British Airways breach: How did hackers get in?英国航空公司被入侵：黑客是怎么进入的？

▌ 部分素材来源于BBC，世界播团队翻译

It isn't clear how hackers boarded BA's website and app - but cyber-security experts have some suggestions

目前还不清楚黑客是如何登陆英国航空的网站和应用程序的，但网络安全专家有一些建议。

British Airways has revealed that hackers managed to breach its website and app, stealing data from many thousands of customers in the process.

英国航空公司透露，黑客成功入侵了该公司的网站和应用程序，窃取了成千上万名客户的数据。

But how was this possible?

但这一切是怎么发生的？

BA has not revealed any technical details about the breach, but cyber-security experts have some suggestions of possible methods used.

英国航空公司尚未透露任何有关此次入侵的技术细节，但网络安全专家对可能采用的方法提出了一些建议。

Names, email addresses and credit card details including card numbers, expiry dates and three-digit CVV codes were stolen by the hackers.

黑客窃取了客户的姓名、电子邮件地址和信用卡详细信息，包括卡号、有效期和三位数的CVV代码。

At first glance, the firm's statement appears to give no details about the hack, but by "reading between the lines", it is possible to infer some potential attack routes, says cyber-security expert Prof Alan Woodward at the University of Surrey.

萨里大学的网络安全专家艾伦·伍德沃德教授说，乍一看，该公司的声明似乎没有给出黑客攻击的细节，但通过“字里行间的解读”可以推断出一些潜在的攻击路线。

Take BA's specification of the exact times and dates between which the attack occurred - 22:58 BST, 21 August 2018 until 21:45 BST, 5 September 2018 inclusive.

以英国航空关于攻击发生的确切时间和日期的说明为例-英国时间2018年8月21日22：58，一直到英国时间2018年9月5日的21：45。

"They very carefully worded the statement to say anybody who made a card payment between those two dates is at risk," says Prof Woodward.

伍德沃德教授表示：“他们非常谨慎地在声明中说，任何在这两天之间用信用卡支付的人都面临风险。”

"It looks very much like the details were nabbed at the point of entry - someone managed to get a script on to the website."

“看上去细节就像是在入口处捕捉到的，有人设法在网站上找到了一个脚本。”

This means that as customers typed in their credit card details, a piece of malicious code on the BA website or app may have been furtively extracting those details and sending them to someone else.

这意味着，当客户输入信用卡的详细信息时，英国航空网站或应用程序上的一段恶意代码可能正在暗中提取这些细节，并将其发送给其他人。

Prof Woodward points out that this is an increasing problem for websites that embed code from third-party suppliers - it's known as a supply chain attack.

伍德沃德教授指出，对于嵌入第三方供应商代码的网站来说，这是一个日益严重的问，这被称为供应链攻击。

Third parties may supply code to run payment authorisation, present ads or allow users to log into external services, for example.

例如，第三方可以提供代码来运行支付授权、提供广告或允许用户登录外部服务。

Popular events ticketing website Ticketmaster was hit with a data breach earlier this year

流行事件票务网站Ticketmaster今年早些时候遭遇数据泄露。

Such an attack appeared to affect Ticketmaster recently, after an on-site customer service chatbot was labelled as the potential cause of a breach affecting up to 40,000 UK users.

这种攻击最近似乎影响到了Ticketmaster，因为一个在线客户服务聊天机器人被贴上潜在的漏洞标签，影响多达4万英国用户。

Without further details, there is no way of knowing for sure if something similar has happened to BA. Prof Woodward points out it may just as easily have been a company insider who tampered with the website and app's code for malicious purposes.

如果没有更多的细节，就无法确定是否有类似的事情发生在英国航空公司身上。伍德沃德教授指出，这很有可能一名公司内部人士做的，他为了恶意目的篡改了该网站和应用程序的代码。

Because CVV data, the three-digit security code on credit and debit cards, was also taken in the attack, it is indeed likely the details were lifted live, according to Robert Pritchard, a former cyber-security researcher at GCHQ and founder of private firm The Cyber Security Expert.

据政府通信总局前网络安全研究员、私人公司“网络安全专家”创始人罗伯特·普里查德称，由于CVV数据，即信用卡和借记卡上的三位数安全代码也是在这次攻击中被窃取的，所以细节很可能是被实时删除的。

This is because CVV codes are not meant to be stored by companies, though they may be processed at payment time.

这是因为CVV代码不由公司存储，尽管它们可能在付款时被处理。

"This means it was either a direct compromise of their... booking site, or compromise of a third party provider," he told the BBC.

“这意味着要么是对他们的预订网站的直接妥协，要么是第三方提供商的妥协，”他告诉BBC。

Prof Woodward added that private firms using third party code on their websites and apps must continually vet such products, to ensure weak points in security don't emerge.

伍德沃德教授补充说，在网站和应用程序上使用第三方代码的私营企业必须不断审查此类产品，以确保不会出现安全方面的缺口。

"You can put the strongest lock you like on the front door," he said, "but if the builders have left a ladder up to a window, where do you think the burglars will go?"

“你可以把你喜欢的最坚固的锁放在前门上，”他说，“但是如果建筑工人把梯子留在窗户上，你认为窃贼会去哪里”？

世界播，天下大事全掌握！中英双语呈现，还可以加强英语学习哦！

这事你怎么看？欢迎留言探讨