Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Severity
Medium
Analysis Summary
A credit card skimming campaign recently observed that steals payment card details from compromised websites.
MageCart is the name given to numerous cybercriminal groups that embed digital skimmers on compromised e-commerce sites. The group made global headlines for a series of high-profile breaches on Ticketmaster, British Airways, and Newegg. These groups are still active and continue to target online stores to steal payment card details from unaware customers.
MageCart Skimmer
The malicious javascript code, also called CoffeMokko JS-sniffer, has been around since May 2017. While the skimmer has been modified several times, we will be focusing our analysis on the latest sample. The skimmer is loaded by a direct link in the compromised website’s HTML code and has the following URL format:
<C&C >/src/<compromised website>.js
<C&C>/js/<compromised website>.js
<C&C>/assets/<compromised website>.js
Taking a look at the skimmer javascript, some strings are obfuscated to avoid crawlers and signatures detecting their malicious code. Upon deobfuscation, an array is created with interesting strings, such as the C&C (foodandcot[.]com) and other strings to identify the payment form on the targeted website.
To check that the current page is the payment page, it searches for the keywords onepage, checkout, onestep, and firecheckout in the URL address. Once it is on the correct page, it intercepts the following details after an unaware customer fills in the fields:
Without knowing the replaced characters, it would be difficult to decode back the original information.
The encoded stolen information is sent via a POST request to /tr/index.php, which is the same C&C where the malicious javascript is being hosted.
Inspecting the C&C with the IP address 178.33.231[.]184 revealed other domains it is hosting. As expected, these domain names attempts to imitate legitimate e-commerce websites related to different services and products (e.g. food, fitness, espresso, etc.). This makes it more difficult to spot something suspicious during static analysis.
Impact
Exposure of sensitive information
Indicators of Compromise
IP(s) / Hostname(s)
178[.]33[.]231[.]184
URLs
Malware Hash (MD5/SHA1/SH256)
Remediation
Block threat indicators at your respective controls.