Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/14/2019
08:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Use One Line of Code to Steal Card Data from E-Commerce Sites

New JavaScript sniffer is similar to malware used in the Magecart campaign last year that affected over 800 sites.

Criminals using just one line of malicious code have successfully compromised at least seven e-commerce sites and potentially stolen payment card data belonging to thousands of customers of the online stores.

Six of the e-commerce sites are US-based and one, belonging to footwear maker Fila, is based in the United Kingdom. Security vendor Group-IB, which uncovered the attacks, identified the malicious code as a new JavaScript sniffer (JS sniffer) that it has named GMO.

In an alert Thursday, the Moscow-based Group-IB said its researchers first discovered the GMO JS sniffer on Fila UK's website in early March. The company's subsequent investigations showed that the malware has been active since at least May 2018 and that six relatively small US e-commerce sites have been affected as well.

Group-IB identified the six sites as forshaw.com, absolutenewyork.com, cajungrocer.com, getrxd.com, jungleeny.com, and sharbor.com. The security vendor pegged the combined total number of monthly visitors to these sites at around 350,000.

Group-IB described GMO as a family of JS sniffers that targets e-commerce sites based on the Magento content management system. The malware is one of at least 38 families of JS sniffers designed to steal payment card data and credentials from online stores. The attackers are injecting the card-stealing code into the sites either via an unknown vulnerability in Magento or by somehow compromising the credentials on the website administrator, Group-IB said.

Once in place, the one-line code downloads the JS sniffer whenever a user lands on the compromised e-commerce website's checkout page. The sniffer then intercepts any credit card data that is entered into the page, puts the data it into local storage, and then sends it out to a system controlled by the attacker.

The GMO campaign is very similar to but much smaller than one that RiskIQ reported last year where multiple attackers operating under a common umbrella group called Magecart installed lightweight card-stealing malware on some 800 e-commerce sites worldwide, including Ticketmaster UK. In that campaign, the attackers installed the single-line card sniffers on third-party software components on the sites, such as those used for customer support and for sending out push notifications.

Such attacks are especially dangerous because adversaries can adapt it for use against any e-commerce site, Group-IB said.

The GMO campaign as well as the one involving Ticketmaster and other major sites shows that despite their simplicity, JavaScript sniffers are extremely dangerous, says Nicholas Palmer, vice president of international business at Group-IB. Such tools can be used to steal data on thousands of customers. "If underestimated, this threat can lead to additional risks for customers," Palmer says. "Any e-commerce business around the world is vulnerable to this type of attack," he says.  And it's not just online stores that get affected, but also payment systems and banks.

Palmer says that the group operating the GMO JS sniffer malware appears to be relatively new. Even so, it managed to get access to several websites, including Fila, he notes.

Significantly, there are multiple other groups using distinct families of JS Sniffers targeting online stores. In some cases, it is difficult to determine how many people are use a particular sniffer. Every family of JS Sniffers has unique characteristics, some of which are multipurpose and others specific that are designed to target particular content management systems and other third-party software components that e-commerce sites use.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Our Endpoint Protection system is a little outdated... 
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19729
PUBLISHED: 2019-12-11
An issue was discovered in the BSON ObjectID (aka bson-objectid) package 1.3.0 for Node.js. ObjectID() allows an attacker to generate a malformed objectid by inserting an additional property to the user-input, because bson-objectid will return early if it detects _bsontype==ObjectID in the user-inpu...
CVE-2019-19373
PUBLISHED: 2019-12-11
An issue was discovered in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can trigger arbitrary unserialization of a PHP object from a packages/cms/page_templates/page_remote_content/page_remote_content.inc POST parame...
CVE-2019-19374
PUBLISHED: 2019-12-11
An issue was discovered in core/assets/form/form_question_types/form_question_type_file_upload/form_question_type_file_upload.inc in Squiz Matrix CMS 5.5.0 prior to 5.5.0.3, 5.5.1 prior to 5.5.1.8, 5.5.2 prior to 5.5.2.4, and 5.5.3 prior to 5.5.3.3 where a user can delete arbitrary files from the se...
CVE-2014-7257
PUBLISHED: 2019-12-11
SQL injection vulnerability in DBD::PgPP 0.05 and earlier
CVE-2013-4303
PUBLISHED: 2019-12-11
includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detect extensions when there are an even number of "." (period) characters in a string, which allows remote attackers to conduct cross-s...