Rootconf digital skimming

1. - ARJUN B.M.
The Art of Exfiltration
DIGITAL SKIMMING

2. About
• A security professional with diverse experience in
architecting, designing & implementing & supporting IT
Security & Vulnerability Management solutions in Enterprise
& Cloud environments
• Currently, working for a Retail major as a Security Architect
ensuring end-to-end implementation, design and
governance of security measures for Digital & Marketing
space on an e-commerce platform

3. Outline
• Context and Introduction
• Threat Actors and Modus Operandi
• Challenges and Countermeasures

4. The Nation Wants To Know…
WHAT 17000 domains compromised, July 2019
WHO Cybercriminals (Magecart)
WHY Misconfigured Amazon S3 buckets (WRITE permission)
HOW JavaScript-based payment card-skimming code is over-
written on existing JavaScript files on the bucket
WHO FILA, British Airways, Feedify
Source: https://www.riskiq.com/blog/labs/magecart-amazon-s3-buckets

5. ATTACKE
R
ONLINE
USER
ATTACKER
CONTROLLED
SERVER
ATTACKER SCANS
FOR VULNERABLE
WEBSITES AND
INJECTS MALICIOUS
JS CODE
ENTERS PAYMENT
CARD DETAILS ON
CHECKOUT PAGE
TO MAKE ONLINE
PURCHASE
MALICIOUS
JS CODE
INJECTED
STEALING OF
PAYMENT CARD
INFORMATIONE-COMMERCE
WEBSITE
MONETIZATION
• RESHIPPING VIA MULES
• SELL IT TO OTHER
CYBERCRIMINALS

6. Anatomy of a Digital Skimmer

7. Threat Vectors
The “How” of Digital Skimming
- Misconfigured S3 Buckets
- Compromise of Third-party Components
- Outdated or Unpatched Versions of Software
- Application Vulnerabilities (SQLi)

8. Threat Vectors
Attack Patterns & Signatures
- Group 1, 2 & 3 Automated spray & pray attack
- Group 4 Obfuscation & Stealth
- Group 5 Hacks third-party suppliers
- Group 6 Extremely selective top-tier targets

9. Challenges
• Lack of visibility into online resources
• Dependency on third parties
• Diversity of attack types: obfuscation, bitcoin miners, noisy techniques
• Detection is difficult

10. Countermeasures
• JavaScript Controls inventory, reduction & hosting
• Hardening Procedures patching, 3rd party plugins, 2FA
• Process & Policy vendor evaluation, monitoring, control code change

11. Countermeasures
• Website Configuration Settings CSP, SRI, HTTPS, iFrame
CSP HEADER
Content-Security-Policy: script-src https://example.com/
Content-Security-Policy: require-sri-for script;
SRI
<script src=https://example.com/example-framework.js
integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC"
</script>
iFRAME
X-Frame-Options: DENY
X-Frame-Options: SAMEORIGIN

12. Conclusion
• Build defenses against known attack patterns and watch
out for the unknown
• Collaborative sharing between impacted organizations,
security researchers and law enforcement

13. Thank you
arjun.bm@target.com