BA systems down globally
Discussion
Harpoon said:
RiskIQ are attributing the attack to the same group (Magecart) that hit Ticketmaster and others
https://www.riskiq.com/blog/labs/magecart-ticketma...
ha just clicked on the linked, and they wanted to download something to my machine with regard to their cookie preferences............https://www.riskiq.com/blog/labs/magecart-ticketma...
brilliant............that'll be a no then.
It's like looking at a porn site and giving them your card details
Tin Foil Selfish Gene at your service.
The Selfish Gene said:
If someone injects code into your baseline, at the appropriate time it (the baseline) will be functionally tested and flow through the lifecycle. Thereby making it from the 'sandpit' , to functional and integration testing.
Probably thats the bit I dont understand. If the code is injected at the baseline, why couldnt the rogue message be picked up at either the functionality or integration stages? I assume all network activity is logged at those stages.Edited by s2art on Tuesday 11th September 17:00
s2art said:
The Selfish Gene said:
If someone injects code into your baseline, at the appropriate time it (the baseline) will be functionally tested and flow through the lifecycle. Thereby making it from the 'sandpit' , to functional and integration testing.
Probably thats the bit I dont understand. If the code is injected at the baseline, why couldnt the rogue message be picked up and either the functionality or integration stages? I assume all network activity is logged at those stages.However, all of these things are done on a risk based methodology.
Hence why I mentioned Fagan inspections when I worked on military application of code (a long time ago, I'm sure they do something else now)
It 'can' be done - but in reality - we here, are doing 4 massive releases a year, with additional minor releases and code fixes constantly.
It just wouldn't be feasible to test to that level every time.
Obviously there are elements that are more 'agile' - front ends being one of them.
think generally for software principle in big organisations oil tanker, not fighter plane.
Unless they're very small implementations.
Elements of course will be fast moving - but billing systems, databases , designs and coding is often slower work than you would imagine.
All that being said - I'm pretty sure this will end up being cheap, unskilled testing from third party companies and BA taking their eye of the security ball..............
and it's cost them, twice, hugely for cash and reputation.
hence why the guy in charge should have got the bullet.
The Selfish Gene said:
Elements of course will be fast moving - but billing systems, databases , designs and coding is often slower work than you would imagine.
Not slower than I imagine. The biggest (and most secure system) I worked on took something like 5 years from start of dev to live running. And that was just phase one.to add - the risk profile previously didn't show it was necessary, as it hardly happened. i.e it's still making headline news and thus is a relatively new issue.
Now it's happening much more, most organisations are working much harder to prevent (good news for anyone that is in the industry) and the risk profile and due diligence is getting much stronger.
as I've mentioned a few times - I'm heading up a element of a programme that is designed to tackle exactly this sort of thing. It's taking 3 years...........more money than I care to mention and a massive team of experts from all over the world to implement the necessary.
Now it's happening much more, most organisations are working much harder to prevent (good news for anyone that is in the industry) and the risk profile and due diligence is getting much stronger.
as I've mentioned a few times - I'm heading up a element of a programme that is designed to tackle exactly this sort of thing. It's taking 3 years...........more money than I care to mention and a massive team of experts from all over the world to implement the necessary.
s2art said:
The Selfish Gene said:
Elements of course will be fast moving - but billing systems, databases , designs and coding is often slower work than you would imagine.
Not slower than I imagine. The biggest (and most secure system) I worked on took something like 5 years from start of dev to live running. And that was just phase one.The Selfish Gene said:
s2art said:
The Selfish Gene said:
Elements of course will be fast moving - but billing systems, databases , designs and coding is often slower work than you would imagine.
Not slower than I imagine. The biggest (and most secure system) I worked on took something like 5 years from start of dev to live running. And that was just phase one.anonymous said:
[redacted]
CSP covers the loading of scripts and also the actions performed by the site - connect-src blocks stuff like XMLHttpRequest, WebSockets etcba.com/index.html has header Content-Security-Policy: connect-src: 'self'
That page can load ba.com/hacked-script.js, which is prevented from using XMLHttpRequest.send() to anything except ba.com
bad company said:
I was one of those whose data was stolen. BA are still not able to let me change my password due to ‘an IT problem’.
I’d have thought that given what has happened they would prioritise getting customers to change their passwords.
If the passwords were affected they'd have to reset them all immediately, and by the looks of the javascript only the form data from the payment page was targeted.I’d have thought that given what has happened they would prioritise getting customers to change their passwords.
essayer said:
At the point hackers have the ability to modify files on your web server, iframes aren’t going to make much difference - they’ll modify your payment pages, or if the external iframe is under your control, they’ll go after that too.
It'd be a lot harder to alter an external IFRAMEd payment process work though... the reason this was so successful was that it made zero changes to the functioning parts of the system.anonymous said:
[redacted]
The script was in a directory called "/cms/global/scripts..." so there was likely some sort of CMS, even if an internal custom system.CzechItOut said:
Does anyone else find it strange now little detailed analysis available in the public domain there seems to be of these hacks? How are companies supposed to learn from other's mistakes when the information is so rarely available?
it does happen, but privately.We spend time in various organisations swapping lessons learned, and technical detail, by invite only though.
anonymous said:
[redacted]
That's a problem though, isn't it? When an airliner crashes there is a forensic level investigation and the results are shared with the industry. Why shouldn't this happen in IT? At the end of the day, it is in everyone's best interests, as not only will BA face financial losses for card compromised, damage to their brand and ultimately fines from regulators.I'm not even sure it is a financial limitation. Companies seem to be spending fortunes on cyber security teams, which in my opinion is an ineffective way to secure your systems.
safety critical systems are treated in that way. Such as an airliner.
They have a very different level of focus and cost.
IT systems don't have that, and shouldn't have. (unless they're on a safety critical implementation)
It would be too expensive.
It's a happy medium.
Think of it as terrorism. Mi5/Mi6 can't chase every single lead, they risk assess and chase the most high risk.
that's fine always, unless of course a bomb goes off and it slips through the net.
the BA hack is the bomb in IT Terms.
Or to quote Armageddon............"it's a big ass sky"
They have a very different level of focus and cost.
IT systems don't have that, and shouldn't have. (unless they're on a safety critical implementation)
It would be too expensive.
It's a happy medium.
Think of it as terrorism. Mi5/Mi6 can't chase every single lead, they risk assess and chase the most high risk.
that's fine always, unless of course a bomb goes off and it slips through the net.
the BA hack is the bomb in IT Terms.
Or to quote Armageddon............"it's a big ass sky"
CzechItOut said:
That's a problem though, isn't it? When an airliner crashes there is a forensic level investigation and the results are shared with the industry. Why shouldn't this happen in IT? At the end of the day, it is in everyone's best interests, as not only will BA face financial losses for card compromised, damage to their brand and ultimately fines from regulators.
I'm not even sure it is a financial limitation. Companies seem to be spending fortunes on cyber security teams, which in my opinion is an ineffective way to secure your systems.
Aeroplanes, for all their complexity, are all very similar. If a hinge fails on a door on one 737, then it is likely to fail on all of them. So they crawl all over the wreckage, find what broke, and then make sure everyone fixes it. Similar for the human factors side: an overloaded pilot is the same in any situation, so it is worth finding out why they were overloaded, and then making sure it doesn’t happen again. I'm not even sure it is a financial limitation. Companies seem to be spending fortunes on cyber security teams, which in my opinion is an ineffective way to secure your systems.
IT systems are very different. I’ve been in the business for er, several decades, and I’ve not once seen two implementations that were the same, even when they were using the same underlying software. Even when companies decide to use an external service (one of the premises behind cloud), they will use it in subtly different ways. A “lesson learned” in one place may not be relevant to others. Software suppliers (either closed or open source) do update their code all the time to fix problems - but that may open up new issues in something that someone has built.
Two other points.
The number of companies that you’d expect to be really thorough ... but stick largely untested software into production is eye watering. Generally functional stuff (does it work?) is tested, but no one is really interested in other aspects (does it perform, is it secure) because the skills to do that properly are expensive. It’s also not very interesting for people whose focus is business growth or whatever. They view hard technical stuff as “in the IT domain”, and they’d rather IT spent less money... For the avoidance of doubt, I’m not saying BA do this, I’ve never worked for them, but lots of organisations do.
There’s also no commercial advantage to a company in revealing stuff they’ve found. It’s generally embarasssing, and its cost them a fortune to find it. Why share competitive advantage? The software suppliers will generally be involved, and will fix whatever they can.
rxe said:
IT systems are very different. I’ve been in the business for er, several decades, and I’ve not once seen two implementations that were the same, even when they were using the same underlying software. Even when companies decide to use an external service (one of the premises behind cloud), they will use it in subtly different ways. A “lesson learned” in one place may not be relevant to others. Software suppliers (either closed or open source) do update their code all the time to fix problems - but that may open up new issues in something that someone has built.
Not that different. BA sought to save money by not doing a code audit until after a breach.
If you've ever worked on any kind of Mil Spec system (as in the £5 per bolt to ensure you know which day the zinc in the anti-corrosion coating was mined on) they will go over every line and only use the lines they require.
It looks like BA built a system on the cheap, rather than writing their own libraries, just took one from another source without auditing the code.
This is why card information should never be stored by merchants. Ultimately we can't trust them to do a proper job.
dmsims said:
Except BA did not find it
Having control of what file are on your web server and monitoring them for changes should be in the IT for dummies book
you're simplifying it again.Having control of what file are on your web server and monitoring them for changes should be in the IT for dummies book
We are talking the most complicated programmes of work.
Which of my 100 systems across 9 environments for 1/5th of the business that we are updating constantly would you like me to monitor? Also what would you like me to monitor it for?
Someone injecting 20 lines of code?
We are taking extreme measures (currently sat in a room with around 20 people in a design workshop).
The cheapest salary bill in this room is north of 100k.......most expensive north of 300k.
Massive work goes into this.
Granted - BA have been caught with their pants down, twice.
many other companies have been that you haven't heard about.
It is an entire massive industry building and securing these systems.
Technology is constantly changing.
I'm not making excuses for the industry, I'm saying that you haven't heard about the 1000s (daily) hacks that we have stopped.
You hear about the one, that cost BA and its customers some money.
I could list you another 50 much worse than what you know of BA this year alone.
The criminals are highly motivated, higher trained and highly paid.
That's before we even get into entire governments doing it to destabilise other economies.
Frankly - the UK has been caught napping in many respects.
anonymous said:
[redacted]
I read it as a third party library was used to gain access. anonymous said:
[redacted]
Erm you do audit your production code... This is how they found the vulnerability. anonymous said:
[redacted]
If it doesn't make sense to you, that would be your issue. I've worked with banking, finance and insurance. Nothing goes into production without being checked and triple checked. Any slightly ambiguous sources of code to be used with payment information is discarded. Unless they know exactly what the code does, it's not implemented.
The problem with this approach is it's not cheap. You need talented people who can write their own code rather than copy/pasting from Stack Overflow.
Gassing Station | News, Politics & Economics | Top of Page | What's New | My Stuff