Netcraft has found that Halifax has been left vulnerable to convincing impersonation attacks for five years. The operator of a website promoting Spanish hotels is able to send and receive emails on the official Halifax online banking domain, and get legitimate security certificates issued for the same domain.

Halifax Online

Halifax operates its online banking service on a separate domain (halifax-online.co.uk) to its main website (halifax.co.uk).

The entry point to Halifax's banking service is via www.halifax-online.co.uk. Visitors to the site without the www. prefix are presented with a browser error.

halifax-online.co.uk

The mail server configuration of halifax-online.co.uk domain is configured in such a way that makes it open to attack.

MX records

A Mail Exchanger (MX) record publishes the location where email should be sent to for addresses on that domain. For example, Netcraft’s own MX records point to mail.netcraft.com. Any system wanting to send email to info@netcraft.com would look up the MX record for netcraft.com, and see they need to forward the email to mail.netcraft.com.

It is common for many domain name owners to delegate its mail processing to a third-party service; Microsoft and Google are notable providers. In the case of halifax-online.co.uk, the MX records point to mail.btwebworld.com.

BT WebWorld

BT WebWorld was a B2B web host and email service offered by BT. BT WebWorld launched in October 1996 and was discontinued in 2013/2014. During its heyday, BT WebWorld was a popular hosting provider used by many British SMEs and large organisations.

The domain name, btwebworld.com, continued to belong to BT until 2015, at which time the domain registration lapsed. It was then registered by an unaffiliated party on 22nd November 2015, and presently redirects to a hotel-themed website. Some of the original BT WebWorld website content has been copied on to this website. This is likely an attempt by the operator of the website to appear more genuine to search providers, in the hopes of increasing visibility in search results.

Metadata for the IP Address used by btwebworld.com indicates the server is located in Dominica. However, tracing the IP Address shows the server is probably located on the east coast of America. The stated location of the IP Address may have been chosen in an attempt to place the website outside the jurisdiction of certain law enforcement agencies.

Screenshot of btwebworld.com

Why is this a concern?

Any Halifax customer aware of the halifax-online.co.uk website would unlikely be concerned if they received an email appearing to be from halifax-online.co.uk, and could be tricked into sending sensitive information to email accounts on the same domain.

Inconsistent configuration of Halifax’s SPF record increases the chance that fraudulent emails purporting to be from halifax-online.co.uk do not get sent to the ‘spam’ folder, and Halifax would not be alerted to spoofed emails.

Being able to receive email at @halifax-online.co.uk addresses also allows the domain owner to request TLS certificates for the official Halifax online banking domain. This would allow a fraudster to create convincing impersonations of the Halifax website.

SPF

Sender Policy Framework (SPF) is a mechanism that allows a domain name owner to assert control over which servers are permitted to send email from that domain.

An SPF record includes a list of IP Addresses that are allowed to send email for the domain, and an instruction informing email servers how to process email they receive which does not originate from one of the allowed IP Addresses. When a mail server receives an email, the mail server may perform a lookup of the SPF record for the associated domain to determine whether the email is genuine.

A misconfigured SPF record can be advantageous to fraudsters. Email that is permitted by an SPF record is more likely to land in the user’s inbox. Email not permitted is more likely to land in the ‘spam’ folder, or not even get delivered.

The SPF record for halifax-online.co.uk instructs mail servers to only allow email from IP Addresses in its MX record, which in this case is btwebworld.com.

The owner of btwebworld.com — or any sites that share the same email server — would be able to successfully send email from @halifax-online.co.uk addresses, even to email servers which perform checks on SPF records.

TLS Certificates

In order to obtain a certificate issued for a website and appear ‘secure’ the owner of that website needs to prove to a Certificate Authority that they have control over the website. One common method is to prove that you can receive emails sent to a special email address on the domain.

Certificate Transparency (CT) is an initiative where Certificate Authorities publish certificates they issue. This allows unauthorised certificates to be identified. The authorised party could then request the certificate be revoked — although most browsers do not check if certificates have been revoked. It could also request the unauthorised website be taken offline. Providing evidence that the certificate has been included in a CT log is only a requirement for the Chrome browser and recent versions of iOS.

This kind of attack could be partially mitigated through the use of Certificate Authority Authorization (CAA) records. These records allow the domain owner to list the set of Certificate Authorities that are permitted to issue certificates for sites on that domain. There is no CAA record on halifax-online.co.uk.

The end result is that it would be possible for the owner of btwebworld.com to request — and be issued with — a valid certificate for the official Halifax online banking website. The owner could request the certificate from a Certificate Authority that does not require certificates they issue to be logged, reducing the chance of discovery, and would, at least for a significant proportion of web users, appear in the web browser as ‘secure’.

Combined with another attack, such as man-in-the-middle, it would be trivial for a fraudster to create a highly convincing impersonation designed to capture banking credentials of Halifax customers.

Who else is affected?

Netcraft found 131 other domains that still point its MX records at btwebworld.com, including three other Halifax domains, the primary domain of BT’s own BT Wholesale division, 13 domains owned by investment bank Rothschild & Co, a domain for UK insurance company esure, a sub-domain of the NHS, and a domain belonging to soft-drinks company Robinsons.

Netcraft has also found that www.e-commerce.bt.com and www.btbroadband.com both resolve to the same IP Address as btwebworld.com. The owner of this IP Address would be able to set up a phishing attack against BT under an official BT domain.

Remediations

Halifax can make simple changes to their DNS in order to protect itself and its customers from impersonation attacks:

• redirect halifax-online.co.uk to www.halifax-online.co.uk to prevent visitors attempting to try alternative combinations that might lead them to fraud;
• update or remove MX records to prevent email being delivered to a non-affiliated website;
• update the SPF policy to reject emails sent from halifax-online.co.uk addresses if it not used for that purpose by Halifax;
• add CAA records to ensure only Halifax’s chosen Certificate Authorities are permitted to issue certificates for its domains.

Netcraft has found 171 phishing attacks impersonating Halifax over the past 12 months.

Netcraft offers a range of services to protect organisations against cybercrime, including monitoring of DNS for look-a-like domains, SPF record auditing, and processing DMARC email reports.

Rackspace had the most reliable hosting company site in March 2019. This is the second month in a row, and the third time in the last 12 months, that Rackspace has topped the ranking. Rackspace offers a range of managed dedicated and cloud hosting solutions.

The top five hosting company sites each responded to all of Netcraft's requests in March; to break the tie they are ranked by average connection times. This puts New York Internet in second place. NYI offers bare metal, cloud and colocation services in its US datacentres. One.com took third place, appearing in the top 10 for a second consecutive month. One.com offers a variety of internet services including a no-code website builder, 1-click WordPress installations, domain registrations and email hosting.

Linux is used by seven of the top 10 in March and remains the most popular choice of operating system, with the remaining three sites all powered by FreeBSD.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

In the March 2019 survey we received responses from 1,462,021,378 sites, 232,162,099 unique domains, and 8,526,624 web-facing computers. This reflects a loss of 15.8 million sites, but a gain of 2.57 million domains and 160k web-facing computers.

The March survey brings major upheaval in the domains metric. A large 8 million domain switch from Microsoft to nginx at GoDaddy has allowed nginx to overtake Microsoft to gain second place. Many of these freshly-switched domains do not host distinct content, instead redirecting elsewhere. Accordingly, nginx's share of active sites increased by a more moderate 3.3%. The total number of domains using nginx grew by 15.4%, a 3.24 percentage point increase of market share. Microsoft lost 3.95 p.p. Both remain some way behind Apache in the domains metric, which is 13.8 million domains ahead of nginx.

The largest three vendors - Apache, Microsoft, and nginx - showed at least minor increases in the number of active sites using their respective platforms this month. However, there has been an overall decrease in active site numbers over the past year. Apache in particular has seen a significant drop in active sites of around 20 million. In contrast, the LiteSpeed web server has seen more stable growth from month to month, having increased 960k (+31.7%) over the past year. Cloudflare’s server software, which had previously identified itself as a flavour of nginx prior to 2018, also demonstrated significant growth, serving content for 4.54 million more active sites (+65.6%) than it did a year ago.

Within the top million busiest sites, nginx continues to increase its share of the market, with a further small increase of 0.078 p.p. this month. Apache had its first monthly increase since September 2013, gaining back 0.051 p.p. Apache has been on a downward trend since late 2011 when it held around a 66% majority. Despite this, it has still remained the largest vendor amongst the million busiest sites, despite its market share halving to 32.5% as of March 2019. Microsoft servers have also seen a general decrease of market share over time, and its share has fallen to just under 9% this month.

F5 Acquires NGINX

On March 11th, F5 Networks, Inc. announced its acquisition of NGINX, Inc., the developer of the open source nginx web server. A similar announcement was made by NGINX on their website the same day. The acquisition comes with a $670 million price tag.

F5 and NGINX both provide rival sets of products, although the two have traditionally targeted different communities. F5’s BIG-IP line-up provides a variety of specialised products and service-based solutions for application delivery networking. Much of the key functionality provided by BIG-IP products, such as reverse proxying and load-balancing, overlap with the feature set of NGINX Plus, an exclusively software-based product providing a load balancer, web server, and content cache, along with exclusive features not included in the open-source edition of nginx. NGINX has made numerous blog posts and guides promoting its NGINX Plus product over F5’s BIG-IP, with competitive pricing and greater developer agility being common points of discussion.

In March 2019, Netcraft identified 12.6 million domains being served by F5 BIG-IP systems. Most of these BIG-IP systems are used in conjunction with other web server software.

An extremely convincing phishing attack that impersonates a multi-game skin trade bot appears to be using a fake Extended Validation TLS certificate to steal Steam accounts.

The phishing site displaying a fake Extended Validation certificate indicator.

The ongoing phishing attack impersonates TradeIt.gg, which facilitates the trading of skins, weapons and other in-game commodities within popular games like CS:GO, TF2 and DOTA.

When a victim attempts to sign in through Steam to view their inventory on the spoof trading site, Steam's OpenID login form opens in a new window, clearly displaying its use of an Extended Validation certificate issued to Valve Corp...

... or does it?

Extended Validation (EV) certificates offer the highest level of assurance that a website is being operated by a bona fide legal entity, which is why phishers like to make use of them whenever they can. EV certificates typically cost more than both domain and organisation validated certificates, as the issuance process involves a more stringent vetting process.

However, in this case, the fraudster has bypassed all of the expenses and vetting requirements by simply presenting a fake — yet very convincing — EV certificate indicator next to the address bar.

Closer inspection reveals that the Steam login page is also a spoof form, and it is not actually being displayed in a new browser window at all – it is being shown in an interactive, movable iframe that behaves like a window, allowing the fraudster to dress the "window" up however he likes. The tell-tale feature to look out for here is that the fake window cannot be maximized or moved beyond the boundaries of the spoof trading website.

Needless to say, when a victim submits their Steam credentials into this fake window, they will be stolen by a PHP script on the phishing site. The phisher can then monetize the compromised Steam account by selling it directly or by trading the victim's valuable in-game commodities.

Fraudsters have a long history of exploiting user interface redressing vulnerabilities to make better phishing attacks. More than 14 years ago, Netcraft's anti-phishing toolbar community discovered a particularly fiendish set of examples that exploited a vulnerability in Microsoft Internet Explorer, which allowed part of the webpage to be placed on top of the browser's own address bar.

An extremely convincing PayPal phishing attack that took place back in 2005. A bug in IE made it possible for page elements to be placed outside of the browser's viewport, allowing the attacker to place a fake paypal.com address on top of the browser's real address bar, thus hiding the true location of the fraudulent website.

There are often resurgences in these types of attack, but the certificate and address spoofing techniques are usually forced to change as browser security improves and becomes more restrictive. No doubt there will be more attacks like these in the future, as phishing site developers continue to evolve new tricks.

Netcraft has been protecting consumers against phishing attacks for 15 years. You can enjoy the best protection against the latest attacks, including this Steam trading attack, by installing the desktop Netcraft Extension and Netcraft app for Android.

Rackspace had the most reliable hosting company site in February 2019, and has now appeared in the top 10 eight times in the past 12 months. Rackspace offers a range of managed dedicated and cloud hosting solutions.

The top three hosting company sites responded to each of Netcraft's requests in February. Bigstep appears in second place, making February the third consecutive month it has appeared in the top three. Bigstep offers "bare metal" cloud hosting with the flexibility of virtual machines while also providing the isolation and efficiency of bare metal. One.com returns to the top 10 for the first time since October 2018. One.com offers a variety of internet services including a no-code website builder, 1-click WordPress installations, domain registrations and email hosting.

The next sites, placed fourth to sixth, failed to respond to one request from Netcraft. In fourth place is GoDaddy with the fastest average connection speed of 7ms. Hyve Managed Solutions appears in the top 10 for the fourth consecutive month, this time in fifth place. Pair Networks came sixth, with an average connection time of 93ms. The next four sites that made up the top 10 failed to respond to two requests from Netcraft in February 2019.

This month Linux is used by eight of the top 10, remaining the most popular choice. SmartOS makes an appearance in eighth place with EveryCity.

Netcraft measures and makes available the response times of around twenty leading hosting providers' sites. The performance measurements are made at fifteen minute intervals from separate points around the internet, and averages are calculated over the immediately preceding 24 hour period.

From a customer's point of view, the percentage of failed requests is more pertinent than outages on hosting companies' own sites, as this gives a pointer to reliability of routing, and this is why we choose to rank our table by fewest failed requests, rather than shortest periods of outage. In the event the number of failed requests are equal then sites are ranked by average connection times.

Information on the measurement process and current measurements is available.

In the February 2019 survey we received responses from 1,477,803,927 sites, 229,586,773 unique domains, and 8,366,753 web-facing computers. This reflects a loss of 40.4 million sites, and gains of 979k domains, and 157k web-facing computers.

Microsoft experienced the largest gain in domains this month, with a net increase of just over one million. Despite several months of relatively small fluctuating gains and losses, the number of domains running Microsoft server software is on a general upward trend. Its total now stands at 59.3 million domains, up by just under 2.6 million (+4.6%) since this time last year. However, this strong domain growth was not reflected in any other metric this month – Microsoft gained only 478 web-facing computers, made losses both in active sites and within the top million sites, and suffered a sizable loss of 65 million hostnames.

On 20 February, Microsoft published a security advisory regarding a potential denial of service vulnerability in IIS. It can be exploited by sending specially crafted HTTP/2 requests to a Microsoft IIS web server, causing CPU usage to spike to 100% until the malicious connections are killed by IIS. Microsoft has addressed this issue in February's "non-security" update by providing the ability to define limits on the number of HTTP/2 settings parameters allowed over a connection.

nginx's growth in the domains metric was some way behind Microsoft's this month, with an increase of 622k. nginx's current total of 52.6 million domains represents a growth of over 8.6 million domains (+19.1%) since February 2018 – over three times that of Microsoft – however, its market share has remained just under 3 percentage points behind Microsoft's since April 2018. In terms of web-facing computers, nginx experienced the largest increase (+102k), continuing its steady gains in market share. It now holds a 29.0% share of the web-facing computer market with a total of 2.4 million.

The latest version of nginx (1.15.9 mainline) was released on 26 February, with some small changes including two new features and two bug fixes. Another product in the nginx family, NGINX Unit 1.7.1, was also released in February to address a security vulnerability in its router process. NGINX Unit is a lightweight web application server that can serve sandboxed Go, Perl, PHP, Python, Ruby and – soon – Java applications.

Apache is still losing domains, with a decrease of 216k this month, and 7.3 million domains over the past year. Apache is also gradually losing market share in terms of web-facing computers, despite an overall increase in the number of public web servers using it: this month, Apache gained 32.9k web-facing computers, taking its total up to 3.2 million, while competitor growth caused its market share to fall to 38.04%. The latest version, Apache 2.4.38, was released on 22 January. This release in the 2.4.x stable branch is regarded as the best available version of Apache, and includes three security fixes and multiple bug fixes.