Magecart-TheRisingThreatTo_e-commerceWebsites.pdf

This is a very famous attackers' group whose main target is the e-commerce websites.

Transcript

1. MAGECART - THE RISING THREAT TO E- COMMERCE WEBSITES By Shrutirupa Banerjiee
2. Whoami??? ▪ Web Application Security Analyst, WAF Research, Qualys ▪ InfosecGirls Chapter Lead, Pune ▪ Mentor at CyberPreserve ▪ Lead in Breaking Barriers, Lean – in Circle ▪ WomenWhoCode, Pune Lead ▪ Speaker/ Trainer ▪ Blogger at https://shrutirupa.me
3. Agenda WHAT WHY WHERE HOW
4. Who are Magecart Attackers? ▪ A group of attackers ▪ Target is the e-commerce websites ▪ Steal PII(Personal Identifiable Information) like credit card
5. Some famous victims ▪ British Airways ▪ TicketMaster ▪ Nutribullet ▪ … and many more
6. What exactly happens? Use a highly obfuscated Javascript code Most of the time use third party JavaScripts being loaded by another organization Follow digital skimming
7. What is digital skimming? The malicious activity of stealing PII-Personally identifiable information (credit card or payment card) details during a digital transaction Skimming is a fraudulent practice performed by hackers or malicious users to steal credit card details from the users using physical devices such as skimmers
8. Attack flow
9. Product A Third party web page uses loads advertisements Javascripts
10. Malicious code Third party web app The web Application Injected Compromises
11. Compromised Web Application User Interacts User enters PII Details The details get passed on to the malicious server
12. ▪ The domain that these attackers use, also seem to be legitimate ▪ The attackers mimic the known existing domains
13. The Magecart Pattern ▪ Content Layer - a set of data tokens, that requiring a decryption step, to become the real data values ▪ Decryption Layer - The function decrypts the data token using a dedicated algorithm (e.g window.atob) to retrieve the original data value. ▪ Logic Layer - The actual malware code
15. What is an obfuscated code? ▪ “the action of making something less clear and less easy to understand, especially intentionally” - Cambridge Dictionary
16. Obfuscated code might look like
17. After beautifying the code, for British airways
18. Mitigation Tools detecting malicious injections. Once detected, it should be blocked directly, Implementation of good security practices in the organization Each and every application should be patched up to date. A sandbox environment could be implemented along with some effective monitoring tools. Implementation of CSP – Content Security Policy could be helpful
19. Conclusion ▪ Nothing is 100% secure. ▪ It's always better to be aware of the attacks and be ready with all the precautionary measures.
20. References: ▪ https://www.perimeterx.com/tech- blog/2020/analyzing_magecart_malware_from_zero_to_hero/ ▪ https://www.riskiq.com/blog/labs/magecart-makeframe/ ▪ https://techmonitor.ai/techonology/cybersecurity/what-is-shadow-code-javascript- magecart ▪ https://www.rapidspike.com/blog/the-code-behind-magecart-skimming-scripts/
21. Contact me ▪ LinkedIn – https://www.linkedin.com/in/shrutirupa-banerjiee/ ▪ Twitter – @freak_crypt https://shrutirupa.me
22. Thank you