Shopping Site Skimmers
Skimming for gold
On 10 April 2019, Netcraft discovered that Cleor's website was infected with malicious skimming code.
The malicious code is served from an external domain,
cleor.co. This is injected into the website alongside a legitimate Facebook tracking script. The similarity of the domain to the real
cleor.com makes it easy to mistake as benign.
The skimming code on
hxxps://cleor[.]co/api.js has been obfuscated by its author in an attempt to disguise its purpose. This is a common tactic of criminals. When deobfuscated, its malicious intent is made clear:
The code contains references to credit card input fields, which are used to extract sensitive information entered into the checkout form by visitors to Cleor's site. This data is sent to
hxxps://cleor[.]co/track.js, which is also visible in the deobfuscated code.
We confirmed this by doing a test checkout on the site. Once the credit card details were filled in as part of the checkout process, a POST request is sent to
hxxps://cleor[.]co/track.js. The data sent to the dropsite is Base64-encoded, decoding it reveals a JSON array containing all of the credentials entered into the form.
Even customers who did not complete their purchase may have been affected, as the credentials are skimmed immediately after they are entered rather than when the checkout form is submitted.
Netcraft alerted Cleor of the incident, and the skimmer injection code has since been removed.
In this attack, a single site,
cleor.co, is used to both serve malicious code and receive the stolen credentials. The domain was purpose-registered for this attack, a trait shared with the British Airways skimmer, which makes it easy to mistake the code as benign.
cleor.co was registered with Namecheap on 10 January this year, suggesting the attack may have been carefully planned before deployment or been active for some time.
The criminals responsible for this attack are also plausibly behind at least one other more wide-spread attack from a domain registered just one day later, also with Namecheap,
ajaxstatic.com. Both of these attacks are hosted by Ankas-group, the only Moldovan-hosted sources of skimming code identified by Netcraft.
ajaxstatic.com is currently hosting at least 27 distinct skimmers which target a range of payment gateways including Authorize.net, Verisign, Stripe and Braintree.
Prevention and protection
Subresource Integrity (SRI) instructs web browsers to perform integrity checks of third-party resources, which can prevent the browser from loading any resources that have been tampered with. CSP can be used to ensure that all resources loaded on a page use SRI.
Posted by Seth Hayward in Security
Netcraft has found that Halifax has been left vulnerable to convincing impersonation attacks for five years. The operator of a website promoting Spanish hotels is able to send and receive emails on the official Halifax online banking domain, and get legitimate security certificates issued for the same domain.
The entry point to Halifax's banking service is via
www.halifax-online.co.uk. Visitors to the site without the
www. prefix are presented with a browser error.
The mail server configuration of
halifax-online.co.uk domain is configured in such a way that makes it open to attack.
A Mail Exchanger (MX) record publishes the location where email should be sent to for addresses on that domain. For example, Netcraft’s own MX records point to
mail.netcraft.com. Any system wanting to send email to
firstname.lastname@example.org would look up the MX record for
netcraft.com, and see they need to forward the email to
It is common for many domain name owners to delegate its mail processing to a third-party service; Microsoft and Google are notable providers. In the case of
halifax-online.co.uk, the MX records point to
BT WebWorld was a B2B web host and email service offered by BT. BT WebWorld launched in October 1996 and was discontinued in 2013/2014. During its heyday, BT WebWorld was a popular hosting provider used by many British SMEs and large organisations.
The domain name,
btwebworld.com, continued to belong to BT until 2015, at which time the domain registration lapsed.
It was then registered by an unaffiliated party on 22nd November 2015, and presently redirects to a hotel-themed website. Some of the original BT WebWorld website content has been copied on to this website. This is likely an attempt by the operator of the website to appear more genuine to search providers, in the hopes of increasing visibility in search results.
Metadata for the IP Address used by
btwebworld.com indicates the server is located in Dominica. However, tracing the IP Address shows the server is probably located on the east coast of America. The stated location of the IP Address may have been chosen in an attempt to place the website outside the jurisdiction of certain law enforcement agencies.
Why is this a concern?
Any Halifax customer aware of the
halifax-online.co.uk website would unlikely be concerned if they received an email appearing to be from
halifax-online.co.uk, and could be tricked into sending sensitive information to email accounts on the same domain.
Inconsistent configuration of Halifax’s SPF record increases the chance that fraudulent emails purporting to be from
halifax-online.co.uk do not get sent to the ‘spam’ folder, and Halifax would not be alerted to spoofed emails.
Being able to receive email at
@halifax-online.co.uk addresses also allows the domain owner to request TLS certificates for the official Halifax online banking domain. This would allow a fraudster to create convincing impersonations of the Halifax website.
Sender Policy Framework (SPF) is a mechanism that allows a domain name owner to assert control over which servers are permitted to send email from that domain.
An SPF record includes a list of IP Addresses that are allowed to send email for the domain, and an instruction informing email servers how to process email they receive which does not originate from one of the allowed IP Addresses. When a mail server receives an email, the mail server may perform a lookup of the SPF record for the associated domain to determine whether the email is genuine.
A misconfigured SPF record can be advantageous to fraudsters. Email that is permitted by an SPF record is more likely to land in the user’s inbox. Email not permitted is more likely to land in the ‘spam’ folder, or not even get delivered.
The SPF record for
halifax-online.co.uk instructs mail servers to only allow email from IP Addresses in its MX record, which in this case is
The owner of
btwebworld.com — or any sites that share the same email server — would be able to successfully send email from
@halifax-online.co.uk addresses, even to email servers which perform checks on SPF records.
In order to obtain a certificate issued for a website and appear ‘secure’ the owner of that website needs to prove to a Certificate Authority that they have control over the website. One common method is to prove that you can receive emails sent to a special email address on the domain.
Certificate Transparency (CT) is an initiative where Certificate Authorities publish certificates they issue. This allows unauthorised certificates to be identified. The authorised party could then request the certificate be revoked — although most browsers do not check if certificates have been revoked. It could also request the unauthorised website be taken offline. Providing evidence that the certificate has been included in a CT log is only a requirement for the Chrome browser and recent versions of iOS.
This kind of attack could be partially mitigated through the use of Certificate Authority Authorization (CAA) records. These records allow the domain owner to list the set of Certificate Authorities that are permitted to issue certificates for sites on that domain. There is no CAA record on
The end result is that it would be possible for the owner of
btwebworld.com to request — and be issued with — a valid certificate for the official Halifax online banking website. The owner could request the certificate from a Certificate Authority that does not require certificates they issue to be logged, reducing the chance of discovery, and would, at least for a significant proportion of web users, appear in the web browser as ‘secure’.
Combined with another attack, such as man-in-the-middle, it would be trivial for a fraudster to create a highly convincing impersonation designed to capture banking credentials of Halifax customers.
Who else is affected?
Netcraft found 131 other domains that still point its MX records at
btwebworld.com, including three other Halifax domains, the primary domain of BT’s own BT Wholesale division, 13 domains owned by investment bank Rothschild & Co, a domain for UK insurance company esure, a sub-domain of the NHS, and a domain belonging to soft-drinks company Robinsons.
Netcraft has also found that
www.btbroadband.com both resolve to the same IP Address as
btwebworld.com. The owner of this IP Address would be able to set up a phishing attack against BT under an official BT domain.
Halifax can make simple changes to their DNS in order to protect itself and its customers from impersonation attacks:
www.halifax-online.co.ukto prevent visitors attempting to try alternative combinations that might lead them to fraud;
- update or remove MX records to prevent email being delivered to a non-affiliated website;
- update the SPF policy to reject emails sent from
halifax-online.co.ukaddresses if it not used for that purpose by Halifax;
- add CAA records to ensure only Halifax’s chosen Certificate Authorities are permitted to issue certificates for its domains.
Netcraft has found 171 phishing attacks impersonating Halifax over the past 12 months.
Netcraft offers a range of services to protect organisations against cybercrime, including monitoring of DNS for look-a-like domains, SPF record auditing, and processing DMARC email reports.
Posted by James Michael in Security
An extremely convincing phishing attack that impersonates a multi-game skin trade bot appears to be using a fake Extended Validation TLS certificate to steal Steam accounts.
The ongoing phishing attack impersonates TradeIt.gg, which facilitates the trading of skins, weapons and other in-game commodities within popular games like CS:GO, TF2 and DOTA.
When a victim attempts to sign in through Steam to view their inventory on the spoof trading site, Steam's OpenID login form opens in a new window, clearly displaying its use of an Extended Validation certificate issued to Valve Corp...
... or does it?
Extended Validation (EV) certificates offer the highest level of assurance that a website is being operated by a bona fide legal entity, which is why phishers like to make use of them whenever they can. EV certificates typically cost more than both domain and organisation validated certificates, as the issuance process involves a more stringent vetting process.
However, in this case, the fraudster has bypassed all of the expenses and vetting requirements by simply presenting a fake — yet very convincing — EV certificate indicator next to the address bar.
Closer inspection reveals that the Steam login page is also a spoof form, and it is not actually being displayed in a new browser window at all – it is being shown in an interactive, movable iframe that behaves like a window, allowing the fraudster to dress the "window" up however he likes. The tell-tale feature to look out for here is that the fake window cannot be maximized or moved beyond the boundaries of the spoof trading website.
Needless to say, when a victim submits their Steam credentials into this fake window, they will be stolen by a PHP script on the phishing site. The phisher can then monetize the compromised Steam account by selling it directly or by trading the victim's valuable in-game commodities.
Fraudsters have a long history of exploiting user interface redressing vulnerabilities to make better phishing attacks. More than 14 years ago, Netcraft's anti-phishing toolbar community discovered a particularly fiendish set of examples that exploited a vulnerability in Microsoft Internet Explorer, which allowed part of the webpage to be placed on top of the browser's own address bar.
There are often resurgences in these types of attack, but the certificate and address spoofing techniques are usually forced to change as browser security improves and becomes more restrictive. No doubt there will be more attacks like these in the future, as phishing site developers continue to evolve new tricks.
Netcraft has been protecting consumers against phishing attacks for 15 years. You can enjoy the best protection against the latest attacks, including this Steam trading attack, by installing the desktop Netcraft Extension and Netcraft app for Android.
Dozens more U.S. government websites have become inaccessible since last week, when Netcraft highlighted the impact of security certificates expiring during the federal shutdown.
As of today, more than 130 TLS certificates used by U.S. government websites have expired without being renewed. Some of these sites are now completely inaccessible in modern browsers due to their strict transport security policies.
The latest sites to be affected include some particularly prominent examples.
Take https://manufacturing.gov, for instance. While Trump is keen to highlight the performance of U.S. manufacturing during his administration, the shutdown has meant that nobody was available to renew the site's TLS certificate when it expired on 14 January 2019. Consequently, https://manufacturing.gov is dead in the water, along with https://manufacturingusa.com which shares the same certificate.
Furthermore, as https://manufacturing.gov appears in Chromium's HSTS preload list, visitors are unable to bypass the browser's security warnings, rendering the site unreachable.
A White House subdomain at https://pages.mail.whitehouse.gov has also become unreachable. The certificate used by this site expired on 15 January 2019 and has not been renewed. This site is also covered by an effective preloaded HSTS policy.
Other notable websites to have been affected by expired certificates over the past five days include two FAA (Federal Aviation Authority) websites, a National Archives customer portal, the FFIEC (Federal Financial Institutions Examination Council) Anti-Money Laundering Infobase, several Department of Agriculture sites, and several governmental remote access services.
When the federal government restarts, the White House will need to renew its certificate for pages.mail.whitehouse.gov. The list price for a replacement DigiCert organisation validated certificate — similar to the expired one — could be up to $399 per year, or about 70 Big Macs.
Dozens of U.S. government websites have been rendered either insecure or inaccessible during the ongoing U.S. federal shutdown. These sites include sensitive government payment portals and remote access services, affecting the likes of NASA, the U.S. Department of Justice, and the Court of Appeals.
With around 400,000 federal employees currently furloughed, more than 80 TLS certificates used by .gov websites have so far expired without being renewed. To compound the situation, some of these abandoned websites can no longer be accessed due to strict security measures that were implemented long before the shutdown started.
One such example is https://ows2.usdoj.gov, a U.S. Department of Justice website which uses a certificate that expired in the week leading up the shutdown. The certificate has been signed by a trusted certificate authority, GoDaddy, but it has not been renewed since it expired on 17 December 2018.
In a twist of fate, the usdoj.gov domain — and all of its subdomains — are included in Chromium's HSTS preload list. This is a prudent security measure which forces modern browsers to only use secure, encrypted protocols when accessing the U.S. DoJ websites; however, it will also prevent users from visiting the HTTPS sites when an expired certificate is encountered. In these cases, modern browsers like Google Chrome and Mozilla Firefox deliberately hide the advanced option that would let the user bypass the warning and continue through to the site.
While this behaviour is bound to frustrate some users, in this case, security is arguably better than usability when you can't have both. If users were to ignore such warnings, they would be vulnerable to the type of man-in-the-middle attacks that TLS certificates were intended to combat.
However, only a few of the affected .gov sites implement correctly-functioning HSTS policies. Just a handful of the sites appear in the HSTS preload list, and only a small proportion of the rest attempt to set a policy via the Strict-Transport-Security HTTP header – but the latter policies will not be obeyed when they are served alongside an expired certificate, and so will only be effective if the user has already visited the sites before.
Consequently, most of the affected sites will display an interstitial security warning that the user will be able to bypass. This introduces some realistic security concerns, as task-oriented users are more likely to ignore these security warnings, and will therefore render themselves vulnerable to man-in-the-middle attacks.
For example, https://rockettest.nasa.gov/ is not included in the HSTS preload list, and its certificate expired on 5 January 2019. This causes browsers to display an interstitial security warning that users can ignore.
The following example clearly demonstrates the potential dangers of ignoring browser security warnings. The certificate used by this Berkeley Lab .gov website at https://d2l.lbl.gov expired on 8 January 2019 (although Berkeley Lab was not affected by the shutdown) and has not yet been replaced. As there is no effective HSTS policy, users can ignore the browser's warnings and proceed to the login form.
With Donald Trump seemingly unwilling to compromise on his demands for a wall along the border with Mexico, and Democrats refusing to approve a budget containing $5.7bn for the wall, the hundreds of thousands of unpaid federal employees might not be the only ones hurting. As more and more certificates used by government websites inevitably expire over the following days, weeks — or maybe even months — there could be some realistic opportunities to undermine the security of all U.S. citizens.
Thousands of phishing sites have been finding homes in special hidden directories on compromised web servers.
In the past month alone, over 400 new phishing sites were found hosted within directories named
/.well-known/; but rather than being created by fraudsters, these special directories are already present on millions of websites.
/.well-known/ directory acts as a URI path prefix for "well-known locations", as defined by IETF RFC 5785, and provides a way for both humans and automated processes to discover a website's policies and other information.
One of the most common legitimate uses of the
/.well-known/ directory is to prove control over a domain. When a secure website uses the Automatic Certificate Management Environment (ACME) protocol to manage its SSL certificate, the issuer will verify ownership by checking for a unique token in
/.well-known/pki-validation/. Consequently, most of the phishing attacks that make use of the
/.well-known/ directory have been deployed on sites that support HTTPS, using certificates issued by ACME-driven certificate authorities like Let's Encrypt and cPanel.
Due to the success of Let's Encrypt and ACME, millions of websites now have a
/.well-known/ directory in their web root, although many website administrators may be oblivious to its presence – particularly if they did not create the directory themselves. The directory can also easily be overlooked, as a bare
ls command will treat files or directories that start with a "." as hidden. These factors make
/.well-known/ an ideal place to smuggle phish onto a compromised web server.
Shared hosting platforms are particularly vulnerable to misuse if the file system permissions on the
/.well-known/ directories are overly permissive, allowing one website to place content on another customer's website. Some of the individual servers involved in these attacks were hosting "well-known" phishing sites for multiple hostnames, which lends weight to this hypothesis.
Other well-known URIs
In addition to
acme-challenge, there are 30 other widely recognised well-known URI suffixes defined by the IETF, W3C and others. For example, the EFF came up with the
dnt-policy.txt suffix, which allows websites to announce their compliance with user opt-outs from tracking. The EFF's own Do Not Track Compliance Policy can be viewed at https://www.eff.org/.well-known/dnt-policy.txt.
Where multiple resources may be required, the well-known URI suffix is a directory rather than a file. For example, the IETF's Enrollment over Secure Transport RFC defines a set of resources that can be found under the
Despite there being several other well-known URI directory suffixes, only
acme-challenge have been used to host recent phishing sites. In fact, more than half of the phishing sites found under the
/.well-known/ directory were planted within the subdirectories created by ACME clients (i.e.
/.well-known/acme-challenge/), possibly making them even less likely to be noticed by the website administrators.
The possible route of compromise is not always apparent in the aforementioned cases, but if there are any glaring security misconfigurations, a proposed new well-known URI suffix,
security.txt, could come in handy. By placing contact details and disclosure policies in
/.well-known/security.txt, website administrators can make it safer and easier for security researchers to reach out and report any problems they find.
Your link here? Advertising on the Netcraft Blog