{"id":1768850,"date":"2022-12-08T12:58:49","date_gmt":"2022-12-08T17:58:49","guid":{"rendered":"https:\/\/platoaistream.com\/?post_type=station&#038;p=1768850"},"modified":"2022-12-08T17:33:38","modified_gmt":"2022-12-08T22:33:38","slug":"credit-card-skimming-the-long-and-winding-road-of-supply-chain-failure","status":"publish","type":"station","link":"https:\/\/platoaistream.com\/plato-data\/credit-card-skimming-the-long-and-winding-road-of-supply-chain-failure\/","title":{"rendered":"Credit card skimming \u2013 the long and winding road of supply chain failure"},"content":{"rendered":"<div><\/div>\n<div class=\"entry-prefix\">\n<div class=\"entry-author\">\n<p>\t\t\t\t\t<span class=\"by\">by<\/span><br \/>\n\t\t\t<a href=\"https:\/\/nakedsecurity.sophos.com\/author\/paul-ducklin\/\" title=\"Posts by Paul Ducklin\" class=\"author url fn\" rel=\"author noopener\">Paul Ducklin<\/a>\t\t<\/p><\/div><\/div>\n<p>Researchers at application security company Jscrambler have just published a <a href=\"https:\/\/blog.jscrambler.com\/defcon-skimming-a-new-batch-of-web-skimming-attacks\/\" rel=\"nofollow noopener\">cautionary tale<\/a> about supply chain attacks\u2026<\/p>\n<p>\u2026that is also a powerful reminder of just how long attack chains can be.<\/p>\n<p>Sadly, that\u2019s long merely in terms of <em>time<\/em>, not long in terms of technical complexity or the number of links in the chain itself.<\/p>\n<aside id=\"sophos_ad-3\" class=\"widget sophos-inline-ad sophos_widget_ad\">\t\t\t\t.s-button+.s-button { margin-left: .3125rem; } .s-button { transition: all .15s linear; font-size: .875rem; line-height: 1.5; color: #f2f2f2; font-family: SophosSansMedium, Helvetica Neue, Helvetica, Arial, sans-serif; font-weight: 400; font-style: normal; display: inline-block; padding: .3125rem 1.25rem; cursor: pointer; text-align: center; text-decoration: none; border: 1px solid #005bc8; border-radius: 3px; background-color: #005bc8; text-shadow: none; } .s-button:hover { text-decoration: none; color: #fff; border-color: #002d62; background-color: #002d62; } .s-button&#8211;white, .s-button&#8211;white:hover { color: #005bc8 !important; border-color: #fff; background-color: #fff; } .s-ad-sophos-mdr { font-size: 1rem; line-height: 1.5; color: #242629; font-family: SophosSansRegular, Helvetica Neue, Helvetica, Arial, sans-serif; font-weight: 400; font-style: normal; position: relative; max-width: 769px; margin: 15px auto; padding: 30px 30px 25px; transition: box-shadow .25s cubic-bezier( .645, .045, .355, 1 ); text-align: center; background-color: #0d141d; background-repeat: no-repeat; background-position: 50%; background-size: cover; box-shadow: 0 0 0 0 0 transparent; background-color: #005bc8; background-image: none; background-position: 0 0; } .s-ad-sophos-mdr__title { font-size: 2rem; line-height: 1.125; margin-bottom: 4px; color: #fff; } .s-ad-sophos-mdr__text { font-family: SophosSansLight, Helvetica Neue, Helvetica, Arial, sans-serif; font-weight: 400; font-style: normal; font-size: 17px; color: #fff; } .s-ad-sophos-mdr__action { margin-top: 15px; } .s-ad-sophos-mdr__action .s-button { color: #fff; } .s-ad-sophos-mdr__link-wrapper { text-decoration: none; } .s-ad-sophos-mdr__link-wrapper:hover .s-ad-sophos-mdr { box-shadow: 0 5px 10px 0 rgba( 0, 0, 0, .15 ); } .s-ad-sophos-mdr__sophos-logo { position: absolute; top: 15px; right: 15px; } .s-ad-sophos-mdr__sophos-logo-svg { display: inline-block; width: 64px; height: 11px; vertical-align: top; background-repeat: no-repeat; background-size: 64px 11px; } .s-ad-sophos-mdr__title { font-family: SophosSansSemibold, Helvetica Neue, Helvetica, Arial, sans-serif; font-weight: 400; font-style: normal; font-size: 28px; font-weight: 700; line-height: 1; margin-bottom: 10px; text-align: left; } .s-ad-sophos-mdr__title svg { max-width: 100%; } .s-ad-sophos-mdr__text { font-size: 16px; line-height: 1.25; text-align: left; } .s-ad-sophos-mdr__action { text-align: right; } .s-ad-sophos-mdr .s-button { border-radius: 20px; } @media (min-width:769px) { .s-ad-sophos-mdr__text { margin-right: 140px; } .s-ad-sophos-mdr__action { position: absolute; right: 30px; bottom: 30px; } } @media (max-width:768px) { .s-ad-sophos-mdr { padding-top: 50px; } .s-ad-sophos-mdr__title { font-size: 1.625rem; } .s-ad-sophos-mdr__text { font-size: 16px; } .s-ad-sophos-mdr { padding-top: 30px; } }<\/p>\n<\/aside>\n<h2>Eight years ago\u2026<\/h2>\n<p>The high-level version of the story published by the researchers is simply told, and it goes like this:<\/p>\n<ul>\n<li><strong>In the early 2010s, a web analytics company called Cockpit offered a free web marketing and analytics service.<\/strong> Numerous e-commerce sites used this service by sourcing JavaScript code from Cockpit\u2019s servers, thus incorporating third-party code into their own web pages as trusted content.\n<\/li>\n<li><strong>In December 2014, Cockpit shut down its service.<\/strong> Users were warned that the service would be going offline, and that any JavaScript code they imported from Cockpit would stop working.\n<\/li>\n<li><strong>In November 2021, cybercriminals bought up Cockpit\u2019s old domain name.<\/strong> To what we can only assume was a mixture of surprise and delight, the crooks apparently found that at least 40 e-commerce sites still hadn\u2019t updated their web pages to remove any links to Cockpit, and were still calling home and accepting any JavaScript code that was on offer.\n<\/li>\n<\/ul>\n<p>You can see where this story is going.<\/p>\n<p>Any hapless former Cockpit users who had apparently not checked their logs properly (or perhaps even at all) since late 2014 failed to notice that they were still trying to load code that wasn\u2019t working.<\/p>\n<p>We\u2019re guessing that those businesses did notice they weren\u2019t getting any more analytics data from Cockpit, but that because they were expecting the data feed to stop working, they assumed that the end of the data was the end of their cybersecurity concerns relating to the service and its domain name.<\/p>\n<h2>Injection and surveillance<\/h2>\n<p>According to Jscrambler, the crooks who took over the defunct domain, and who thus acquired a direct route to insert malware into any web pages that still trusted and used that now-revived domain\u2026<\/p>\n<p>\u2026started doing exactly that, injecting unauthorised, malicious JavaScript into a wide range of e-commerce sites.<\/p>\n<p>This enabled two major types of attack:<\/p>\n<ul>\n<li><strong>Insert JavaScript code to monitor the content of input fields on predetermined web pages.<\/strong> Data in <code>input<\/code>, <code>select<\/code> and <code>textarea<\/code> fields (such as you would expect in a typical web form) was extracted, encoded and exfiltrated to a range of \u201ccall home\u201d servers operated by the attackers.\n<\/li>\n<li><strong>Insert additional fields into web forms on selected web pages.<\/strong> This trick, known as <em>HTML injection<\/em>, means that crooks can subvert pages that users already trust. Users can believably be lured into entering personal data that those pages wouldn\u2019t normally ask for, such as passwords, birthdays, phone numbers or payment card details.\n<\/li>\n<\/ul>\n<p>With this pair of attack vectors at their disposal, the crooks could not only siphon off whatever you typed into a web form on a compromised web page, but also go after additional personally identifiable information (PII) that they wouldn\u2019t normally be able to steal.<\/p>\n<p>By deciding which JavaScript code to serve up based on the identity of the server that requested the code in the first place, the crooks were able to tailor their malware to attack different types of e-commerce site in different ways.<\/p>\n<p>This sort of tailored response, which is easy to implement by looking at the <code>Referer:<\/code> header sent in the HTTP requests generated by your browser, also makes it hard for cybersecurity rearchers to determine the full range of attack \u201cpayloads\u201d that the criminals have up their sleeves.<\/p>\n<p>After all, unless you know in advance the precise list of servers and URLs that the crooks are looking out for on their servers, you won\u2019t be able to generate HTTP requests that shake loose all likely variants of the attack that the criminals have programmed into the system.<\/p>\n<p>In case you\u2019re wondering, the <code>Referer:<\/code> header, which is a mis-spelling of the English word \u201creferrer\u201d, gets its name from a typographical mistake in the original internet <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc2068\" rel=\"nofollow noopener\">standards<\/a> document.<\/p>\n<h2>What to do?<\/h2>\n<ul>\n<li><strong>Review your web-based supply chain links.<\/strong> Anywhere that you rely on URLs provided by other people for data or code that you serve up as if it were your own, you need to check regularly and frequently that you can still trust them. Don\u2019t wait for your own customers to complain that \u201csomething looks broken\u201d. Firstly, that means you\u2019re relying entirely on reactive cybersecurity measures. Secondly, there may not be anything obvious for customers themselves to notice and report.\n<\/li>\n<li><strong>Check your logs.<\/strong> If your own website makes use of embedded HTTP links that are no longer working, then something is clearly wrong. Either you shouldn\u2019t have been trusting that link before, because it was the wrong one, or you shouldn\u2019t be trusting it any more, because it\u2019s not behaving as it used to. If you aren\u2019t going to check your logs, why bother collecting them in the first place?\n<\/li>\n<li><strong>Perform test transactions regularly.<\/strong> Maintain a regular and frequent test procedure that realistically goes through the same online transaction sequences that you expect your customers to follow, and track all incoming and outgoing requests closely. This will help you to spot unexpected downloads (e.g. your test browser sucking in unknown JavaScript) and unexpected uploads (e.g. data being exfiltrated from the test browser to unusual destinations).\n<\/li>\n<\/ul>\n<p>If you\u2019re still sourcing JavaScript from a server that was retired eight years ago, especially if you\u2019re using it in a service that handles PII or payment data, you\u2019re not part of the solution, you\u2019re part of the problem\u2026<\/p>\n<p>\u2026so, please, don\u2019t be that person!<\/p>\n<hr \/>\n<p><strong>Note for Sophos customers.<\/strong> The \u201crevitalised\u201d web domain used here for JavaScript injection (<code>web-cockpit DOT jp<\/code>, if you want to search your own logs) is blocked by Sophos as <code>PROD_SPYWARE_AND_MALWARE<\/code> and <code>SEC_MALWARE_REPOSITORY<\/code>. This denotes that the domain is known not only to be associated with malware-related cybercriminality, but also to be involved in actively serving up malware code.<\/p>\n<hr \/>\n","protected":false},"author":1,"featured_media":1768851,"template":"","meta":{"_eb_attr":"","type":"","auto_type":false,"post":"","stream":"","stream_url":"","waveform_data":[],"duration":0,"start":0,"end":0,"bpm":0,"downloadable":false,"download_url":"","purchase_title":"","purchase_url":"","post-count-all":0,"like_count":0,"download_count":0,"editor_note":"","copyright":"","captions":[],"sources":[]},"genre":[10650],"station_tag":[3884,39469,14557,15679,15663,7027,6174,4897,17182,15662,5133,5753,15665,39470,6535,5026,6464,15664,9242,7457,14558,8453,15312,9642,14556,4211,39471,5367,15675,14555],"artist":[15727],"mood":[],"activity":[],"_links":{"self":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station\/1768850"}],"collection":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station"}],"about":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/types\/station"}],"author":[{"embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/users\/1"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/media\/1768851"}],"wp:attachment":[{"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/media?parent=1768850"}],"wp:term":[{"taxonomy":"genre","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/genre?post=1768850"},{"taxonomy":"station_tag","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/station_tag?post=1768850"},{"taxonomy":"artist","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/artist?post=1768850"},{"taxonomy":"mood","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/mood?post=1768850"},{"taxonomy":"activity","embeddable":true,"href":"https:\/\/platoaistream.com\/wp-json\/wp\/v2\/activity?post=1768850"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}