• About
  • Advertise
  • Careers
  • Contact
Sunday, February 5, 2023
No Result
View All Result
NEWSLETTER
Cyber360 News
  • Home
  • Security
  • Data Breach
  • Cyber Attacks
  • Cyber Security
  • Cyber Crime
  • Contact Us
  • Home
  • Security
  • Data Breach
  • Cyber Attacks
  • Cyber Security
  • Cyber Crime
  • Contact Us
No Result
View All Result
Cyber360 News
No Result
View All Result
Home Cyber Attacks

e-Commerce Site Hackers Now Hiding Credit Card Stealer Inside Image Metadata

by Cyber360 News
June 29, 2020
in Cyber Attacks
0
e-Commerce Site Hackers Now Hiding Credit Card Stealer Inside Image Metadata
0
SHARES
21
VIEWS
Share on FacebookShare on Twitter

In what’s one of the most innovative hacking campaigns, cybercrime gangs are now hiding malicious code implants in the metadata of image files to covertly steal payment card information entered by visitors on the hacked websites.

“We found skimming code hidden within the metadata of an image file (a form of steganography) and surreptitiously loaded by compromised online stores,” Malwarebytes researchers said last week.

“This scheme would not be complete without yet another interesting variation to exfiltrate stolen credit card data. Once again, criminals used the disguise of an image file to collect their loot.”

The evolving tactic of the operation, widely known as web skimming or a Magecart attack, comes as bad actors are finding different ways to inject JavaScript scripts, including misconfigured AWS S3 data storage buckets and exploiting content security policy to transmit data to a Google Analytics account under their control.

Using Steganography to Hide Skimmer Code in EXIF

Banking on the growing trend of online shopping, these attacks typically work by inserting malicious code into a compromised site, which surreptitiously harvests and sends user-entered data to a cybercriminal’s server, thus giving them access to shoppers’ payment information.

image metadata

In this week-old campaign, the cybersecurity firm found that the skimmer was not only discovered on an online store running the WooCommerce WordPress plugin but was contained in the EXIF (short for Exchangeable Image File Format) metadata for a suspicious domain’s (cddn.site) favicon image.

Every image comes embedded with information about the image itself, such as the camera manufacturer and model, date and time the photo was taken, the location, resolution, and camera settings, among other details.

Using this EXIF data, the hackers executed a piece of JavaScript that was concealed in the “Copyright” field of the favicon image.

“As with other skimmers, this one also grabs the content of the input fields where online shoppers are entering their name, billing address, and credit card details,” the researchers said.

Aside from encoding the captured information using the Base64 format and reversing the output string, the stolen data is transmitted in the form of an image file to conceal the exfiltration process.

Stating the operation might be the handiwork of Magecart Group 9, Malwarebytes added the JavaScript code for the skimmer is obfuscated using the WiseLoop PHP JS Obfuscator library.

javascript web skimmer

This is not the first time Magecart groups have used images as attack vectors to compromise e-commerce websites. Back in May, several hacked websites were observed loading a malicious favicon on their checkout pages and subsequently replacing the legitimate online payment forms with a fraudulent substitute that stole user card details.

Abusing DNS Protocol to Exfiltrate Data from the Browser

But data-stealing attacks don’t have to be necessarily confined to malicious skimmer code.

In a separate technique demonstrated by Jessie Li, it’s possible to pilfer data from the browser by leveraging dns-prefetch, a latency-reducing method used to resolve DNS lookups cross-origin domains before resources (e.g., files, links) are requested.

Called “browsertunnel,” the open-source software consists of a server that decodes messages sent by the tool, and a client-side JavaScript library to encode and transmit the messages.

dns prefetch hacking

The messages themselves are arbitrary strings encoded in a subdomain of the top domain being resolved by the browser. The tool then listens for DNS queries, collecting incoming messages, and decoding them to extract the relevant data.

Put differently, ‘browsertunnel’ can be used to amass sensitive information as users carry out specific actions on a webpage and subsequently exfiltrate them to a server by disguising it as DNS traffic.

“DNS traffic does not appear in the browser’s debugging tools, is not blocked by a page’s Content Security Policy (CSP), and is often not inspected by corporate firewalls or proxies, making it an ideal medium for smuggling data in constrained scenarios,” Li said.

Cyber360 News

Cyber360 News

Next Post
Eight cities using Click2Gov targeted in Magecart skimming attacks

Eight cities using Click2Gov targeted in Magecart skimming attacks

Recent Posts

Twitch’s Entire Critical Data Leaked, Includes Streamer Earnings, Source Code

Twitch’s Entire Critical Data Leaked, Includes Streamer Earnings, Source Code

October 6, 2021
Former U.S. Security Firm Helped The UAE Carry Out “Karma” iMessage Hack: MIT Tech Review

Former U.S. Security Firm Helped The UAE Carry Out “Karma” iMessage Hack: MIT Tech Review

October 1, 2021
Facing “This App Has Been Blocked For Your Protection” Issue? Here’s How You Can Fix It

Facing “This App Has Been Blocked For Your Protection” Issue? Here’s How You Can Fix It

October 1, 2021

Whats New in Kali Linux?

September 14, 2021

Kali Linux 2019.3 Release (CloudFlare, Kali-status, metapackages, Helper-Scripts & LXD)

September 14, 2021

Kali Linux 2021.3 Release (OpenSSL, Kali-Tools, Kali Live VM Support, Kali NetHunter Smartwatch)

September 14, 2021

Kali Linux 2018.4 Release

September 14, 2021

Kali Linux 1.0.5 and Software Defined Radio

September 14, 2021

Kali Tools Website Launched, 1.0.9 Release

September 14, 2021

Kali Linux Dojo at Black Hat Vegas 2016

September 14, 2021

Category

Site Links

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

About Us

We bring you the best Premium WordPress Themes that perfect for news, magazine, personal blog, etc. Check our landing page for details.

© 2019 Cyber360 News - Powered by WebSensePro

No Result
View All Result
  • Home
  • Security
  • Data Breach
  • Cyber Attacks
  • Cyber Security
  • Cyber Crime
  • Contact Us

© 2019 Cyber360 News - Powered by WebSensePro

Login to your account below

Forgotten Password?

Fill the forms bellow to register

All fields are required. Log In

Retrieve your password

Please enter your username or email address to reset your password.

Log In