4 ms·
What I can't get my head around is how they managed to add their code to the .js file. Correct me if I'm wrong, but the file was hosted by BA within their CMS,
by ID1452319 8y ago
What I can't get my head around is how they managed to add their code to the .js file.
Correct me if I'm wrong, but the file was hosted by BA within their CMS, yet the attackers were able to update this file to include their 22 lines of code.
Does this mean the attackers had access to the CMS for BA.com or is there a step I am missing or has been deliberately omitted?
- raesene9 8y agoI'm guessing (and it is just that) that the attacker had indeed compromised some element(s) of BA's Web server infrastructure. The reason this report doesn't mention it, is that their analysis focuses on publicly facing changes, so they can find the change to the JS file but not the mechanism that was used to get it onto the server. For that we'd need some statement from BA or some other intel. source that has more information on that aspect.
- netsharc 8y agoWhy "yet"? I've worked with CMS tools that allow you to add plain HTML blocks, even stuff inside <script></script>. If their CMS allows this, and some marketing person had "password123" as their CMS password, and they allow access from the web (instead of intranet/VPN + 2FA requirements)...
- ObsoleteNerd 8y agoCMSes get hacked every day now. It's the new entry level thing to probe for and hack into. Then the fact that most CMSes these days allow some form of creating code blocks in the content or injecting code into the templates, and it's not very hard to believe.
- blacksmith_tb 8y agoI see BA is using Google Tag Manager, which is another handy way to inject $RANDOM_JS into a site.