How to Rob an Online Bank (and get away with it) - Acros Security

More documents

Recommendations

Info

Apply: Penetration Testers• Staging != Production• Authentication, back-end processing, scheduled jobs• Find bugs in staging, verify in production• Successful tests in production may be hard to undo(therefore test with small amounts)• Vulnerabilities• Use HTTP proxy* to “eliminate” client user interface• Be really thorough with negative numbers• Base64 encoding is often mere obfuscation• Banks are focused on authentication, not authorization* https://www.owasp.org/index.php/Phoenix/Tools#HTTP_proxying_.2F_editing48
Mitja KolsekACROS d.o.o.www.acrossecurity.commitja.kolsek@acrossecurity.comTwitter: @acrossecurity, @mkolsekThanks: Mikko H. Hypponen, René Pfeiffer, Claudio Criscione, Stefan Ortloff and Candi Carrerafor help with gathering information on national digital certificate usage49
Page 4 and 5: Evolution Of E-banking AttacksPAST-
Page 6 and 7: Attacks Against Corporate UsersGoal
Page 8 and 9: Example: Published Corporate Certif
Page 10 and 11: Direct ResourceAccess10
Page 12: Direct Resource Access - URL Base64
Page 15 and 16: Transaction Creation ProcessI want
Page 17 and 18: Negative Numbers - A Devastating Ov
Page 19 and 20: Creating Money Out Of Thin AirNorma
Page 21 and 22: Normal OverdraftAccount #1:Account
Page 23 and 24: Luca Carettoni & Stefano di Paolaht
Page 25 and 26: HTTP Parameter Pollution(Source Acc
Page 27 and 28: SQL Injection27
Page 29 and 30: SQL Injection - Messing With Transa
Page 31 and 32: SQL Injection - Messing With Transa
Page 33 and 34: Automated Signing Of Deposit Agreem
Page 35 and 36: Server-Side Code ExecutionExamples
Page 37 and 38: Other Attacks• Session Puzzling
Page 40 and 41: Knownat leastsince2001Asymmetric Cu
Page 43 and 44: http://blog.acrossecurity.com/2012/
Page 45 and 46: Apply45
Page 47: Apply: Bankers - Long Term• “Ph

How to Rob an Online Bank (and get away with it) - Acros Security

Create successful ePaper yourself

Delete template?

Save as template?