{"id":17829,"date":"2020-02-26T10:10:02","date_gmt":"2020-02-26T18:10:02","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2020\/02\/26\/news-11562\/"},"modified":"2020-02-26T10:10:02","modified_gmt":"2020-02-26T18:10:02","slug":"news-11562","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/02\/26\/news-11562\/","title":{"rendered":"Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server"},"content":{"rendered":"

Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Feb 2020 17:03:11 +0000<\/strong><\/p>\n

Threat actors love to abuse legitimate brands and infrastructure\u2014this, we know. Last year we exposed<\/a> how web skimmers had found their way onto Amazon’s Cloudfront content delivery network (CDN) via insecure S3 buckets. Now, we discovered scammers pretending to be CDNs while exfiltrating data and hiding their tracks\u2014another reason to keep watchful eye on third-party content.<\/p>\n

Sometimes, what looks like a CDN may turn out to be anything but. Using lookalike domains is nothing new among malware authors. One trend we see a fair bit with web skimmers in particular is domains that mimic Google Analytics: Practically all websites use this service for their ranking and statistics, so it makes for credible copycats.<\/p>\n

In the latest case, we caught scammers using two different domains pretending to be a CDN. While typically the second piece of the infrastructure is used for data exfiltration, it only acts as an intermediary that attempts to hide the actual exfiltration server.<\/p>\n

Oddly, the crooks decided to use a local web server exposed to the Internet via the free ngrok service\u2014a reverse proxy software that creates secure tunnels\u2014to collect the stolen data. This combination of tricks and technologies shows us that fraudsters can devise custom schemes in an attempt to evade detection.<\/p>\n

Inspecting code for unauthorized third-parties<\/h3>\n

We identified suspicious code on the website for a popular Parisian boutique store. However, to the naked eye, the script in question looks just like another jQuery library loaded from a third-party CDN.<\/p>\n

\"\"
Figure 1: Compromised online store, with source code showing a CDN like domain<\/em><\/figcaption><\/figure>\n

Although the domain name (cdn-sources[.]org) alludes to a CDN, and unveil.js is a legitimate library<\/a>, a quick look at the content shows some inconsistencies. There should not be fields looking for a credit card number for this kind of plugin.<\/p>\n

\"\"
Figure 2: A malicious third-party library impersonating a legitimate one<\/em><\/figcaption><\/figure>\n

To clear any doubts, we decided to check an archived copy of the site and compared it with a live snapshot. We can indeed see that this script did not exist just a couple of weeks prior. Either it was added by the site owner, or in this case, injected by attackers.<\/p>\n

\"\"
Figure 3: Snapshots comparing online store before and after the hack<\/em><\/figcaption><\/figure>\n

The script checks for the current URL in the address bar and if it matches with that of a checkout page, it begins collecting form data. This typically includes the shopper’s name, address, email, phone number, and credit card information.<\/p>\n

\"\"
Figure 4: Another fake CDN domain used as part of the data exfiltration process<\/em><\/figcaption><\/figure>\n

Data exfiltration via ngrok server<\/h3>\n

Once this data is collected, the skimmer will exfiltrate it to a remote location. Here, we see yet another CDN lookalike in cdn-mediafiles[.]org. However, after checking the network traffic, we noticed this is not the actual exfiltration domain, but simply an intermediary.<\/p>\n

GET https:\/\/cdn-mediafiles.org\/cache.php HTTP\/1.1 Host: cdn-mediafiles.org<\/strong> Connection: keep-alive Accept: \/<\/em> Sec-Fetch-Site: cross-site Sec-Fetch-Mode: cors Referer: https:\/\/www.{removed}.com\/checkout\/onepage\/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9  HTTP\/1.1 200 OK Content-Type: text\/html; charset=UTF-8 Connection: keep-alive Content-Length: 36 Ly9kNjgzNDRmYi5uZ3Jvay5pby9hZC5waHA=<\/strong><\/pre>\n
Instead, the GET request returns a Base64 encoded response. This string, which was already present in the original skimmer script, decodes to \/\/d68344fb.ngrok[.]io\/ad.php which turns out to be the actual exfiltration server.<\/p>\n
\"\"
Figure 5: Customer data being stolen and exfiltrated to ngrok server<\/em><\/figcaption><\/figure>\n
Ngrok<\/a> is software that can expose a local machine to the outside as if it was an external server. Users can create a free account and get a public URL. Crooks have abused ngrok to exfiltrate credit card data before<\/a>.<\/p>\n
To summarize, the compromised e-commerce site loads a skimmer from a domain made to look like a CDN. Data is collected when a shopper is about to make a payment and sent to a custom ngrok server after a simple redirect.<\/p>\n
\"\"
Figure 6: Traffic flow, from skimming to data exfiltration<\/em><\/figcaption><\/figure>\n
The above view is simplified, only keeping the key elements responsible for the skimming activity. In practice, network captures will contain hundreds more sequences that will make it more difficult to isolate the actual malicious activity.<\/p>\n
Blocking and reporting<\/h3>\n
We caught this campaign early on, and at the time only a handful of sites had been injected with the skimmer. We reported it to the affected parties while also making sure that Malwarebytes users<\/a> were protected against it.<\/p>\n
\"\"
Figure 7: Malwarebytes blocking the skimmer on the checkout page<\/em><\/figcaption><\/figure>\n
Threat actors know they typically have a small window of opportunity before their infrastructure gets detected and possibly shutdown. They can devise clever tricks to mask their activity in addition to using domains that are either fresh or belong to legitimate (but abused) owners.<\/p>\n
While these breaches hurt the reputation of online merchants, customers also suffer the consequences of a hack. Not only do they have to go through the hassle of getting new credit cards, their identities are stolen as well, opening the door to future phishing attacks<\/a> and impersonation attempts.<\/p>\n
Indicators of Compromise<\/h3>\n
Web skimmer domain<\/strong><\/p>\n
cdn-sources[.]org<\/pre>\n
Web skimmer scripts<\/strong><\/p>\n
cdn-sources[.]org\/jquery.unveil.js
cdn-sources[.]org\/adrum-4.4.3.717.js
cdn-sources[.]org\/jquery.social.share.2.2.min.js<\/pre>\n
Redirect<\/strong><\/p>\n
cdn-mediafiles[.]org\/cache.php<\/pre>\n
Exfiltration URL<\/strong><\/p>\n
d68344fb.ngrok[.]io\/ad.php<\/pre>\n
The post Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server<\/a> appeared first on Malwarebytes Labs<\/a>.<\/p>\n
https:\/\/blog.malwarebytes.com\/feed\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Credit to Author: J\u00e9r\u00f4me Segura| Date: Wed, 26 Feb 2020 17:03:11 +0000<\/strong><\/p>\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Criminals set up fraudulent infrastructure that looks like a typical content delivery network\u2014except it isn’t. Behind it hides a credit card skimmer injected into Magento online stores.<\/p>\n
Categories: <\/p>\n