6 ms·

A new skimmer uses WebSockets and a fake credit card form

96 points by gok 6y ago

hangonhn 6y ago
Gotta love the completely superfluous dig at Cloudflare. As if providing the client IP is what enabled the attack. That was probably the least interesting part of the attack. Cheap shot Akamai.
- yathern 6y ago
  I feel like it isn't a dig at all: > The skimmer uses a Cloudflare API in order to get the end-user IP address. They described what the script does in detail, and that's part of what it does.
  - chewmieser 6y ago
    I agree. It would be weird to document the call to a 3rd party source without explaining it.
- bitminer 6y ago
  "Cheap shot". Yes. Also no mitigation suggested other than CSP for which "A lot of CSP policies don't..." Which is a suggestion to use CSP correctly, in a backhanded way. It is a sales pitch plus an info-sec report.
  - jiveturkey 6y ago
    They do suggest a mitigation: Akamai Page Integrity Manager, which they say is proven effective against this attack. I wish they'd have stated if they had to make an update to PIM for it to recognize this attack, or if it worked as-is (as-was). The lack of such statement, given that this is a sales blog, strongly suggests they had to update PIM. Indeed it's a bit of a cheap shot since they could have gotten the ip via whatismyip.com or any other innumerable ways. It just happened to use CF, which I'm sure they were jumping in joy about since they get to do a direct compare against CF: Akamai has PIM, CF does not.
draw_down 6y ago
Not sure it's totally necessary to be scrolling through long blurry screengrabs of code to get the gist of the exploit. Seems like it would be easy enough to show the code as text, and have it be collapsible (collapsed by default) so that you can take a gander if you're interested.
monoideism 6y ago
As a non-infosec person, I'm very curious why the term "skimmer" is used for this kind of exploit? Seems like a skimmer should be used for a physical device only. It seems odd to use it for exploits that take advantage of web-based vulnerabilities - they're entirely unrelated unless you make heavy use of analogies. I was not familiar with this usage, and was initially confused. For this kind of exploit, it seems like we already have the terms like formjacking and script injection. Edit: I (half-jokingly) propose the term "skimware".
- throwaway201103 6y ago
  It's skimming credit card data at the point of use. Physical terminal or webpage doesn't seem a big distinction. The end result is the same, and it is a term that the general public is more likely to have heard. "Script injection" doesn't mean anything to to the average consumer.
  - gabereiser 6y ago
    Script injection is bad and all but doesn’t convey the fact that sensitive data is being sent to 3rd parties. Skimming, or card skimmer, immediately triggers thoughts of exfiltration. I support the use of the term in this case.
- xaduha 6y ago
  I agree, it's not a skimmer.
- machello13 6y ago
  I would argue that "script injection" is the means by which the credit card is "skimmed"
  - monoideism 6y ago
    Yes, agreed, it's "skimmed" in quotes, because it's an analogy. I'm still not sure if it's wise to use the same term for both a physical and virtual skimmer, from the point of view of a regular consumer. Something like "skimware" seems better, if you must use a specific term related to "skimmer". Maybe I'm wrong, though.
craftinator 6y ago
Ah, well obviously we need to make these nefarious "Web Sockets" illegal, sounds like they can be used by criminals to harm children, so they are bad.
opinologo 6y ago
Any idea how the attacker manages to inject their JavaScript code?
- bagacrap 6y ago
  Sounds like it's likely coming from a browser extension because they called it "client side".
  - lowcodetv 6y ago
    "The skimmer injects a loader into the page source as an inline script." "Given the obfuscated nature and supply chain origination of in-browser attacks, traditional CSP-reliant approaches miss most of these types of attacks." "Also, a lot of CSP policies don't limit WebSockets usage." ...But CSP is very aggressive with denying inline scripts. Could be a browser plugin, or maybe an infected common JS package?
    - hn_throwaway_99 6y ago
      My reaction exactly. This whole post seemed like purely thrown shade against CSP, which should prevent both injection and data exfiltration as designed when used correctly, in order to sell Akamai's product.
bzb6 6y ago
There’s absolutely nothing of interest here besides the script using websockets instead of xhr to transmit the data?
- Tepix 6y ago
  It's also spoofing 3rd party forms thst it cannot inject itself into.
lgats 6y ago
Interesting addition, the malicious domain is registered [1] to Ivan Popov, a Russian chess grandmaster. [2] [1] https://domain.glass/tags-manager.com#whois https://domain.glass/tags-manager.com#whois [2] https://en.wikipedia.org/wiki/Ivan_Popov_(chess_player) https://en.wikipedia.org/wiki/Ivan_Popov_(chess_player)
- userbinator 6y ago
  Ivan and Popov are not exactly uncommon names, especially in Russia.
rafaelturk 6y ago
IMO this is little help. The root of the attack, ie, how the attacker injected the code into user browser is not shown. Traditionally attackers can change domain names within hours after they realized that the destination was discovered. IMG The correct approach when studying this type of attack is to understand the source of the attack, not the outcome
- jacamera 6y ago
  The correct approach is clearly not to ask how 3rd party scripts are being injected into your web page but instead to just purchase Akamai's Page Integrity Manager.
- anonymfus 6y ago
  Injection and payload are orthogonal, somebody who can inject scripts just sells that to somebody who has a payload. At least my Instagram story feed is full of ads where these people find each other. (I mark them all as "scam or illegal" but Instagram removes such ads with a few weeks of delay and never bans their accounts)
- hn_throwaway_99 6y ago
  TBH, this whole blog post just seemed like a poor ad for Akamai's Page Integrity product, and deliberately overcomplicated 2 problems that should be very simple to deal with: 1. How did the malicious script get injected in the first place? CSP should eliminate if not greatly reduce this attack surface. 2. The blog post states "Also, a lot of CSP policies don't limit WebSockets usage." Umm, what? Why not, this seems incredibly stupid to me, that's the whole point of connect-src. What I did find was this issue report, https://github.com/w3c/webappsec-csp/issues/7 https://github.com/w3c/webappsec-csp/issues/7 , stating that connect-src 'self' doesn't allow websockets in many browsers because it's technically not same-origin, so all I can imagine is that there is some (bad, lazy) practice where if you wanted connect-src 'self' to allow websockets back to the same host you just said "fuck it" and also put ws:* in your connect-src, which is just a bazooka aimed at your foot.
  - josephg 6y ago

96 points by gok 6y ago

Gotta love the completely superfluous dig at Cloudflare. As if providing the client IP is what enabled the attack. That was probably the least interesting part of the attack. Cheap shot Akamai.

yathern 6y ago
I feel like it isn't a dig at all: > The skimmer uses a Cloudflare API in order to get the end-user IP address. They described what the script does in detail, and that's part of what it does.
- chewmieser 6y ago
  I agree. It would be weird to document the call to a 3rd party source without explaining it.
bitminer 6y ago
"Cheap shot". Yes. Also no mitigation suggested other than CSP for which "A lot of CSP policies don't..." Which is a suggestion to use CSP correctly, in a backhanded way. It is a sales pitch plus an info-sec report.
- jiveturkey 6y ago
  They do suggest a mitigation: Akamai Page Integrity Manager, which they say is proven effective against this attack. I wish they'd have stated if they had to make an update to PIM for it to recognize this attack, or if it worked as-is (as-was). The lack of such statement, given that this is a sales blog, strongly suggests they had to update PIM. Indeed it's a bit of a cheap shot since they could have gotten the ip via whatismyip.com or any other innumerable ways. It just happened to use CF, which I'm sure they were jumping in joy about since they get to do a direct compare against CF: Akamai has PIM, CF does not.

draw_down 6y ago

Not sure it's totally necessary to be scrolling through long blurry screengrabs of code to get the gist of the exploit. Seems like it would be easy enough to show the code as text, and have it be collapsible (collapsed by default) so that you can take a gander if you're interested.

monoideism 6y ago

As a non-infosec person, I'm very curious why the term "skimmer" is used for this kind of exploit? Seems like a skimmer should be used for a physical device only. It seems odd to use it for exploits that take advantage of web-based vulnerabilities - they're entirely unrelated unless you make heavy use of analogies. I was not familiar with this usage, and was initially confused. For this kind of exploit, it seems like we already have the terms like formjacking and script injection. Edit: I (half-jokingly) propose the term "skimware".

throwaway201103 6y ago
It's skimming credit card data at the point of use. Physical terminal or webpage doesn't seem a big distinction. The end result is the same, and it is a term that the general public is more likely to have heard. "Script injection" doesn't mean anything to to the average consumer.
- gabereiser 6y ago
  Script injection is bad and all but doesn’t convey the fact that sensitive data is being sent to 3rd parties. Skimming, or card skimmer, immediately triggers thoughts of exfiltration. I support the use of the term in this case.
xaduha 6y ago
I agree, it's not a skimmer.
machello13 6y ago
I would argue that "script injection" is the means by which the credit card is "skimmed"
- monoideism 6y ago
  Yes, agreed, it's "skimmed" in quotes, because it's an analogy. I'm still not sure if it's wise to use the same term for both a physical and virtual skimmer, from the point of view of a regular consumer. Something like "skimware" seems better, if you must use a specific term related to "skimmer". Maybe I'm wrong, though.

craftinator 6y ago

Ah, well obviously we need to make these nefarious "Web Sockets" illegal, sounds like they can be used by criminals to harm children, so they are bad.

opinologo 6y ago

Any idea how the attacker manages to inject their JavaScript code?

bagacrap 6y ago
Sounds like it's likely coming from a browser extension because they called it "client side".
- lowcodetv 6y ago
  "The skimmer injects a loader into the page source as an inline script." "Given the obfuscated nature and supply chain origination of in-browser attacks, traditional CSP-reliant approaches miss most of these types of attacks." "Also, a lot of CSP policies don't limit WebSockets usage." ...But CSP is very aggressive with denying inline scripts. Could be a browser plugin, or maybe an infected common JS package?
  - hn_throwaway_99 6y ago
    My reaction exactly. This whole post seemed like purely thrown shade against CSP, which should prevent both injection and data exfiltration as designed when used correctly, in order to sell Akamai's product.

bzb6 6y ago

There’s absolutely nothing of interest here besides the script using websockets instead of xhr to transmit the data?

Tepix 6y ago
It's also spoofing 3rd party forms thst it cannot inject itself into.

lgats 6y ago

Interesting addition, the malicious domain is registered [1] to Ivan Popov, a Russian chess grandmaster. [2] [1] https://domain.glass/tags-manager.com#whois https://domain.glass/tags-manager.com#whois [2] https://en.wikipedia.org/wiki/Ivan_Popov_(chess_player) https://en.wikipedia.org/wiki/Ivan_Popov_(chess_player)

userbinator 6y ago
Ivan and Popov are not exactly uncommon names, especially in Russia.

rafaelturk 6y ago

IMO this is little help. The root of the attack, ie, how the attacker injected the code into user browser is not shown. Traditionally attackers can change domain names within hours after they realized that the destination was discovered. IMG The correct approach when studying this type of attack is to understand the source of the attack, not the outcome

jacamera 6y ago
The correct approach is clearly not to ask how 3rd party scripts are being injected into your web page but instead to just purchase Akamai's Page Integrity Manager.
anonymfus 6y ago
Injection and payload are orthogonal, somebody who can inject scripts just sells that to somebody who has a payload. At least my Instagram story feed is full of ads where these people find each other. (I mark them all as "scam or illegal" but Instagram removes such ads with a few weeks of delay and never bans their accounts)
hn_throwaway_99 6y ago
TBH, this whole blog post just seemed like a poor ad for Akamai's Page Integrity product, and deliberately overcomplicated 2 problems that should be very simple to deal with: 1. How did the malicious script get injected in the first place? CSP should eliminate if not greatly reduce this attack surface. 2. The blog post states "Also, a lot of CSP policies don't limit WebSockets usage." Umm, what? Why not, this seems incredibly stupid to me, that's the whole point of connect-src. What I did find was this issue report, https://github.com/w3c/webappsec-csp/issues/7 https://github.com/w3c/webappsec-csp/issues/7 , stating that connect-src 'self' doesn't allow websockets in many browsers because it's technically not same-origin, so all I can imagine is that there is some (bad, lazy) practice where if you wanted connect-src 'self' to allow websockets back to the same host you just said "fuck it" and also put ws:* in your connect-src, which is just a bazooka aimed at your foot.
- josephg 6y ago