4

today I went to my Online-Banking by typing in the correct domain name in Firefox. I could login and even see my actual balance. Then within the site a warning appeared that I should do a test-transfere for security reasons (over 7200€...). I didn't do this, but was wondering, because I still stayed on the original domain.

Checking the certificate showed me this (wrong, but valid. To compare with the original one: https://www.sparkasse-suedpfalz.de):

enter image description here

This type of certificate appears on every website I visit (inkluding stackexchange.com or google.com).: Instead of a certificate for [DOMAIN] i get one of *.[DOMAIN], where the CA is VeriSign.: enter image description here

It happens with all browsers (Firefox, chrome, edge), but not with TOR. The OS is Windows 10 Pro, Version 10.0.19042 Build 19042

I dont have any issues on an other machines in the same intranet.

Are all requests from this computer send to a proxy? And how do they manage to insert fake requests to send money to the original domain? Happy if you have an idea what to do.

Improve this question
11
  • The bank certificate is definitely not genuine (original doesn't use wildcards and has a different digest). At least now you know that your system is infected somehow. Backup you data and files and re-install it from a fresh genuine media.
    – Robert
    Jan 13, 2022 at 21:35
  • 2
    Looks like a MITM attack in your network. When using Tor or a VPN originating on your machine you are protected from such attacks since it tunnels through the local network. It is unclear where exactly the attack originates though, might be a compromised router or some other compromised machine on the network or an actual attacker machine inside it. It might also be that your local machine is compromised.
    – Steffen Ullrich
    Jan 13, 2022 at 21:53
  • 3
    Regardless of where the MITM attack is taking place, your system has been compromised, as the attacker was able to install the 'OV Verisign CA' certificate in your system's trust store. This is what is enabling the MITM attack, i.e. the 'OV Verisign CA' certificate in your system's trust store is what is causing your browser to trust the MITM attacker's fake certificates.
    – mti2935
    Jan 13, 2022 at 22:31
  • 3
    You should change all your passwords from a separate machine immediately, and treat this one as compromised. Ideally, follow the instructions from this post
    – nobody
    Jan 13, 2022 at 22:46
  • 2
    @TheGermanGuy When you login to an https web site, the password is sent in plaintext through the TLS tunnel. So, an MITM attacker in this case would be able to see your plaintext password. See security.stackexchange.com/questions/110415/…. The password hashing that you are referring to applies to how passwords are stored on a server. See security.stackexchange.com/questions/211/…
    – mti2935
    Jan 13, 2022 at 22:55

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .