Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/14/2019
08:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Use One Line of Code to Steal Card Data from E-Commerce Sites

New JavaScript sniffer is similar to malware used in the Magecart campaign last year that affected over 800 sites.

Criminals using just one line of malicious code have successfully compromised at least seven e-commerce sites and potentially stolen payment card data belonging to thousands of customers of the online stores.

Six of the e-commerce sites are US-based and one, belonging to footwear maker Fila, is based in the United Kingdom. Security vendor Group-IB, which uncovered the attacks, identified the malicious code as a new JavaScript sniffer (JS sniffer) that it has named GMO.

In an alert Thursday, the Moscow-based Group-IB said its researchers first discovered the GMO JS sniffer on Fila UK's website in early March. The company's subsequent investigations showed that the malware has been active since at least May 2018 and that six relatively small US e-commerce sites have been affected as well.

Group-IB identified the six sites as forshaw.com, absolutenewyork.com, cajungrocer.com, getrxd.com, jungleeny.com, and sharbor.com. The security vendor pegged the combined total number of monthly visitors to these sites at around 350,000.

Group-IB described GMO as a family of JS sniffers that targets e-commerce sites based on the Magento content management system. The malware is one of at least 38 families of JS sniffers designed to steal payment card data and credentials from online stores. The attackers are injecting the card-stealing code into the sites either via an unknown vulnerability in Magento or by somehow compromising the credentials on the website administrator, Group-IB said.

Once in place, the one-line code downloads the JS sniffer whenever a user lands on the compromised e-commerce website's checkout page. The sniffer then intercepts any credit card data that is entered into the page, puts the data it into local storage, and then sends it out to a system controlled by the attacker.

The GMO campaign is very similar to but much smaller than one that RiskIQ reported last year where multiple attackers operating under a common umbrella group called Magecart installed lightweight card-stealing malware on some 800 e-commerce sites worldwide, including Ticketmaster UK. In that campaign, the attackers installed the single-line card sniffers on third-party software components on the sites, such as those used for customer support and for sending out push notifications.

Such attacks are especially dangerous because adversaries can adapt it for use against any e-commerce site, Group-IB said.

The GMO campaign as well as the one involving Ticketmaster and other major sites shows that despite their simplicity, JavaScript sniffers are extremely dangerous, says Nicholas Palmer, vice president of international business at Group-IB. Such tools can be used to steal data on thousands of customers. "If underestimated, this threat can lead to additional risks for customers," Palmer says. "Any e-commerce business around the world is vulnerable to this type of attack," he says.  And it's not just online stores that get affected, but also payment systems and banks.

Palmer says that the group operating the GMO JS sniffer malware appears to be relatively new. Even so, it managed to get access to several websites, including Fila, he notes.

Significantly, there are multiple other groups using distinct families of JS Sniffers targeting online stores. In some cases, it is difficult to determine how many people are use a particular sniffer. Every family of JS Sniffers has unique characteristics, some of which are multipurpose and others specific that are designed to target particular content management systems and other third-party software components that e-commerce sites use.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
For Cybersecurity to Be Proactive, Terrains Must Be Mapped
Craig Harber, Chief Technology Officer at Fidelis Cybersecurity,  10/8/2019
A Realistic Threat Model for the Masses
Lysa Myers, Security Researcher, ESET,  10/9/2019
USB Drive Security Still Lags
Dark Reading Staff 10/9/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17545
PUBLISHED: 2019-10-14
GDAL through 3.0.1 has a poolDestroy double free in OGRExpatRealloc in ogr/ogr_expat.cpp when the 10MB threshold is exceeded.
CVE-2019-17546
PUBLISHED: 2019-10-14
tif_getimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition.
CVE-2019-17547
PUBLISHED: 2019-10-14
In ImageMagick before 7.0.8-62, TraceBezier in MagickCore/draw.c has a use-after-free.
CVE-2019-17501
PUBLISHED: 2019-10-14
Centreon 19.04 allows attackers to execute arbitrary OS commands via the Command Line field of main.php?p=60807&type=4 (aka the Configuration > Commands > Discovery screen).
CVE-2019-17539
PUBLISHED: 2019-10-14
In FFmpeg before 4.2, avcodec_open2 in libavcodec/utils.c allows a NULL pointer dereference and possibly unspecified other impact when there is no valid close function pointer.