3 ms·
The article on the British Airways hack goes into a bit more detail, but still not enough to slake my curiosity. https://www.riskiq.com/blog/labs/magecart-brit
by lacker 8y ago
The article on the British Airways hack goes into a bit more detail, but still not enough to slake my curiosity.
https://www.riskiq.com/blog/labs/magecart-british-airways-breach/ https://www.riskiq.com/blog/labs/magecart-british-airways-br...
It seems like we just don't have enough information to know how exactly the attackers got the JS onto the page. What it looks like, though, is that some machine serving static files for the website got compromised, and the attackers replaced an innocent file with one that had some custom javascript tacked onto the end, that skimmed the credit card numbers.
For what it's worth, PCI compliance doesn't really help you keep your webservers secure, or to keep people from breaking into your servers at all, it's more about the way you permanently store credit card numbers.
- pjc50 8y agoIt was appended to "Modernizr.js". That suggests a number of further possibilities by which that may have been replaced on a developer's computer, or at the point of download by a package manager (are packages authenticated?) It could well have been included in a legitimate re-deploy if that was the case.
- lacker 8y agoSince that file was served from "/cms/global/scripts/lib", perhaps their CMS got compromised. Anecdotally it seems like CMS's are more frequently prone to compromises than systems like nginx or apache.