Iceman Group : reveals one of its own hacking operations
في منتصف شهر مايو
/ أيار 17،
كشفت كاسبيرسكي لابس عن هجوم DNS
لم يسبق له مثيل على
بنك برازيلي لم يكشف عن اسمه والذي حصل
في 16 أكتوبر.
يبدو أن المهاجمين
سيطروا على كل نظام DNS في
شبكة البنك، وبذلك تمكنوا من إعادة توجيه
جميع حركة المرور المرتبطة بالبنوك من
خلال الخوادم الخبيثة الخاصة بهم.
استمر الهجوم لمدة
6 ساعات،
حيث تم تسريب عدد لا يحصى من معلومات قيمة
والخاصة في العملاء لأيدي المهاجمين .
تم الكشف أن المجموعة
التي تقف وراء هذا الهجوم كانت "مجموعة
رجال الثلج" "Iceman Group”،
وهي مجموعة صاعدة في عالم القرصنة المالية.
هذا هو الهجوم
المعروف الوحيد لهذه المجموعة، حيث أن
معظم الهجمات التي نفذت على ما يبدو من
قبل هذه المجموعة لم يتم الكشف عنها .
مرفق المقالة باللغة
الانجليزية تشرح بالضبط الطريقة التي
استخدمتها المجموعة للنجاح باختراقها
للبنك
The Iceman Group started their attack by aiming at the NIC.BR service
- the one from which all Brazilian domains get their redirections. From
this point on, finding and infecting the DNS servers of the said bank -
now revealed to be Banrisul Bank - was a much easier task.
After the successful redirection of the DNS Records of the bank, Iceman turned their own servers into complete replicas of the Bank’s Services. SSL encryption of the traffic aimed for the replica servers was done by tricking the site “Let’s Encrypt” into believing The Iceman’s control over the servers was legit. The individual of the group claims that the group have used an inside access to several bank’s employees email accounts in order to deceive “Let’s Encrypt” company.
Throughout the 6 hours the attack lasted, every login attempt into the bank was transferred through the Iceman Group.
“Let this be a slight warning for you all finance crooks”, those were his last words.
A full interview will be published soon.
After the successful redirection of the DNS Records of the bank, Iceman turned their own servers into complete replicas of the Bank’s Services. SSL encryption of the traffic aimed for the replica servers was done by tricking the site “Let’s Encrypt” into believing The Iceman’s control over the servers was legit. The individual of the group claims that the group have used an inside access to several bank’s employees email accounts in order to deceive “Let’s Encrypt” company.
Throughout the 6 hours the attack lasted, every login attempt into the bank was transferred through the Iceman Group.
“Let this be a slight warning for you all finance crooks”, those were his last words.
A full interview will be published soon.
http://zepurplehat.blogspot.ch/2017/08/the-iceman-group.html
Comments
Post a Comment