Web Platform Pentesting and Data Breach Consulting for a Trading Services Provider

Summary

A UK-based fintech company offering mobile and web trading platforms suffered a data breach caused by an attack on its main web platform. With a 14-day regulatory deadline to investigate and report, the Customer engaged INNERLUXES for gray-box penetration testing. INNERLUXES completed the project in 13 days, found the platform highly secure with only low-severity issues, and helped the Customer report its mitigation efforts — leading regulators to close the case with no further investigation or fines.

About the Customer

The Customer is a UK-based fintech company providing services worldwide. It offers sleek, easy-to-use mobile applications and web platforms to facilitate its clients' financial trading experience.

The Challenge

The Customer puts much effort into ensuring its clients' data security and maintaining compliance with financial security standards. Despite the solid security measures in place, it suffered a data breach caused by an attack on its main web platform.

After notifying the regulatory authorities of the incident, the Customer was obliged to mitigate the breach consequences and investigate how the attacker had broken the security of its web platform. It needed to conduct comprehensive security testing of the platform within 14 days of the breach to report the results to the regulatory authorities in time.

The Solution

Recognizing INNERLUXES's expertise in cybersecurity, the Customer reached out to investigate the possible causes of the data breach.

To thoroughly explore the web platform's security and report within the deadline, INNERLUXES's security experts chose the gray-box method, authorized under one user role. The testers planned and performed penetration testing according to the OWASP Web Security Testing Guide methodology.

The testing showed that the security level of the web platform was high — it contained no critical security gaps. However, INNERLUXES's testers revealed several low-severity vulnerabilities and demonstrated how a skilled attacker could have exploited them to obtain the Customer's sensitive data. The discovered vulnerabilities included:

• Missing HTTP security headers that could protect the web application against clickjacking, cross-site scripting, and other common attacks.
• Insecure cross-origin resource sharing (CORS) configuration that could be exploited for cross-domain attacks.
• Password fields with autocomplete enabled. With autocomplete on by default, an attacker could easily retrieve the Customer's credentials if they gained access to one of the Customer's devices.
• Deprecated transport security protocols. TLS 1.0 and TLS 1.1 have known vulnerabilities a hacker could exploit to perform man-in-the-middle attacks and observe the traffic between the web platform and its visitors.

To ensure all-around protection of the web platform and prevent future breaches, INNERLUXES provided a detailed guide to the necessary corrective measures, such as:

• Using HTTP security headers such as X-Frame-Options, X-Content-Type-Options, X-XSS-Protection, and Strict-Transport-Security.
• Disabling autocomplete for passwords and implementing multi-factor authentication.
• Configuring CORS correctly — specifying the allowed origins (trusted sites only) in the Access-Control-Allow-Origin header.
• Disabling TLS 1.0 and 1.1 and using secure versions instead.

The pentesting project took 13 days from planning to delivering the final report. Additionally, INNERLUXES's team helped the Customer communicate its breach investigation and mitigation efforts to the regulatory authorities.

The Results

• The Customer got a clear picture of its web platform's security vulnerabilities and how they could be exploited to access sensitive data.
• The Customer received actionable recommendations on protecting its web platform against future cyberattacks.
• With INNERLUXES's help, the Customer proved its diligence in fulfilling compliance requirements and mitigating the data breach — resulting in the regulatory authorities closing the case without further investigation or additional fines.

Technologies and Tools

Nessus, Qualys, Burp Suite, OWASP ZAP, cURL, testssl, DirB.