Where's my dough? A look at web skimming attacks on e-commerce websites.

Talk focuses on web skimming attacks used by Magecart and skimmer characteristics then goes on to talk about protecting storefronts by isolating credit card forms using iframe sandboxes, CSP directives and sub resource integrity checks.

References:
https://www.cyberint.com/wp-content/uploads/2019/06/CyberInt_Profiling-Magecart-eCommerce-Scraping-Attacks_Report.pdf
https://www.atwix.com/magento/credit-card-numbers-leak/
https://www.getastra.com/blog/911/how-to-remove-fix-magento-opencart-credit-card-malware-hack/
https://www.getastra.com/blog/cms/magento-security/magentos-payment-security-targeted-by-credit-card-scrapers/
https://www.riskiq.com/blog/labs/magecart-ticketmaster-breach/
https://www.riskiq.com/blog/labs/magecart-british-airways-breach/
https://www.riskiq.com/blog/labs/magecart-newegg/
https://cdn.riskiq.com/wp-content/uploads/2018/11/RiskIQ-Flashpoint-Inside-MageCart-Report.pdf
https://www.helpnetsecurity.com/2019/11/19/macys-online-store-compromised/
https://www.darkreading.com/risk/getting-to-know-magecart-an-inside-look-at-7-groups/d/d-id/1333260
https://gist.github.com/gwillem/2a4b7ca32c06cfb57fb11a0fc444ca01
https://twitter.com/AffableKraut/status/1210298763417276416?s=20
https://twitter.com/AffableKraut/status/1206794642949193728?s=20

Transcript

1. A look at web skimming attacks on e-commerce websites Where’s my dough?!
2. About me Senior Product Security Engineer @ Application security pentesting, threat modelling, secure code review @ Aspect Security and EY @theClumsyCoder /siddharthcoontoor
3. Agenda
4. e-commerce terminologies E-commerce Platform Storefront : www.myshop.com Extension/Plugins Order management Checkout Partners Merchants
5. Web Skimming - Typical Online Shopping Process
6. Origins of Web skimming Magento Open Source eCommerce Platform Admin console exposure Arbitrary file upload through CSRF Hackers targeted the following pages involved in Payment checkout : app/code/core/Mage/XmlConnect/Block/Checkout/Payment/Method/Ccsave.php app/code/core/Mage/Customer/controllers/AccountController.php app/code/core/Mage/Payment/Model/Method/Cc.php app/code/core/Mage/Checkout/Model/Type/Onepage.php Magecart!
7. So how do the hackers get in??? • Underlying vulns in OS • Exposed services FTP, SSH, application’s admin console • Vulnerabilities in web application code (SQLi, file upload, XSS etc) • 3rd party libraries hosted on site’s infrastructure • 3rd party libraries hosted on CDNs • 3rd party plugins or extensions
8. Fast forward 2020! Ticketmaster - Supply chain attack, compromise of third party service Inbenta British Airways - Compromised server, served malicious script : modernizr.js NewEgg - Malicious javascript code directly injected into checkout page Macy’s - Malicious Javascript code added to payment and account profile pages
9. Magecart Profiling 7 Magecart groups based on : Targets Volume of credit cards Skimmer characteristics Infrastructure setup Group 1 & 2 Group 3 Group 4 Group 5 Group 6 Group 7
10. Web Skimmer characteristics Obfuscation Page & form detection Information collection & storage Data exfiltration Anti-analysis
11. Web skimmer obfuscation “the action of making something less clear and less easy to understand, especially intentionally” - Cambridge dictionary Name obfuscation Code flow obfuscation Dead-code insertions String encryption Minification & compression
12. Group 7 Skimmer characteristics
13. Anti-analysis
14. Steganography based skimmer!
15. Websockets!
16. What can we do to protect? E-commerce Platform Storefront : www.myshop.com Extension/Plugins Order management Checkout Partners Merchants
17. E-commerce platform mitigations Enforce 2FA across all merchant’s site administrators and developers Harden server operating systems Reduce attack surface by minimizing exposure of service like SFTP, SSH Provide secure by default configurations Update developer documentation to reflect security best practices for your reference architectures Perform secure code reviews of partner code/extension as part of the marketplace publishing process
18. Subresource Integrity attribute skimmer.magecart.com www.somecdn.com www.myshop.com checkout.html web skimmer
19. SRI Considerations Trust but verify approach(well known CDNs) Update subresource integrity attribute when scripts are updated Integrity attribute can also be applied to CSS Partners that develop extensions for e-commerce platform must include SRI Partners must also maintain and make available extension versions and corresponding hashes
20. Can i use?
21. Content-Security-Policy Response header traditionally used to mitigate cross-site scripting attacks by whitelisting allowed sources of script, style, and other resources. Content-Security-Policy: default-src 'self'; script-src *.somecdn.com; font-src fonts.googleapi.com; style-src https://*/; connect-src https://p.analytics.com/ www.myshop.com
22. Good enough for E-commerce? E-commerce platforms manage 100-1000s of storefronts Each storefront relies on several third-party domains to load resources Third-party server names change without notice Detection of sub-resource compromise Difficult to gain intel on compromised domains Difficult to alert merchants of sub-resource compromise
23. CSP Simulation mode Content-Security-Policy-Report-Only: default-src 'self'; report-uri /report-violations bootstrapcdn.com /report-violations
24. Evaluating the current resource dependencies Collect, aggregate & analyse reports for known good resources for storefront Based on known good resources, craft CSP policy for your storefront Content-Security-Policy-Report-Only: default-src 'self'; report-uri /report-violations Content-Security-Policy: default-src 'self'; script-src *.somecdn.com; font-src fonts.googleapi.com; style-src https://*/; connect-src https://p.analytics.com/
25. Policy enforcement and alerting fonts.googleapis.com skimmer.magecart.com p.analytics.com www.somecdn.com www.myshop.com checkout.html web skimmer Content-Security-Policy: default-src 'self'; script-src *.somecdn.com; font-src fonts.googleapi.com; style-src https://*/; connect-src https://p.analytics.com/; report-uri /csp-violation /csp-violation { "csp-report": { "document-uri": "https://www.myshop.com/checkout.html", "referrer": "https://skimmer.magecart.com“, "blocked-uri": "https://skimmer.magecart.com/evil.js", "violated-directive": "script-src ‘https://*.somecdn.com”, "original-policy": "<complete csp policy of page>” } }
26. CSP enforcement and alerting approach Allows e-commerce platform to build intelligence of known good/bad domains Allows deployment at scale across all storefronts Zero customizations needed, configuration only All pages on browser can be monitored including payment pages Alert merchants about compromised domains across the platform
27. Can i use?
28. iframes
29. iFrame protection
30. Not so secure.. Yet!
31. iFrame sandboxing <iframe sandbox src="http://example.com"></iframe> Access to parent DOM or IndexedDB Access to same origin Access to render forms Access to pointer Access to execute any JS event-handlers javascript: URL <noscript> Access to run plugins
32. Granular control flags using sandboxes <iframe sandbox src="http://example.com"></iframe> allow-forms allows form submission. allow-popups (window.open(), showModalDialog(), target=”_blank”, etc.). allow-pointer-lock allows (mouse movements) pointer lock. allow-same-origin allows the document to maintain its origin; pages loaded from https://example.com/ will retain access to that origin’s data. allow-scripts allows JavaScript execution, and also allows features to trigger automatically (as they’d be trivial to implement via JavaScript). allow-top-navigation allows the document to break out of the frame by navigating the top-level window.
33. Can i use?
34. Thank you & Questions @theClumsyCoder /siddharthcoontoor