Uniqlo and The Guardian among thousands of sites loading malicious code from S3
29th August, 2019
Updated 05/09/2019: Fast Retailing Co has stated that the credit card fields were contained within an iframe, which meant they would not be collected by this generic skimmer. However, the remainder of the personal information provided by customers would have still been vulnerable if at least one non-credit card field happened to match a regular expression designed to find credit card numbers. Fast Retailing has stated it has “verified its order history database records for last several years and confirmed that there are no inputs in existing orders matching a regular expression designed to find credit card numbers in any non-credit card fields. While the malicious code would have been executed by visitors, based on the information available to Fast Retailing it is unlikely that customers who successfully placed an order would have had their personal data stolen”.
Uniqlo's website was infected with a shopping site skimmer for more than a week in May this year, following the addition of malicious JavaScript. The injected code was designed to silently 'skim' part of the checkout form and send a copy of the customer's details to the criminals under certain conditions. In this case, the attack was not successful as the credit card details were not vulnerable — Uniqlo's Australian site uses an iframe-based credit card form which means it was isolated from the malicious JavaScript.
Thousands more sites have also been compromised in recent months via the same underlying vulnerability that allowed criminals to alter the behaviour of the Uniqlo website — unsecured Amazon S3 buckets. The criminals took a shotgun approach to compromising as many files as possible. They got lucky with a bucket containing JavaScript files used on Uniqlo's site, one of the most visited shopping sites on the internet.
Skimmer on Uniqlo's website
We detected that Uniqlo's Australian online shop was running malicious JavaScript on 18th May 2019. While the skimmer was active, a copy of any data that was entered during the checkout process on Uniqlo’s Australian site would have been silently sent to a dropsite operated by criminals if it matched a regular expression designed to find credit card numbers.
Personal data entered into Uniqlo Australia's checkout page may have been stolen
E-commerce is responsible for nearly 10% of Uniqlo Japan's sales and Uniqlo's parent company Fast Retailing Co is one of the world's largest and most successful retailers, worth $62 billion. Uniqlo is the most-visited online shop on which we have found a skimmer to date. This is the second attack to which Uniqlo has fallen victim in recent times; in May it was announced 460,000 users of the shopping site may have had their details stolen following a credential stuffing attack.
The criminals altered the website's behaviour by adding obfuscated JavaScript code to the all of the resources Uniqlo hosts within its S3 bucket, hoping that at least one would be loaded by the website. By deobfuscating the code, we can reveal the data it captured and to where the stolen data would have been transmitted.
The code captured every input on the page accessible to the script
The code was designed to capture all of the data entered by customers into the checkout form. However, customers would not have had their credit card details stolen by the skimmer, as this part of the checkout form is loaded in an isolated iframe or is processed externally via Paypal. If the injected code did not find any other customer details where at least one field matched a regular expression designed to find credit card numbers, none of the data would be stolen.
Unlike the skimming code used in the attacks against Cleor and British Airways, this JavaScript code is very generic and is designed to function on multiple websites without modification. It harvests all form fields (by looking for input, select, and textarea elements) whether or not they are part of a specific checkout form.
![The captured data is transmitted to cdn-c[.]com](/images/2019/06/uniqlo-loadimage.png)
The captured data is transmitted to cdn-c[.]com
At the time we discovered the attack, the Last-Modified header from the infected JavaScript files within the S3 bucket suggested that they had been harbouring malicious code since at least 13th May.
Uniqlo Australia was Uniqlo's only online shop that appeared to be affected by this attack. We alerted Uniqlo to the compromise and the malicious code was removed from the affected files on 21st May.
Unsecured S3 buckets
This type of attack — in which criminals target less-secure parts of an organisation's supply network — are known as supply chain attacks. This is not the first time supply chain attacks have been used to insert malicious JavaScript into websites. However, we have not identified the exploitation of unsecured S3 buckets to inject code intended to steal personal data entered into a website until recently.
Amazon provides customers with the ability to configure the permissions on their S3 storage with Access Control Lists (ACLs). Using ACLs, users can specify who may view, edit, delete and upload files. In Uniqlo's case, the ACL was misconfigured, allowing any user to modify any of the files within the bucket:
{
"Grantee": {
"Type": "Group",
"URI": "http://acs.amazonaws.com/groups/global/AllUsers"
},
"Permission": "FULL_CONTROL"
},
The criminals took advantage of the lax permissions to add malicious code to every JavaScript file found in the S3 bucket. Uniqlo altered the permissions on the bucket after we provided them with the details of the incident.
Misconfigured permissions on S3 buckets have been the centre of a number of data leaks in the past few years with the NSA and GoDaddy among those affected.
A not-so-unique attack
The Guardian and HuffPost have also loaded compromised resources on their websites, though no customers were affected as the malicious code was loaded in an iframe. The malicious code is intended to work in resources loaded in <script> tags — when the criminals compromise other file types, the malicious code often does not work as intended. If the criminals had been targeting The Guardian, they could have inserted a very convincing phishing site into the article.
The Guardian's website served card stealing code
Software vendors Picreel and Translation Exchange, both of whom provide resources that are loaded on their customers' sites were also compromised. By adding malicious code to just these two buckets, the criminals infected over a thousand sites.
Criminal infrastructure
In all of these cases, the criminals have used the same attack vector and malicious skimming code. We have so far seen a total of six different dropsites that receive credentials from sites compromised in this way:
| Domain | Registered | Registrar | IP Address | Country | Hosting Company |
|---|---|---|---|---|---|
ww1-filecloud[.]com |
2019-01-30 | WebNIC | 45.114.8.162 | Hong Kong | Cloudie Limited |
font-assets[.]com |
2019-04-22 | Shinjiru | 179.43.144.137 | Panama | Private Layer |
cdn-c[.]com |
2019-05-13 | Namecheap | 94.177.123.154 | Russia | QHoster |
cdn-imgcloud[.]com |
2019-05-16 | Shinjiru | 45.114.8.160 | Hong Kong | Cloudie Limited |
js-cloudhost[.]com |
2019-05-17 | Ilovewww | 45.114.8.163 | Hong Kong | Cloudie Limited |
wix-cloud[.]com |
2019-05-17 | Shinjiru | 94.177.123.158 | Russia | QHoster |
This suggests that these attacks are carried out by a single criminal group as part of the same campaign. It is common for criminals to carry out campaigns with more than one dropsite as it makes it harder for their operation to be detected and stopped.
Protect yourself
It is very difficult even for the most tech-savvy consumers to spot a JavaScript skimmer when browsing, making skimmers an invisible threat to online shopping safety. Netcraft's browser extensions and Android app provide protection against online threats, including shopping site skimmers, other forms of malicious JavaScript and phishing.
Companies with customers within the EU that fail to adequately protect personal information can face severe penalties; since GDPR was implemented in 2018, fines of €20 million or up to 4% of annual global turnover can be issued to non-compliant companies. British Airways currently faces a £183m fine from the ICO following a similar attack against its customers. A number of other high-profile shopping sites have recently fallen victim, including Misfit Wearables and ARCTIC.
Netcraft offers a range of services, including web application security testing, to protect organisations and their customers against malicious JavaScript and other forms of attack.
Netcraft Extension adds protection against malicious JavaScript
19th August, 2019
Netcraft has updated its browser extension to add protection against malicious JavaScript, including shopping site skimmers and web miners.
The Netcraft Extension now protects against malicious JavaScript
Shopping site skimmers are malicious JavaScript programs that steal your payment card information when you checkout on a compromised online store, and send it back to a fraudster to use later. These attacks have affected a large number of online shops, and are invisible to even the most vigilant shoppers as there is no visual change to the page.
Web miners are malicious JavaScript programs inserted by fraudsters into a website that let them steal your CPU power to mine for cryptocurrency using your browser without your consent. Browsing a website with a web miner can often slow down your computer by consuming its resources.
Netcraft proactively scans for new shopping site skimmers, web miners, and other malicious JavaScript on the web. In the past six months, we have found malicious JavaScript affecting over 70,000 sites on over 29,000 distinct IPs. We have identified these attacks on high-profile sites such as Cleor (a large French jewellery retailer), Misfit (a wearable devices brand), and Arctic (a PC components and accessories retailer), as well as on the personalized merchandise stores for dozens of sports clubs, including Southampton's and Swansea's.
A well-hidden shopping site skimmer
By using the Netcraft Extension you can get protection from these types of attack as soon as we detect them. It was first made available for Internet Explorer in 2004, Firefox in 2005, Chrome in 2012, Opera in 2013, and Microsoft Edge earlier this year.
Select your browser to download the Netcraft Extension now:
If you already have the Netcraft Extension installed your browser will update it automatically.
The Netcraft app for Android also provides protection against these attacks, while the Netcraft app for iOS provides protection against phishing attacks.
Netcraft releases anti-phishing extension for Microsoft Edge
16th July, 2019
The Netcraft Anti-Phishing Extension is now available for Microsoft Edge.
Netcraft anti-phishing extension on Microsoft Edge.
The Netcraft Anti-Phishing Extension provides phishing and XSS protection as well as informing you about the websites you visit. It was first made available for Internet Explorer in December 2004, followed by Firefox in 2005, Chrome in 2012 and Opera in 2013. Microsoft Edge is now supported with the arrival of the extension in the Windows Store. The extension is compatible with the current version of Microsoft Edge (34+) as well as the preview version available at Microsoft Edge Insider.
The extension displays a website's hosting provider, country, longevity and popularity, along with an abstracted risk rating for each site. Its key features are:
- Protection against phishing sites — the Netcraft anti-phishing community is effectively a giant neighbourhood watch scheme, empowering the most alert and most expert members to defend everyone within the community. As soon as the first recipients of a phishing mail report it, Netcraft blocks it for all users of the extension, providing an additional level of protection from phishing. Netcraft processes reports of fraudulent URLs from a variety of sources and proactively searches for new fraudulent sites.
- Detailed site reports — simply click the Netcraft logo to access a wealth of information about the sites you visit, helping you to make informed choices about their safety.
- Risk ratings — we evaluate the characteristics of the site compared against those depicted by fraudulent sites. The result is a simple visual summary displayed on the site report.
- Convenient reporting for suspected phishing & fraudulent sites — at the click of the button you can report suspected web forgeries to Netcraft, helping to protect the community. Netcraft operates an incentive scheme for phishing site submissions, including iPads, backpacks, mugs, and more. As of July 2019, over 65 million phishing sites have been detected and blocked by Netcraft since its anti-phishing service was launched.
- Protection against cross site scripting (XSS) — the extension optionally traps XSS and other suspicious URLs which contain characters highly likely to deceive.
Left: Microsoft Edge without the Extension - Right: The Netcraft Extension blocking page
The extension is now available to download from the Microsoft Store and once installed will automatically start blocking malicious sites. It is also available from the Google Chrome Store, Opera add-ons page and the Firefox add-ons page.
Netcraft has also released apps for iOS and Android, which protect your mobile device from phishing attacks.
CLEOR : la bijouterie en ligne victime d’un skimmer numérique
22nd May, 2019
La bijouterie en ligne française CLEOR, active dans 136 bijouteries, a été infectée d’un skimmer JavaScript. Le code malveillant injecté est conçu pour envoyer les données bancaires aux criminels sur le formulaire de paiement en ligne légitime de Cleor.
French jewellery chain Cleor falls victim to skimming attack
14th May, 2019
Netcraft recently discovered that French jewellery retailer Cleor—which operates 136 boutiques across France—was infected with a malicious JavaScript skimmer. The injected code sent the fraudster a copy of the credit card details entered by unsuspecting Cleor customers during the legitimate checkout process.
Shopping Site Skimmers
This attack has many of the hallmarks of JavaScript skimming attacks associated with Magecart. Similar to physical card skimmers, credit card credentials are invisibly stolen from unsuspecting customers, in this case through the use of malicious JavaScript code. The stolen credentials are then transmitted to a server (dropsite) under the criminal's control, usually leaving the legitimate transaction unaffected.
In the past few years, this style of attack has affected thousands of websites including those of British Airways and Ticketmaster. As of May 2019, Netcraft is aware of almost 8,000 shopping sites internationally that are currently infected with JavaScript skimming malware. Most of these sites are running common e-commerce software such as Magento, OpenCart and WooCommerce. Attackers target websites running out-of-date versions of these platforms or using plugins with known security flaws.
Skimming for gold
On 10 April 2019, Netcraft discovered that Cleor's website was infected with malicious skimming code.
The malicious code is served from an external domain, cleor.co. This is injected into the website alongside a legitimate Facebook tracking script. The similarity of the domain to the real cleor.com makes it easy to mistake as benign.
A script tag inserted into the website
The skimming code on hxxps://cleor[.]co/api.js has been obfuscated by its author in an attempt to disguise its purpose. This is a common tactic of criminals. When deobfuscated, its malicious intent is made clear:
The malicious code after deobfuscation
The code contains references to credit card input fields, which are used to extract sensitive information entered into the checkout form by visitors to Cleor's site. This data is sent to hxxps://cleor[.]co/track.js, which is also visible in the deobfuscated code.
We confirmed this by doing a test checkout on the site. Once the credit card details were filled in as part of the checkout process, a POST request is sent to hxxps://cleor[.]co/track.js. The data sent to the dropsite is Base64-encoded, decoding it reveals a JSON array containing all of the credentials entered into the form.
Credentials entered into the form are visible in the POST data
Even customers who did not complete their purchase may have been affected, as the credentials are skimmed immediately after they are entered rather than when the checkout form is submitted.
Netcraft alerted Cleor of the incident, and the skimmer injection code has since been removed.
Purpose-Registered Domain
In this attack, a single site, cleor.co, is used to both serve malicious code and receive the stolen credentials. The domain was purpose-registered for this attack, a trait shared with the British Airways skimmer, which makes it easy to mistake the code as benign.
cleor.co was registered with Namecheap on 10 January this year, suggesting the attack may have been carefully planned before deployment or been active for some time.
The criminals responsible for this attack are also plausibly behind at least one other more wide-spread attack from a domain registered just one day later, also with Namecheap, ajaxstatic.com. Both of these attacks are hosted by Ankas-group, the only Moldovan-hosted sources of skimming code identified by Netcraft. ajaxstatic.com is currently hosting at least 27 distinct skimmers which target a range of payment gateways including Authorize.net, Verisign, Stripe and Braintree.
Prevention and protection
A Content-Security-Policy (CSP) header can be used by websites to limit which resources can be loaded by a page by supported browsers. A correctly configured CSP policy can prevent the loading of resources on non-whitelisted domains; in this instance, it could have prevented JavaScript being loaded from cleor.co.
Subresource Integrity (SRI) instructs web browsers to perform integrity checks of third-party resources, which can prevent the browser from loading any resources that have been tampered with. CSP can be used to ensure that all resources loaded on a page use SRI.
In many cases, the proper use of CSP and SRI can protect websites from falling victim to JavaScript attacks; however, it is not a silver bullet. Certain dynamically-loaded scripts are unsuitable for protection by SRI, and if a hacker gains complete control of a server, CSP will often provide no defence. In addition, SRI only provides assurance that a script has not been altered; not that it was safe in the first place.
Netcraft offers a number of services to protect organisations from malicious JavaScript and other forms of attack, including scanning TLDs for malware, web application security testing and enterprise JavaScript protection. For more information on our services, email info@netcraft.com.
Well known UK bank vulnerable to impersonation for five years
15th April, 2019
Netcraft has found that Halifax has been left vulnerable to convincing impersonation attacks for five years. The operator of a website promoting Spanish hotels is able to send and receive emails on the official Halifax online banking domain, and get legitimate security certificates issued for the same domain.
Halifax Online
Halifax operates its online banking service on a separate domain (halifax-online.co.uk) to its main website (halifax.co.uk).
The entry point to Halifax's banking service is via www.halifax-online.co.uk. Visitors to the site without the www. prefix are presented with a browser error.
halifax-online.co.uk
The mail server configuration of halifax-online.co.uk domain is configured in such a way that makes it open to attack.
MX records
A Mail Exchanger (MX) record publishes the location where email should be sent to for addresses on that domain. For example, Netcraft’s own MX records point to mail.netcraft.com. Any system wanting to send email to info@netcraft.com would look up the MX record for netcraft.com, and see they need to forward the email to mail.netcraft.com.
It is common for many domain name owners to delegate its mail processing to a third-party service; Microsoft and Google are notable providers. In the case of halifax-online.co.uk, the MX records point to mail.btwebworld.com.
BT WebWorld
BT WebWorld was a B2B web host and email service offered by BT. BT WebWorld launched in October 1996 and was discontinued in 2013/2014. During its heyday, BT WebWorld was a popular hosting provider used by many British SMEs and large organisations.
The domain name, btwebworld.com, continued to belong to BT until 2015, at which time the domain registration lapsed.
It was then registered by an unaffiliated party on 22nd November 2015, and presently redirects to a hotel-themed website. Some of the original BT WebWorld website content has been copied on to this website. This is likely an attempt by the operator of the website to appear more genuine to search providers, in the hopes of increasing visibility in search results.
Metadata for the IP Address used by btwebworld.com indicates the server is located in Dominica. However, tracing the IP Address shows the server is probably located on the east coast of America. The stated location of the IP Address may have been chosen in an attempt to place the website outside the jurisdiction of certain law enforcement agencies.
Screenshot of btwebworld.com
Why is this a concern?
Any Halifax customer aware of the halifax-online.co.uk website would unlikely be concerned if they received an email appearing to be from halifax-online.co.uk, and could be tricked into sending sensitive information to email accounts on the same domain.
Inconsistent configuration of Halifax’s SPF record increases the chance that fraudulent emails purporting to be from halifax-online.co.uk do not get sent to the ‘spam’ folder, and Halifax would not be alerted to spoofed emails.
Being able to receive email at @halifax-online.co.uk addresses also allows the domain owner to request TLS certificates for the official Halifax online banking domain. This would allow a fraudster to create convincing impersonations of the Halifax website.
SPF
Sender Policy Framework (SPF) is a mechanism that allows a domain name owner to assert control over which servers are permitted to send email from that domain.
An SPF record includes a list of IP Addresses that are allowed to send email for the domain, and an instruction informing email servers how to process email they receive which does not originate from one of the allowed IP Addresses. When a mail server receives an email, the mail server may perform a lookup of the SPF record for the associated domain to determine whether the email is genuine.
A misconfigured SPF record can be advantageous to fraudsters. Email that is permitted by an SPF record is more likely to land in the user’s inbox. Email not permitted is more likely to land in the ‘spam’ folder, or not even get delivered.
The SPF record for halifax-online.co.uk instructs mail servers to only allow email from IP Addresses in its MX record, which in this case is btwebworld.com.
The owner of btwebworld.com — or any sites that share the same email server — would be able to successfully send email from @halifax-online.co.uk addresses, even to email servers which perform checks on SPF records.
TLS Certificates
In order to obtain a certificate issued for a website and appear ‘secure’ the owner of that website needs to prove to a Certificate Authority that they have control over the website. One common method is to prove that you can receive emails sent to a special email address on the domain.
Certificate Transparency (CT) is an initiative where Certificate Authorities publish certificates they issue. This allows unauthorised certificates to be identified. The authorised party could then request the certificate be revoked — although most browsers do not check if certificates have been revoked. It could also request the unauthorised website be taken offline. Providing evidence that the certificate has been included in a CT log is only a requirement for the Chrome browser and recent versions of iOS.
This kind of attack could be partially mitigated through the use of Certificate Authority Authorization (CAA) records. These records allow the domain owner to list the set of Certificate Authorities that are permitted to issue certificates for sites on that domain. There is no CAA record on halifax-online.co.uk.
The end result is that it would be possible for the owner of btwebworld.com to request — and be issued with — a valid certificate for the official Halifax online banking website. The owner could request the certificate from a Certificate Authority that does not require certificates they issue to be logged, reducing the chance of discovery, and would, at least for a significant proportion of web users, appear in the web browser as ‘secure’.
Combined with another attack, such as man-in-the-middle, it would be trivial for a fraudster to create a highly convincing impersonation designed to capture banking credentials of Halifax customers.
Who else is affected?
Netcraft found 131 other domains that still point its MX records at btwebworld.com, including three other Halifax domains, the primary domain of BT’s own BT Wholesale division, 13 domains owned by investment bank Rothschild & Co, a domain for UK insurance company esure, a sub-domain of the NHS, and a domain belonging to soft-drinks company Robinsons.
Netcraft has also found that www.e-commerce.bt.com and www.btbroadband.com both resolve to the same IP Address as btwebworld.com. The owner of this IP Address would be able to set up a phishing attack against BT under an official BT domain.
Remediations
Halifax can make simple changes to their DNS in order to protect itself and its customers from impersonation attacks:
- redirect
halifax-online.co.uktowww.halifax-online.co.ukto prevent visitors attempting to try alternative combinations that might lead them to fraud; - update or remove MX records to prevent email being delivered to a non-affiliated website;
- update the SPF policy to reject emails sent from
halifax-online.co.ukaddresses if it not used for that purpose by Halifax; - add CAA records to ensure only Halifax’s chosen Certificate Authorities are permitted to issue certificates for its domains.
Netcraft has found 171 phishing attacks impersonating Halifax over the past 12 months.
Netcraft offers a range of services to protect organisations against cybercrime, including monitoring of DNS for look-a-like domains, SPF record auditing, and processing DMARC email reports.