{"id":13876,"date":"2018-11-20T10:10:04","date_gmt":"2018-11-20T18:10:04","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/11\/20\/news-7643\/"},"modified":"2018-11-20T10:10:04","modified_gmt":"2018-11-20T18:10:04","slug":"news-7643","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/11\/20\/news-7643\/","title":{"rendered":"Web skimmers compete in Umbro Brasil hack"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 20 Nov 2018 16:51:57 +0000<\/strong><\/p>\n

Umbro,\u00a0the popular sportswear brand has had their Umbro Brasil<\/a> website hacked and injected with not one but two web skimmers part of the Magecart group.<\/p>\n

Magecart has become a household name in recent months due to high profile attacks on various merchant websites. Criminals can seamlessly steal payment and contact information from visitors purchasing products or services online.<\/p>\n

Multiple threat actors are competing at different scales to get their share of the pie. As a result, there are many different web skimming scripts and groups that focus on particular types of merchants or geographical areas.<\/p>\n

Case in point, in this Umbro Brasil compromise, one of the two skimming scripts checks for the presence of other skimming code and if present will slightly alter the credit card number that was entered by the victim. Effectively, the first skimmer will receive wrong credit card numbers as a direct act of sabotage.<\/p>\n

Two skimmers go head to head<\/h3>\n

The Umbro Brasil website (umbro.com[.]br<\/a>) runs the Magento e-commerce platform.\u00a0The first skimmer is loaded via a fake BootStrap library domain bootstrap-js[.]com<\/em>, recently discussed by Brian Krebs<\/a>. Looking at its code, we see that it fits the profile of threat actors predominantly active in South America, according to a recent report from\u00a0RiskIQ<\/a>.<\/p>\n

\"\"<\/a><\/p>\n

1st skimmer with code exposed in plain sight (conditional with referer check)<\/p>\n<\/div>\n

This skimmer is not obfuscated and exfiltrates the data in a standard JSON output. However, another skimmer is also present on the same site, loaded from g-statistic[.]com<\/em>. This time, it is heavily obfuscated as seen in the picture below:<\/p>\n

\"\"<\/a><\/p>\n

2nd skimmer, showing large obfuscation blurb<\/p>\n<\/div>\n

No fairplay between Magecart groups<\/h3>\n

Another interesting aspect is how the second skimmer alters the credit card number from the first skimmer. Before the form data is being sent, it grabs the credit card number and replaces its last digit with a random number.<\/p>\n

The following code snippet shows how certain domain names trigger this mechanism. Here we recognize bootstrap-js[.]com,<\/em> which is the first skimmer. Then, a random integer ranging from 0 to 9 is generated for later use. Finally, the credit card number is stripped of its last digit and the previously generated random number is used.<\/p>\n

\"\"<\/p>\n

Code to conditionally swap the last digit of the credit card (decoding courtesy of Willem de Groot)<\/p>\n<\/div>\n

By tampering with the data, the second skimmer can send an invalid but\u00a0almost<\/em> correct credit card number to the competing skimmer. Because only a small part of it was changed, it will most likely pass validation tests and go on sale on black markets. Buyers will eventually realize their purchased credit cards are not working and will not trust that seller again.<\/p>\n

The second skimmer, now being the only one to hold the valid credit card number, uses a special function to encode the data it exfiltrates. Looking at the POST request, we can only see what looks like gibberish sent to its exfiltration domain (onlineclouds[.]cloud<\/em>):<\/p>\n

\"\"<\/a><\/p>\n

Encoded data sent back to exfiltration server<\/p>\n<\/div>\n

This situation where multiple infections reside on the same host is not unusual. Indeed, unless a vulnerability with a webserver is fixed, it can be prone to several compromises by different perpetrators. Sometimes they can coexist peacefully, sometimes they are directly competing for the same resources.<\/p>\n

Coolest sport in town<\/h3>\n

While web skimming has been going on for years, it has now become a very common (re-)occurrence. Security researcher Willem de Groot<\/a> has aggregated data for 40K websites<\/a> since counting in 2015. His study also shows that reinfection among e-commerce sites (20% reinfection rate) is a problem that needs addressing.<\/p>\n

Website owners that handle payment processing need to do due diligence in securing their platform by keeping their software and plugins up-to-date, as well as paying special attention to third-party scripts.<\/p>\n

Consumers also need to be aware of this threat when shopping online, even if the merchant is a well known and reputable brand. On top of closely monitoring their bank statements, they should consider ways in which they can limit the damage from malicious withdrawals.<\/p>\n

We have informed CERT.br<\/a> of this compromise and even though the skimmers are still online, Malwarebytes users are covered by our web protection module.<\/p>\n

Acknowledgments:<\/em><\/h3>\n

Thanks to Willem de Groot<\/a> for his assistance in this research.<\/p>\n

IOCs<\/h3>\n

Skimmers<\/p>\n

1st skimmer: bootstrap-js[.]com  2nd skimmer:\u00a0g-statistic[.]com<\/pre>\n
Exfiltration<\/p>\n
1st skimmer's exfil domain:\u00a0bootstrap-js[.]com  2nd skimmer's exfil domain:\u00a0onlineclouds[.]cloud<\/pre>\n
The post Web skimmers compete in Umbro Brasil hack<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Tue, 20 Nov 2018 16:51:57 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
In this web skimming match between two Magecart groups, there can only be one winner.<\/p>\n
Categories: <\/p>\n