the arguments are base64-encoded is that really yeah really so when you do the pen testing and you see this of course when you see the typical characters of base64 of course first thing you do you decode this and if you find something like this it's just basic before encode something else and request it and you get some on your system we actually see this in real world but the better banks have gone further they're using URL encryption so you see something like this it's again base64 encoded so it's not a problem per se if it's encrypted or you have hex encoding so whenever you see something like this the first instinct of a hacker is let's try to decode this first and see what's hiding behind so what's usually hiding behind is a code like this so we have the same types of parents that we used in the in the previous slides and then we're encrypting this with some encryption key and then we add that to the URL so the application gives us a link that is encrypted and when you click on the link it receives the request and decrypts the link it's much better than what we saw before because we would need to know the key to to be able to encrypt something that the server will understand but it still happens that it's easy to guess the code if you if you really motivate it and the second problem is that some people actually know the key the people in the bank the developers those who have who have actually selected the key know the key so it's not not a really good idea if that guy who knows the key leaves the bank and then still knows the key he can still get access to other people's accounts I'm sorry now well it can be it now I'm not naming anyone specifically so the developers are being aware of this problem usually make it a little bit more difficult for you to to guess what's going on in the background so they add some some salt to the original arguments and they even add some random which is a good idea if you add some random data then it will be more difficult to guess what's happening in the background if you don't know the code but we still have that guy who knows this code and he knows this key so doing this is not a good substitute for actual server-side authorization of the received request so whenever you see something like this in the URL you know there's something fishy going in the background now we're not here to steal other people's data the bank robber wants to actually steal money so we can apply this knowledge to stealing money we have a similar case we have a transfer URL here we have source account and destination account and an amount right so this is like what I want what I would do if I want to transfer money from my account to someone else's and of course by the same token if we change the source account the application does not allow me to do this through the GUI so I have to do it manually but if I do this and there's no server-side validation or if it if it can be bypassed then money can be taken from someone else's account instead of mine so how does this work this money transaction let's go a little bit deeper into that so we have the user with the browser and the online banking server first of all the user decides that he wants to make a transfer of his funds so the server provides an empty transaction form is there anyone who doesn't use online banking we have we have two guys who are really secure here okay so I can go really really quickly through that so you get an empty transaction form that you can fill out so you select your account select the other account and the amount of money you want to transfer and a few other data that that's not important here so the server then sends you a filled out form just for the confirmation so that you don't mistakenly send money to someone else so you dude it allows you to confirm what you decided to to do now the validation of data first can be done here on the client side right and it you know it always is if you want to enter a negative number into amount you want to transfer the the JavaScript probably won't let you write so so the the browser will not let you do that you cannot just type it in and if you you cannot even select someone else's account from the drop-down box they're only your accounts there so then that's kind of like more user friendly validation than anything security related so that we we all know that you can hack this so you cannot rely on that now there's a server-side validation in this step so whenever I provide some data I want to do this and that with my money the server said validates my data and and looks at it and says ok this guy's trying to do something can he do that does he have does he have authorization for this account is the amount ok and so on and then the server returns that form to me and when I confirm it it can validate it again well the most important validation is the third one because after that's been done the server is going to say ok this validation is OK I'm going to send it to back end and the back end just does everything that the server tells it to do well frequently Eric frequent security error here is that the server only does validation number two so if you change your data in the confirmation form you can bypass that validation and give the backend server whatever you want to give next case is negative numbers would you believe that you can actually use negative numbers in online banking systems yes I would too okay this guy's from the bank he knows what he's talking about okay negative numbers are surprisingly often overlooked let's see this is a typical line of code that does the validation of the amount that we selected so we want to transfer 100 euros and this is the line of code that says is he is it okay does he have 100 euros so if I want to transfer 3,000 euros and I have only 2000 of my account this line is going to block my attempt but if I do this if I want to transfer minus 100 euros this line will have no problem with that so checking for negative numbers is very often overlooked maybe not in the entire online banking application but if you if you can find one place where it's overlooked you can do some funny things with that so this is the actual case the attacker has an empty account balance the victim has 100 euros the attacker transfers minus 100 euros to the victim very generous something right so the end result is that the attacker has 100 and the victim has a zero so it was it's the same as a transaction from the victim to the attacker only triggered by the attacker this is really cool this is a very little-known problem if you try to browse google if you search google for this specific problem it's really not easy to find references I only found a couple but in the banking sector they're very well aware of that after our pen test yeah yeah but now that the business logic behind this is whatever this is the amount to transfer this amount will be subtracted from my account and added to his account right so if minus 100 is subtracted from my account it's like adding adding 100 to my account sorry yeah - - so again I get a plus now let's see something that we once came across a similar case we're going to transfer minus 100 euros but not to another person's account but to our own savings account now savings accounts are just like any other account they have a specific property that they don't cannot have a negative balance well at least those that we see now the problem well the problem this is actually an advantage for the attacker if we want to transfer minus 100 euros from a normal account to savings account this is what we get we get 100 euros but we do not get minus 100 euros on the savings account because it cannot have a negative value now the business logic said that is not okay I'm not going to do that part of the transaction this is a natural case and what's what's fun with this is that you can actually create new money before we had a total of zero euros now we have a total of 100 so there's actually more money in existence because of this failed transaction next thing bypassing limit checks banks like to impose limits on us they don't like us to to transfer 1 million euros from our account if we don't have them and I understand them I wouldn't do that either but due to errors in business logic there you can possibly find ways to bypass that because maybe there's insufficient validation on the server any other any other thing any other reason let me just show you what can happen if if you do if you find that so you have two accounts one with 100 euros the other one empty if you can live bypass the limitations and it can be possible because code is written by people and we make errors right this is the case no extra money is in existence now because the total is the same as before but you actually have a huge - on one account and a huge plus and the other count now if you're an honest guy you would add those two together and say yeah I owed I owe the bank you probably be be worse off because you would be paying a lot of interest for the for the overdraft but if you're a criminal you would just take those million euros and go to Hawaii right and you forget about the debt to the bank so that is why the bank does not want you to make larger overdrafts than those that they authorized to you this can this was actually a case in one of our pan chests next to HTTP parameter pollution this is a class of HTTP vulnerabilities discovered by Luca carretoni and stefano de paola did I pronounce that correctly excellent it's a very good idea actually let me show you what this means in the banking system so we have a communication between the user and the online banking server which is running a JSP code at this time and the backend server running a PHP code it's not very usual for back-end and servers to run PHP code but for our for our example here let's suppose itself so the user wants to transfer 100 euros from account 1 to account 2 now the code on this JSP server reads the arguments from the URL and does some validation you see if not user authorized for source account then error so I cannot actually provide another person's account - to the server they would reject that and also it makes a test that if if I do don't do not have enough disposable funds on my account also I get an error so this is this is typical validation of the user data now the code says if those checks were okay that I'm going to forward that request to the back-end server and it does that in another post transaction so just forwards the same record same parameters that were used before to the back-end server now the back-
nd server reads those parameters and does the transaction that's it now the HTTP parameter pollution is this we add another argument to the URL it doesn't have to be URL it can be an imposed data as well so we have to source arguments here now what happens the guys who are who are researching HTTP parameters pollution they analyzed various servers various frameworks in terms of what they do if they encounter two parameters with the same name now it turns out that in JSP takes the first parameter so we have the same situation as before now when the request is forwarded to the backend PHP takes the second parameter that you can see this can be used for bypassing validation on the first server but of course no one's that silly so we have another layer of or of authorization in the backend so we say if user is not authorized for the source account we're not going to do the transaction we can still do something else we can change the amount so now we have two amount arguments and all the validation will pass correctly although the backend will have the amount of 100,000 euros which I do not have on my account so this is a perfect example of a vulnerability that allows you to do some of the things that I mentioned before so bypassing limit checks sequel injection while it's pretty boring but you still have it everywhere and of course you also have it in online banking systems it's funny that when we talk to to the banks before the pen test we always get skeptical looks and they say now sequel injection won't be possible in our case now and I have hundreds of reasons but we always find at least one case where we can do it so it's really an important varner ability in banking system as well so you're familiar with this this would be a typical typical case if someone attacked the sequel query for forgetting the exchange rate for a specific currency and then replace the unvalidated argument with something like this this is a classic example but again a bank robber is not here to steal data he's here to steal money now let's steal money this is a typical simplified version of what happens when someone transfers money from one account to another so we have an actual sequel transaction which means that either all sequel queries will be successful or none of them this is the basic hygiene of banking industry but we have to update queries so whenever I transfer money from my account to another the balance on my account has to be changed and the balance and the other account has to be changed accordingly make sense so these are the two updates queries so my account is going to be changed to 0 and my con balance and the the other accounts balance is going to be changed to 100 but if these arguments are not properly validated well this is a case how it would actually work in an in a normal case this would be a sequel injection so even though we have a transaction sequel transaction the first query will actually set my account number my account balance to zero but the second one will set the other accounts and my accounts balance back to 100 so we again created money out of nothing this is something completely different banking signatures are you when you're using online banking do you do your banks provide an option for you to to make an online deposit so that you can then digitally sign a deposit agreement do you have that anyone okay were you from Austria axel we have that in our country as well so what banks are doing they are really enthusiastic about this digital certificates and digital signatures because we have the the laws that we need to make this this signatures valid in the court and we have the technology and the users are already have the digital certificates so why not automate some of these processes so let's see how that works if the user wants to deposit 100 euros for 31 days he makes a request to the banking server and the server says okay this is the deposit agreement that you need to sign and it's dynamically generated from the data that user has has provided and the server also decides what the interest rate would be for your deposit and this is all the the data that you get and you're supposed to sign so the user signs the deposit agreement and send it to the server and the server counter signs it with the banking certificate which is on the server now this is a legal document enforceable in court if you go to the court and take this digitally signed document the court will say you are right this is true this is a real agreement between you and the bank even though there was no person on the other side now where do you see the problem here well a malicious user can modify the agreement and if the server is not careful it will sign the modified agreement but the modified agreement can be anything not just increasing the interest rate for from 2% annually to 2,000,000 percent annually which would be like a nice way to earn money but the text of the agreement can also be changed so it it may no longer be a deposit agreement it can be a statement from the bank that all their real estate is now yours or hypothetically that would not work but yeah anything can be changed not just numbers and then of course the classic server-side code execution as you can see everything I'm talking about here requires zero user interaction so these are attacks against the banking servers you don't have to social engineer anyone so the server-side code execution is nothing special in in the banking industry so I want to go through this in in too much detail but the the impact what the attacker would like to do if he manages to execute code on the server is to change the e banking application code of course because that code includes business logic that prevents you from doing some nasty things and you can if you can remove that logic from the application then you can attack the system and what the holy grail for the attacker would be to get the opportunity and credentials to send direct requests to the back end because the backend trusts the server the the online banking server that it has done some validation before so whatever the online server says to the backend the backend can provide some can execute some additional validations but it essentially has to trust that there was a user behind this request even though the attacker was actually behind the request now I know you all came because of this because yeah you like the vulnerabilities you would like hypothetically to hack banks but you don't want to go to jail now I'll give you a way to do that this attack is about rounding and currency exchange now suppose you have an exchange rate such that for one euro you get one point three six four dollars it's pretty much there today now if you exchange one euro cent you will you should get this much dollars but because of the rounding you will get less right so you make a nice little loss so what should we do yeah make it the other way around if we exchange $1 cent for one euro cent because of the rounding you you actually will get one euro cent you sorry will not work that's dead sorry no no the rounding is specified by European Union yes they do my bank does my bank does I tested it it works sorry okay yeah oh you have a bad Bank because all the banks I've seen are doing the rounding like this okay let's talk about that later so let's just see what you can do with this and we'll take a look at your bank later it's funny then this has been known for a decade there's even a paper out there with the URL here guys were writing about this they were thinking about ways to counter this problem and it's been known for a long time and still many banks allow you to do that except his bank so what would be the the algorithm that you use you start with 100 euros for example and you exchange that $2 so you get 136 point $40 and then you make a loop you repeat 13640 times convert that once dollar sent to 1 euro cent and you get 36 point for the euro of profit and go to 1 so we do it as long as they let you now how fast can you get rich doing that if we assume 10 exchanges per second because there can be some some throttling on the server side which should prevent it from doing it too fast so you have to join with your friends so you all do it at the same time you can have a daily profit of over 2000 euros and a nice monthly profit which lets you leave your job immediately but you'll probably your bank will probably notice it and we'll do something about it so we'll have to top two banks and eventually no bank will be doing this anymore so what can be improved here because doing this for a month it takes a long time and probably someone will notice that something's happening whoever is in charge of your account in bank they will see that you have hundreds of thousands of transactions it could trigger some some suspicion but if you want to optimize this you should have because of the rounding you should get as close as possible to 0.005 because that's where the rounding provides the biggest difference but remember that you you earn less than one cent in each transaction so it's really low profit in corporate banking banks are making it easier for you well of course companies can do that as well but banks make it easier for you because you can you can use they provide an option for you two to two a package the request in in single packets and then sign those packets and send those packets to the bank so you can you can do more offline and just send it as a single packet to the bank and yeah it works on my personal bank and also our corporate bank allows us to do that we just stole one cent so yeah I don't think they're taking they'll mind now the countermeasure is really simple and that's what we tell our customers just don't let users exchange less than one whole unit of the larger currency so if you prevent making the exchanges of less than one euro for instance all this goes away because every everything you earn with the rounding there you lose with the with the different exchange rates the buy and sell exchange rates so you lose everything that this is very simple countermeasure question No yeah exactly but but if this attack actually requires you to make exchanges to another country you can't come currency and then back right and and you have different exchange rates for different forth and you lose everything everything you earn you lose when you exchange back because they have a quite a difference between sell and buy rates yeah no it doesn't but we can we can do the math later okay now getting away with it wouldn't you want to why should we even care if we're not actually bank robbers why should we even learn about getting away with it well we shouldn't we shouldn't learn much about it because we don't need that kind of knowledge but we should know at least a bit about it because when you're talking to a bank and you show them their vulnerabilities at some point some guy will tell you yeah but you wouldn't get away with it because we would someone would catch you so you need to you need to have an answer to that because if the conversation stops at that point it may even lead to their wrongful understanding that the vulnerabilities that they have don't really matter so you want you want to make sure that they fix those vulnerabilities and if in order to do that they have to believe that someone could actually exploit them so the first thing to do the attacker would have to avoid detection when when he wants to attack a bank he first has to find some vulnerabilities in that Bank and in the process of finding these vulnerabilities he would create some noise and he might get noticed and to access most of the bugs that we that we covered here the attacker would have to actually login to the bank first now if you want to log in to the - to the bank - to your bank account you would have to have one so it means you had to come to the bank present your ID which means that you can be traced back if they notice that user one two three three seven four is doing something funny like looks like cross-site scripting or buffer or flow exploitation and let's send someone from the police to their home and see what they're doing so the attacker would have to hide behind someone and we call this user in the middle it's like man in the middle browser in the middle the attacker is using the same technique user in the middle he hacks some legitimate users account and does all the hacking through that account now it's not a new concept but it's a way to hide the attackers identity now the most important thing that is not specific to to hacking banks directly the the criminals that are now stealing money from users and corporations are already having this problem and solving it really well is how to break the money trail so as long as you can transfer money from one bank to another but it's still traceable it's still digital money and still in the system so their goal is to extract it from the from the this digital banking system and then they they're employing money mules you're probably getting emails like this all the time trying to recruit you they give you 10% of the proceeds if you just cash in some checks or if you receive some money on your account then withdraw the cash and give it to someone so this is really classic but also digital money in all sorts that exists today can be used to to cover your tracks right and this is what the attackers are doing today and they will continue doing it and one thing that we haven't seen yet or haven't read yet about but can possibly happen in the future is chaining the users in the middle so when someone when the attacker steals some money from the bank he transferred that money not to his own account but to someone else's account which has already been hacked in another country and from that account to yet another hacked accounts to another country so this means that he's buying a lot of time to actually extract that money from the system before the police comes now the perfect crime would be to create new money so that nobody loses anything if you steal money from a user the user will eventually notice that and he will say all right the bank someone took my money take a look into this but we've seen cases where money can be actually created out of nothing it's less likely that someone will notice that because no one has lost anything no one will complain so it's just new money and this can be done either by with types of the tax that I described before or if you remember the first slide in the future future 2.0 there's the in the backend the DBA for instance database admin can actually do that today he has all the access to change numbers in the database not in a true sexual awareness in a transactional way but in a way that creates new money so this can be really hard to track if he knows what he's doing and he knows what the what the controls are for validation controls and unscented checks are in the bank he can actually create new money without anyone ever noticing now the attackers best friend this this is what we hear all the time and probably some of you are thinking too right now now this would not work on my system because of this and that reason and it probably wouldn't not not everything would work on every system obviously but for a for a bank it's really critical if anything works anywhere in their system and that is why testing is better than believing now for the attacker it's very good that banks are adopting new technologies and are trying to automate more and more processes so we've seen automated deposits and the new threats that they bring we will see automated small loans in the future that's for sure because right now the bank banks don't want to automate loans because they have these complex procedures in the background they want to they want to see whether you're worthy to get a loan but for small loans they will start doing that at some point and when one Bank starts doing that the other others will follow quickly and this will just expand the the attack surface many banks also allow you to trade in stocks now think about it can you actually buy - 300 Apple shares that doesn't make that make sense - to human but to a computer this is just a number so if it's just a number many interesting things can happen oh thank you this was
all I had for you I hope you will behave well please don't if you use this don't tell anyone you heard it from me
