Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

3/14/2019
08:45 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Criminals Use One Line of Code to Steal Card Data from E-Commerce Sites

New JavaScript sniffer is similar to malware used in the Magecart campaign last year that affected over 800 sites.

Criminals using just one line of malicious code have successfully compromised at least seven e-commerce sites and potentially stolen payment card data belonging to thousands of customers of the online stores.

Six of the e-commerce sites are US-based and one, belonging to footwear maker Fila, is based in the United Kingdom. Security vendor Group-IB, which uncovered the attacks, identified the malicious code as a new JavaScript sniffer (JS sniffer) that it has named GMO.

In an alert Thursday, the Moscow-based Group-IB said its researchers first discovered the GMO JS sniffer on Fila UK's website in early March. The company's subsequent investigations showed that the malware has been active since at least May 2018 and that six relatively small US e-commerce sites have been affected as well.

Group-IB identified the six sites as forshaw.com, absolutenewyork.com, cajungrocer.com, getrxd.com, jungleeny.com, and sharbor.com. The security vendor pegged the combined total number of monthly visitors to these sites at around 350,000.

Group-IB described GMO as a family of JS sniffers that targets e-commerce sites based on the Magento content management system. The malware is one of at least 38 families of JS sniffers designed to steal payment card data and credentials from online stores. The attackers are injecting the card-stealing code into the sites either via an unknown vulnerability in Magento or by somehow compromising the credentials on the website administrator, Group-IB said.

Once in place, the one-line code downloads the JS sniffer whenever a user lands on the compromised e-commerce website's checkout page. The sniffer then intercepts any credit card data that is entered into the page, puts the data it into local storage, and then sends it out to a system controlled by the attacker.

The GMO campaign is very similar to but much smaller than one that RiskIQ reported last year where multiple attackers operating under a common umbrella group called Magecart installed lightweight card-stealing malware on some 800 e-commerce sites worldwide, including Ticketmaster UK. In that campaign, the attackers installed the single-line card sniffers on third-party software components on the sites, such as those used for customer support and for sending out push notifications.

Such attacks are especially dangerous because adversaries can adapt it for use against any e-commerce site, Group-IB said.

The GMO campaign as well as the one involving Ticketmaster and other major sites shows that despite their simplicity, JavaScript sniffers are extremely dangerous, says Nicholas Palmer, vice president of international business at Group-IB. Such tools can be used to steal data on thousands of customers. "If underestimated, this threat can lead to additional risks for customers," Palmer says. "Any e-commerce business around the world is vulnerable to this type of attack," he says.  And it's not just online stores that get affected, but also payment systems and banks.

Palmer says that the group operating the GMO JS sniffer malware appears to be relatively new. Even so, it managed to get access to several websites, including Fila, he notes.

Significantly, there are multiple other groups using distinct families of JS Sniffers targeting online stores. In some cases, it is difficult to determine how many people are use a particular sniffer. Every family of JS Sniffers has unique characteristics, some of which are multipurpose and others specific that are designed to target particular content management systems and other third-party software components that e-commerce sites use.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15208
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a `DCHECK` which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can ...
CVE-2020-15209
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a `nullptr` buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one....
CVE-2020-15210
PUBLISHED: 2020-09-25
In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, we can observe a segmentation fault or just memory corruption. We have patched the issue in d58c96946b and ...
CVE-2020-15211
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, saved models in the flatbuffer format use a double indexing scheme: a model has a set of subgraphs, each subgraph has a set of operators and each operator has a set of input/output tensors. The flatbuffer format uses indices f...
CVE-2020-15212
PUBLISHED: 2020-09-25
In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger writes outside of bounds of heap allocated buffers by inserting negative elements in the segment ids tensor. Users having access to `segment_ids_data` can alter `output_index` and then write to outside of `outpu...