Hello, World!
Cyber criminals have invented a new way of stealing your money - well, it’s not technically
new - but this version of it, is pretty remarkable.
Take a look at this real life example, you’re on a totally legit website that you trust,
and you’re about to buy something, you select pay by credit card, enter your card details
and hit pay.
Totally normal right?
Well - no, your card details have just been stolen by cyber criminals who’ll package
them along with those of thousands of other people, before selling them on a dark web
carding marketplace, perhaps even one that’s Joe Biden themed, to some low level cyber
criminal who’ll empty your bank account.
The culprit here is this thing, its technical name is a ‘modal box’, a kind of overlay,
they’re often used to get cookie permissions, grab emails for newsletters, and to take payments.
But this modal box is fake, the ecommerce store behind it, in this case a French travel
accessory store was hacked - and miscreants injected malicious javascript into the checkout
process such that when you select pay by credit card their malicious modal box pops up to
grab your card details.
The crazy thing here is just how realistic it is, it mimics the colour scheme and style
of the website, and even incorporates the actual logo of the site - though this has
been blurred out by the researchers who discovered it.
However, as soon as you hand over your payment details, you get an error that your payment
has been declined, before you’re redirected to the real payment processor of the website
- who’s checkout page isn’t anywhere near as good as the fake one.
And in order to avoid raising your suspicions, a cookie is dropped by the malicious code
embedded within the website which ensures you don’t actually see the fake payment
box ever again…
The only telltale sign that something isn’t right with all of this is the link in the
copyright notice, which points to some seemingly random South American payment processor.
A sign that the bad actor here should take a little more care when copy pasting their
template.
But regardless, this is good - well, bad - but it’s good at being bad.
This campaign was discovered by researchers at Malwarebytes - and this isn’t an isolated
case, the exact same template has been seen on multiple other ecommerce stores, and is
growing in popularity amongst Magecart cyber criminals.
Magecart is a kind of umbrella term for cyber criminal gangs that specialise in ecommerce
web skimmers.
You’ll often see Magecart referred to as if it’s a single group, but just like the
name ‘Anonymous’ doesn’t refer to a single group, Magecart doesn’t either.
The name derives from the first known instances of web skimming which targeted vulnerable
Magento servers - and hence the name Magecart was born.
But don’t make the mistake of thinking that just because all these groups are referred
to with the same name that they’re on the same team, Magecart groups won’t turn down
an opportunity to sabotage their competitor’s operations.
Some skimming malware is designed to check if the ecommerce store it’s embedded on
has already been hacked by a Magecart competitor.
If so, it won’t actually remove the competitor code, but will rather replace the last digit
of the credit card number sent to the competitor with a random number.
Such that the reputation of their competitor is ruined when their customers realise the
cards they bought just don’t work.
But how does Magecart hack ecommerce sites in the first place?
There’s a whole array of methods, some of which can be quite sophisticated.
A few years ago, Ticketmaster customers became victims of Magecart thanks to Ticketmaster
embedding a third party chat bot within their payment page.
The chat bot went on to be compromised, allowing a bad actor to inject malicious code right
into the checkout process.
But sometimes Magecart hacks aren’t quite as complex - British airways was compromised
by Magecart a few years ago, which resulted in 380 thousand people’s credit card details
being stolen, and in a report by the regulator, this was the result of a “username and password
of … [an admin account being] … stored in plaintext, in a folder on [their] server”.
In the case of Ticketmaster, 9.4 million people had their creds scooped up, and as per typical
magecart operations, these will’ve been sold on dark web marketplaces for a fraction
of their true value, in some cases card details sell for as little as 15 cents.
As we’ve seen, it’s often difficult to tell whether the site your giving your card
details is hacked.
But chances are whether or not you take precautions like using disposable cards - which is a pretty
good countermeasure, you’ll likely get your money back anyway , or at least here in the
UK that’s the case, so arguably the biggest victim here, are the ecommerce stores that
the stolen credit cards are eventually used to make purchases on, because these purchases
are almost always charged back by the real card owner, leaving the ecommerce store in
the red.
And it can be difficult for stores to spot fraudulent transactions before orders are
shipped because carding marketplaces make it easy to sort cards by State, City and even
Zip Code, so cyber criminals can purchase cards registered just a few miles away from
their shipping address.
This video is brought to you by PlexTrac, who’re offering you a FREE one month trial
of their premier cybersecurity reporting and collaboration platform.
Get started today to learn why the best offensive security teams trust PlexTrac.
PlexTrac empowers users to build better reports in half the time, exponentially increasing
ROI and time savings, To aggregate findings from all their tools by consolidating the
testing process into one platform, creating a single source of truth, and to maximize
their reusable report content, like findings writeups and narratives, improving consistency
across the team.
With PlexTrac you’ll become more efficient and effective, delivering better results from
every engagement.
Ready to elevate your reporting, improve collaboration across teams, and demonstrate real progress?
Spend more time hacking and less time reporting with PlexTrac.
Claim your free month of the PlexTrac platform – exclusively for Seytonic viewers, using
the link in the video description.
As always thanks for watching and I’ll see you in the next video, have a good one.