RiskIQ Blog

> followed the URL returned in the HTML by that request Translated: we can't possibly know it's non-malicious. TFA even has this to say: > And judging from the URL involved, it appears to be an attempt to install a payment-card skimmer – RiskIQ has spotted the same URL in other S3 buckets targeted by miscreants. Details in the linked blog post[0]. So, very much malicious. Why the hell they included "non-malicious" in the title (granted, in quotes), I don't know. Readers could have easily dismissed this as actually non-malicious. [0] https://www.riskiq.com/blog/labs/misconfigured-s3-buckets/

The article on the British Airways hack goes into a bit more detail, but still not enough to slake my curiosity. https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ It seems like we just don't have enough information to know how exactly the attackers got the JS onto the page. What it looks like, though, is that some machine serving static files for the website got compromised, and the attackers replaced an innocent file with one that had some custom javascript tacked onto the end, that skimmed the credit card numbers. For what it's worth, PCI compliance doesn't really help you keep your webservers secure, or to keep people from breaking into your servers at all, it's more about the way you permanently store credit card numbers.

> We've just shifted from "quiet, persistent threat" to "hacker announces to the world that he's in". Changing javascript on a prod website is going to trigger alarms. While I'd like that to be true, it really isn't. There have been loads of card skimming operations injected into production sites which weren't noticed for sometimes months.[0][1][2][3] [0]: https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperw… [1]: https://www.wired.com/story/british-airways-hack-details/ [2]: https://www.riskiq.com/blog/external-threat-management/magecart-ticket… [3]: https://sansec.io/research/svg-malware

I don't know what industries you've been working in but in any sensitive business third-party javascripts are under the same tight controls as any other code, and changes in javascripts are going through the same change management controls as any other code before entering production. Even Google have had issues with malware being distributed via adsense: https://www.businessinsider.com/google-has-shut-down-a-malicious-ad-at… Not to speak of the Megacart hacks: https://www.riskiq.com/blog/external-threat-management/magecart-britis…

Came here to post this same thing. A CSP would have stopped this attack. The exfil server was baways[.]com. Ticketmaster, on the other hand, did have a 3rd party JS that was compromised: https://www.riskiq.com/blog/external-threat-management/magecart-ticket…

Except this article and that quote are wrong. If you look at the linked report on the British Airways hack, https://www.riskiq.com/blog/labs/magecart-british-airways-breach/, you'll see that the compromised script was hosted on www.britishairways.com. It wasn't a third party CDN hack, their own CMS was simply compromised. I kept reading this article looking for an actual decent reason to not use a third party CDN, and I never found one. In fact, the right answer is really that you should always set up your CSP and subresource integrity rules to completely prevent these kinds of attacks, whether from an unintended script injection from your own domain or a 3rd party.

Here's a breakdown of the attack: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

i cant find any hits for "origin" or "CDN" on the original RiskIQ article: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ the RiskIQ article identifies the location of the script as "the main website" additionally, I'm not sure how this would solve the problem. If BA went to all the effort of putting their frontend assets on a CDN, why wouldn't their HTML, with the hashes also be on the CDN? and if the hashes are not generated by the CDN, how does the server generate the hashes without being affected by changes on the CDN? regardless of outcome, if the process is automated, does a human being need to read a diff every time any file on any CDN changes? Can't an attacker then just wait until the hashes are automatically updated?

It was stolen via JavaScript injected on the payment page, not from having stored data exfiltrated. This writeup calls it "digital card skimming", which seems to be a good analogy for the attack: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

Re: https://www.riskiq.com/blog/labs/magecart-newegg/ Newegg has not said anything about this to me, nor explained why after a Newegg transaction my card was cancelled defensively and reissued. I haven't been able to trust Newegg in a very long time, which is sad. They used to be the gold standard, now it's a decrepit pit of dropshipping garbage.

They are breached and can't do anything about it. Some websites hacked by the same group tried to remove it, and later, they added in "IF YOU WILL DELETE MY CODE ONE MORE TIME I WILL ENCRYPT ALL YOUR SITES! YOU VERY BAD ADMINS" [0] Terrifying indeed. [0] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/

Although this comment in RisqIQ's report (https://www.riskiq.com/blog/labs/magecart-british-airways-breach/) is even worse - it suggests that LetsEncrypt certs are less "legitimate" than paid ones: "Interestingly, they decided to go with a paid certificate from Comodo instead of a free LetsEncrypt certificate, likely to make it appear like a legitimate server"

better link: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

It's not that simple as they can backdate the cert, like StartSSL/WoSign: > It turns out WoSign has repeatedly been lying to Mozilla about backdating SHA-1 SSL Certificates Source: https://www.riskiq.com/blog/labs/wosign-and-startcom-caught-red-handed… Certs could be checked via Certificate Transparency but currently this is not required for DV certs.

1) Don't link to sites that you think may have been compromised. It's poor form... 2) Yes http://www.riskiq.com/resources/blog/jquerycom-malware-attack-puts-pri… https://news.ycombinator.com/item?id=8356062

Direct link: http://www.riskiq.com/resources/blog/jquerycom-malware-attack-puts-pri…

Reposting from the other thread at https://news.ycombinator.com/item?id=18299015* It is unclear from any reporting as to how this technically happened, which is a shame but hopefully that will be made public in the coming days. Some other outlets[0] have an interesting statement: > The breach also included details about where each passenger had traveled and any comments made by customer service representatives. The amount of data accessed varied among passengers.* Based on those details, and the mention of 'no passwords were compromised', chances are this breach has come from an internal helpdesk type system, or possibly CRM. If however the statement around the passwords changes, that opens up a few other possibilities. What this doesn't sound like, are the attacks we saw on British Airways[1] and Ticketmaster[2], where javascript was injected into the payment pages to vacuum up payment details from customers. The statement around "The company has no evidence that any personal information has been misused" is always an interesting one, and is one of the many reasons I created my startup Breach Insider[3], so that data breaches like this could be detected much sooner (not 7 months later, as we have seen here), with minimal false positive alerts, and definitive evidence if any data has been misused. By using real email addresses that are unique to each company/business, you can be sure to find out if that data ever leaks & is abused for things like spam or phishing. [0]…

Previous attacks by this Magecart group did go through third parties: https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/ I think the underlying problems are the same either way. In all these attacks the customer loads a page with dozens of scripts from at least a dozen servers and he or she has to trust them all. Speaking as someone who frequently has to reload the checkout page five or more times while authorising successive waves of third party servers in Request Policy and NoScript - there is no way to tell. Any one could be the source of an attack or the destination for malicious exfiltration. Should I do a geoip lookup on every sever on a page when shopping on-line? Baways.com looks like a perfectly plausible server for yet another piece of cruft, or analytics, or some baroque chain of payment services providers. Since the customer has no way of telling we are depending on the suppliers noticing that the website they are serving has changed. Otherwise it's up to the banks to find the common thread in each new wave of fraudulent payments, oops. The current sorry state of security online can only be fixed by the suppliers. I think that doing things properly will necessarily involve more respect for customers and less adtech/ spyware so that payment processes are better separated from everything else on the web </rant>