How Hackers Skipped Through BA’s Security

British Airways recently disclosed a data breach impacting customer information from roughly 380,000 booking transactions made between August 21 and September 5 of this year. The company said that names, addresses, email addresses, and sensitive payment card details were all compromised. Now, researchers from the threat detection firm RiskIQ have shed new light on how the attackers pulled off the heist. 

RiskIQ published details tracking the British Airways hackers' strategy, also linking the intrusion to a criminal hacking gang that has been active since 2015. 

The group, which RiskIQ calls Magecart, is known for web-based credit card skimming, finding websites that don't secure payment data entry forms, and vacuuming up everything that gets submitted. 

But while Magecart has previously been known to use the same broadly targeted code to scoop up data from various third-party processors, RiskIQ found that the attack on British Airways was much more tailored to the company's specific infrastructure.

"We’ve been tracking the Magecart actors for a long time and one of the developments in 2017 was ... they started to invest time into targets to find ways to breach specific high-profile companies, like Ticketmaster," says RiskIQ threat researcher Yonathan Klijnsma.

"The British Airways attack we see as an extension of this campaign where they’ve set up specialized infrastructure mimicking the victim site."

In its initial disclosure, British Airways said that the breach didn't impact passport numbers or other travel data. But the company later clarified that the compromised data included payment card expiration dates and Card Verification Value codes, the extra three or four-digit numbers that authenticate a card, even though British Airways has said it does not store CVVs. 
British Airways further noted that the breach only impacted customers who completed transactions during a specific timeframe, 22:58 BST on August 21 through 21:45 BST on September 5.

These details served as clues, leading analysts at RiskIQ and elsewhere to suspect that the British Airways hackers likely used a "cross-site scripting" attack, in which bad actors identify a poorly secured web page component and inject their own code into it to alter a victim site's behavior. 

The attack doesn't necessarily involve penetrating an organization's network or servers, which would explain how hackers only accessed information submitted during a very specific timeframe, and compromised data that British Airways itself doesn't store.

Klijnsma, who pinned the recent Ticketmaster breach on Magecart and saw similarities with the British Airways situation, started looking through RiskIQ's catalog of public web data; the company crawls more than two billion pages per day. 
He identified all the unique scripts on the British Airways website, which would be targeted in a cross-site scripting attack, and then tracked them through time until he found one JavaScript component that had been modified right around the time the airline said the attack began.

The script is connected to the British Airways baggage claim information page; the last time it had been modified prior to the breach was December 2012. Klijnsma quickly noticed that attackers revised the component to include code, just 22 lines of it, often used in clandestine manipulations. 

The malicious code grabbed data that customers entered into a payment form, and sent it to an attacker-controlled server when a user clicked or tapped a submission button. 

The attackers even paid to set up a Secure Socket Layer certificate for their server, a credential that confirms a server has web encryption enabled to protect data in transit. Attackers of all sorts have increasingly used these certificates to help create an air of legitimacy, even though an encrypted site is not necessarily safe.

The airline also said in its disclosure that the attack impacted its mobile users. Klijnsma found a part of the British Airways Android app built off of the same code as the compromised portion of the airline's website. 

It's normal for an app's functionality to be based in part on existing web infrastructure, but the practice can also create shared risk. In the case of the British Airways Android app, the malicious JavaScript component the attackers injected on the main site hit the mobile app as well. 

Attackers seem to have designed the script with this in mind by accommodating touchscreen inputs.
While the attack wasn't elaborate, it was effective, because it was tailored to the specific scripting and data flow weaknesses of the British Airways site. British Airways have stated,

"As this is a criminal investigation, we are unable to comment on speculation."1 RiskIQ says it gave the findings to the UK's National Crime Agency and National Cyber Security Centre, which are investigating the breach with British Airways.

"We are working with partners to better understand this incident and how it has affected customers," an NCSC spokesperson said of the breach on Friday.

RiskIQ says it is attributing the incident to Magecart because the skimmer code injected into the British Airways website is a modified version of the group's hallmark script. 

RiskIQ also views the attack as an evolution of the techniques used in the recent Ticketmaster breach, which RiskIQ linked to Magecart, though with the added innovation of directly targeting a victim's site rather than compromising a third party. And some of the attack infrastructure, like the web server hosting and domain name, point to the group as well.

So far British Airways and law enforcement haven't publicly commented on this attribution, but Klijnsma says the other takeaway for now is the prevalence of tiny website vulnerabilities that can quickly turn into huge exposures. 

"It comes down to knowing your web-facing assets," Klijnsma says. "Don’t overexpose, only expose what you need. The consequences, as seen in this incident, can be really, really bad."

Wired

You Might Also Read: 

British Airways Data Breach:

 

« GCHQ Data Collection Violated Rights To Privacy
Cybersecurity Needs A Collective Approach »

Directory of Suppliers

Expand Executive Search

Expand Executive Search

Expand Executive Search provides specialist executive recruitment services in Technology, Communications and Digital Media.

Secure Zoo

Secure Zoo

Securezoo's mission is to simplify and enhance information security by providing trusted security guidance, products, and information to small and mid-sized businesses and security professionals.

McKinsey

McKinsey

McKinsey & Company is a global management consulting firm. Areas of expertise include technology risk and cyber security.

BSquare

BSquare

Bsquare DataV software and engineering services help enterprises implement business-focused Internet of Things systems.

Control Esc

Control Esc

Control Esc specialises in IT support, software development and technology consultancy including digital forensics, network security and disaster recovery.

Cyber Security Centre - University of Kent

Cyber Security Centre - University of Kent

The centre harnesses expertise across the University to address current and potential cyber security challenges.

MetricStream

MetricStream

MetricStream provide integrated GRC solutions across business, IT, and security functions.

Conscia

Conscia

Conscia provides IT infrastructure solutions and 24/7 services in network, data center, security and mobility.

Tigerscheme

Tigerscheme

Tigerscheme is a certification scheme for information security specialists, backed by University standards and covering a wide range of expertise.

Center for Strategic Cyberspace & Security Science (CSCSS)

Center for Strategic Cyberspace & Security Science (CSCSS)

CSCSS seeks to advance global cyberspace security and prosperity by providing strategic insights for cyberspace and policy solutions to decision makers.

Coronet

Coronet

Coronet is a cloud-based platform that enables every business to secure its cloud operations in minutes.

OSIRIS Lab - NYU Tandon

OSIRIS Lab - NYU Tandon

The Offensive Security, Incident Response & Internet Security Lab (OSIRIS) is a security research environment where students analyze and understand how attackers take advantage of real systems.

TEISS Recruitment

TEISS Recruitment

TEISS Recruitment is a specialist in providing contract, permanent and temporary recruitment services to the cyber and information security sector.

National Cybersecurity Institute (NCI) - Excelsior College

National Cybersecurity Institute (NCI) - Excelsior College

NCI is Excelsior College’s research center dedicated to assisting government, industry, military and academic sectors meet the challenges in cybersecurity policy, technology and education.

Hdac Technology

Hdac Technology

Hdac Technology's mission is to create a frictionless experience for all transactions using blockchain technology by improving current services and building new blockchain applications.