CERT-In Advisory
CIAD-2019-0026
Online Skimming
Original Issue Date: August 06, 2019
Description
Card Skimming through ATM machines and merchant businesses have been on the rise since many years now. Recently, card skimming through various e-commerce websites has been reported where attackers collect information from credit/debit cards for unauthorized activities.
How it works
The attackers use various methods such as vulnerable plugins, brute force login attempts, phishing and other social engineering techniques to gain access to the websites and inject malicious codes (known as JavaScript (JS) sniffers). Once the website is infected, the attackers can extract information such as username, password, name, email, phone number, credit card details and billing address.
The attacks are directed to e-commerce websites or third-party's software libraries. In case third-party services are compromised, the attacker is able to target multiple websites at the same time by sending the malicious JavaScript in bulk. In these cases, it is difficult to detect the security breach as the attacks are not directed towards the e-commerce merchant. They can be targeted even if they are updated with latest Payment Card Industry (PCI) compliance standards and antifraud best practices.
Best practices
- Use latest version of Web server, Database Server, Hypertext Processor (PHP).
- Apply appropriate updates/patches on the OS and Application software when available.
- Restrict access to only what is absolutely necessary and deny all other access by default
- Conduct complete security audit of web application, web server, database server periodically and after every major configuration change and plug vulnerabilities found.
- Apply Security Information and Event Management (SIEM) and/or Database Activity Monitoring (DAM) solutions.
- Search all the websites hosted on the web server or sharing the same DB server for the malicious webshells or any other artefact.
- Periodically check the web server directories for any malicious/unknown web shell files and remove as and when noticed.
References
https://rhisac.org/media/media_detail/rhisac-pci-ssc-bulletin-online-skimming/
https://blog.malwarebytes.com/web-threats/2019/08/no-summer-break-for-magecart-as-web-skimming-intensifies/
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|