Quattuor JavaScript narium qui insidiantur tibi in stores

Fere omnibus servitiis usui sumus de thesauris online, quae significat quod citius aut serius periclitamur ne victima JavaScript narium .

Fere 400 usorum Airlines Britannici website et applicatione mobilia iam sniffers affecti sunt, necnon hospites in societate Britannica lusorum gigantis FILA et tessera distributoria Ticketmaster Americanorum. PayPal, Chase Paymenttech, USAePay, Moneris - hae et multae aliae rationes solutionis infectae sunt.

Comminatio Intelligentia Group-IB Analysta Viktor Okorokov loquitur quomodo stimulos in codice paginae infiltrato et solutionis notitias furantur, itemque quid CRMs oppugnant.

"Minationes occultae";

Accidit ut diu JS sniffers e conspectu anti-virus analystae mansissent, et systemata riparum et solutionum eos gravi comminatione non viderent. Et omnino frustra. Group-IB experts resolvitur 2440 tabernis infectis, quorum visitatores - totalem circiter 1,5 miliones hominum per diem - in periculo compromissi fuerunt. Inter victimas non solum utentes, sed etiam online thesauraria, systemata et ripae solutionis e cardi- nis suspecti edita sunt.

fama Group-IB prima meditatio mercatus est obscurorum narium, infrastructurae et methodi monetizationis, quae creatores eorum decies centena milia dollariorum adducunt. XXXVIII familias snifferorum notavimus, quarum tantum XII inquisitoribus antea notae erant.

Singillatim habitemus in quattuor familiis narium studiorum studiosis.

ReactGet Familiae

Nivei ReactGet familiae adhibentur ut schedulae argentariae data in online shopping sites furantur. Sniffer cum magna multitudine diversarum solutionum systematum in situ usitatum laborare potest: unus valor parametri correspondet uni rationi solutionis, et singulae reperiuntur versiones sniffer documentorum surripere possunt, et ad schedulam argentariam e solutione furandi. formas plurium systematum reddi simul, sicut sniffer universalis sic dicta. In quibusdam casibus deprehensum est, oppugnatores illusio procurantes in administratorum copia online, ut aditus ad tabulam administrativam situs accederet.

Militia hac familia narium incepit mense Maio MMXVII: sites cursus CMS et Magento, Bigcommerce, et suggesta Shopify oppugnata sunt.

Quomodo ReactGet impletur in codice copiae online?

Praeter "classicam" exsequendam scripturae per nexum, operarii ReactGet familiae snifferorum artificio singulari utuntur: JavaScript codicem utens, num inscriptionem hodiernam ubi usor sita est, certis indiciis occurrat. Codices malitiosi modo exsecutioni mandabuntur si substringi praesens in URL currens est Checkout aut unum gradum Checkout, onepage/, e/onepag, Checkout / one, ckout / one. Sic sniffer codicem exacte exequetur tempore quo usor ad solvendum emptionem procedit et informationes solucionis in formam in locum situm intrat.

Hoc sniffer artificio non-vexillo utitur. De victima solutionis et personalis notitia colliguntur et utendo encoded base64et inde chorda pro modulo adhibetur ut rogationem pro loci oppugnatoribus mittat. Saepissime via ad portam limam JavaScript imitatur, e.g resp.js, data.js et sic porro, sed nexus imaginum etiam adhibentur; GIF и PNG. Proprium est quod sniffer objectum imaginis metiendi 1 ab 1 pixel creat et utatur vinculum antea receptum pro modulo. src Imagines. Hoc est, pro tali in negotiatione usoris petitio videbitur sicut petitio pro imagine ordinaria. Similis ars in snifferorum familia ImageID adhibita est. Accedit ars utendi 1 per 1 pixel imaginis in multis legitimis scriptis analyticis analyticis, quae etiam errorem usoris possunt.

Version Analysis

Analysis ditionum activarum quae ab operariis ReactGet sniffer adhibitae sunt, multas varias versiones huius familiae snifferorum manifestavit. Versiones in praesentia vel absentia obfuscationis differunt, et praeterea, quilibet sniffer destinatur pro certae solutionis systemate, quod processuum ripam card solutiones pro online traduntur. Cum per valorem parametri congruentem numero versioni digestus, speciales Group-IB plenam indicem variationum olentis promptorum acceperunt, et nomina agrorum formarum, quas quisque olfacio quaerit in pagina codice, systemata solutionis identificaverunt ut sniffer intenditur.

Index sniffers eorumque systemata mercedem respondentem

Sniffer URL	Payment system
reactjsapi.com/react.js	Authorize.Net
ajaxstatic.com/api.js?v=2.1.1	Cardsave
ajaxstatic.com/api.js?v=2.1.2	Authorize.Net
ajaxstatic.com/api.js?v=2.1.3	Authorize.Net
ajaxstatic.com/api.js?v=2.1.4	eWAY Celeri
ajaxstatic.com/api.js?v=2.1.5	Authorize.Net
ajaxstatic.com/api.js?v=2.1.6	Adyen
ajaxstatic.com/api.js?v=2.1.7	USAePay
ajaxstatic.com/api.js?v=2.1.9	Authorize.Net
apitstatus.com/api.js?v=2.1.1	USAePay
apitstatus.com/api.js?v=2.1.2	Authorize.Net
apitstatus.com/api.js?v=2.1.3	Moneris
apitstatus.com/api.js?v=2.1.5	USAePay
apitstatus.com/api.js?v=2.1.6	PayPal
apitstatus.com/api.js?v=2.1.7	Sapiens Esto
apitstatus.com/api.js?v=2.1.8	Verisign
apitstatus.com/api.js?v=2.1.9	PayPal
apitstatus.com/api.js?v=2.3.0	livorem
apitstatus.com/api.js?v=3.0.2	Realex
apitstatus.com/api.js?v=3.0.3	PayPal
apitstatus.com/api.js?v=3.0.4	LinkPoint
apitstatus.com/api.js?v=3.0.5	PayPal
apitstatus.com/api.js?v=3.0.7	PayPal
apitstatus.com/api.js?v=3.0.8	DataCash
apitstatus.com/api.js?v=3.0.9	PayPal
asianfoodgracer.com/footer.js	Authorize.Net
billgetstatus.com/api.js?v=1.2	Authorize.Net
billgetstatus.com/api.js?v=1.3	Authorize.Net
billgetstatus.com/api.js?v=1.4	Authorize.Net
billgetstatus.com/api.js?v=1.5	Verisign
billgetstatus.com/api.js?v=1.6	Authorize.Net
billgetstatus.com/api.js?v=1.7	Moneris
billgetstatus.com/api.js?v=1.8	Sapiens Esto
billgetstatus.com/api.js?v=2.0	USAePay
billgetstatus.com/react.js	Authorize.Net
cloudodesc.com/gtm.js?v=1.2	Authorize.Net
cloudodesc.com/gtm.js?v=1.3	ANZ eGate
cloudodesc.com/gtm.js?v=2.3	Authorize.Net
cloudodesc.com/gtm.js?v=2.4	Moneris
cloudodesc.com/gtm.js?v=2.6	Sapiens Esto
cloudodesc.com/gtm.js?v=2.7	Sapiens Esto
cloudodesc.com/gtm.js?v=2.8	Chase Paymentech
cloudodesc.com/gtm.js?v=2.9	Authorize.Net
cloudodesc.com/gtm.js?v=2.91	Adyen
cloudodesc.com/gtm.js?v=2.92	PsiGate
cloudodesc.com/gtm.js?v=2.93	Cyber ​​Source
cloudodesc.com/gtm.js?v=2.95	ANZ eGate
cloudodesc.com/gtm.js?v=2.97	Realex
geisseie.com/gs.js	USAePay
gtmproc.com/age.js	Authorize.Net
gtmproc.com/gtm.js?v=1.2	Authorize.Net
gtmproc.com/gtm.js?v=1.3	ANZ eGate
gtmproc.com/gtm.js?v=1.5	PayPal
gtmproc.com/gtm.js?v=1.6	PayPal
gtmproc.com/gtm.js?v=1.7	Realex
livecheckpay.com/api.js?v=2.0	Sapiens Esto
livecheckpay.com/api.js?v=2.1	PayPal
livecheckpay.com/api.js?v=2.2	Verisign
livecheckpay.com/api.js?v=2.3	Authorize.Net
livecheckpay.com/api.js?v=2.4	Verisign
livecheckpay.com/react.js	Authorize.Net
livegetpay.com/pay.js?v=2.1.2	ANZ eGate
livegetpay.com/pay.js?v=2.1.3	PayPal
livegetpay.com/pay.js?v=2.1.5	Cyber ​​Source
livegetpay.com/pay.js?v=2.1.7	Authorize.Net
livegetpay.com/pay.js?v=2.1.8	Sapiens Esto
livegetpay.com/pay.js?v=2.1.9	Realex
livegetpay.com/pay.js?v=2.2.0	Cyber ​​Source
livegetpay.com/pay.js?v=2.2.1	PayPal
livegetpay.com/pay.js?v=2.2.2	PayPal
livegetpay.com/pay.js?v=2.2.3	PayPal
livegetpay.com/pay.js?v=2.2.4	Verisign
livegetpay.com/pay.js?v=2.2.5	eWAY Celeri
livegetpay.com/pay.js?v=2.2.7	Sapiens Esto
livegetpay.com/pay.js?v=2.2.8	Sapiens Esto
livegetpay.com/pay.js?v=2.2.9	Verisign
livegetpay.com/pay.js?v=2.3.0	Authorize.Net
livegetpay.com/pay.js?v=2.3.1	Authorize.Net
livegetpay.com/pay.js?v=2.3.2	Primum Data Global Gateway
livegetpay.com/pay.js?v=2.3.3	Authorize.Net
livegetpay.com/pay.js?v=2.3.4	Authorize.Net
livegetpay.com/pay.js?v=2.3.5	Moneris
livegetpay.com/pay.js?v=2.3.6	Authorize.Net
livegetpay.com/pay.js?v=2.3.8	PayPal
livegetpay.com/pay.js?v=2.4.0	Verisign
maxstatics.com/site.js	USAePay
mediapack.info/track.js?d=funlove.com	USAePay
mediapack.info/track.js?d=qbedding.com	Authorize.Net
mediapack.info/track.js?d=vseyewear.com	Verisign
mxcounter.com/c.js?v=1.2	PayPal
mxcounter.com/c.js?v=1.3	Authorize.Net
mxcounter.com/c.js?v=1.4	livorem
mxcounter.com/c.js?v=1.6	Authorize.Net
mxcounter.com/c.js?v=1.7	eWAY Celeri
mxcounter.com/c.js?v=1.8	Sapiens Esto
mxcounter.com/c.js?v=2.0	Authorize.Net
mxcounter.com/c.js?v=2.1	Braintree
mxcounter.com/c.js?v=2.10	Braintree
mxcounter.com/c.js?v=2.2	PayPal
mxcounter.com/c.js?v=2.3	Sapiens Esto
mxcounter.com/c.js?v=2.31	Sapiens Esto
mxcounter.com/c.js?v=2.32	Authorize.Net
mxcounter.com/c.js?v=2.33	PayPal
mxcounter.com/c.js?v=2.34	Authorize.Net
mxcounter.com/c.js?v=2.35	Verisign
mxcounter.com/click.js?v=1.2	PayPal
mxcounter.com/click.js?v=1.3	Authorize.Net
mxcounter.com/click.js?v=1.4	livorem
mxcounter.com/click.js?v=1.6	Authorize.Net
mxcounter.com/click.js?v=1.7	eWAY Celeri
mxcounter.com/click.js?v=1.8	Sapiens Esto
mxcounter.com/click.js?v=2.0	Authorize.Net
mxcounter.com/click.js?v=2.1	Braintree
mxcounter.com/click.js?v=2.2	PayPal
mxcounter.com/click.js?v=2.3	Sapiens Esto
mxcounter.com/click.js?v=2.31	Sapiens Esto
mxcounter.com/click.js?v=2.32	Authorize.Net
mxcounter.com/click.js?v=2.33	PayPal
mxcounter.com/click.js?v=2.34	Authorize.Net
mxcounter.com/click.js?v=2.35	Verisign
mxcounter.com/cnt.js	Authorize.Net
mxcounter.com/j.js	Authorize.Net
newrelicnet.com/api.js?v=1.2	Authorize.Net
newrelicnet.com/api.js?v=1.4	Authorize.Net
newrelicnet.com/api.js?v=1.8	Sapiens Esto
newrelicnet.com/api.js?v=4.5	Sapiens Esto
newrelicnet.com/api.js?v=4.6	Westpac Payway
nr-public.com/api.js?v=2.0	PayFort
nr-public.com/api.js?v=2.1	PayPal
nr-public.com/api.js?v=2.2	Authorize.Net
nr-public.com/api.js?v=2.3	livorem
nr-public.com/api.js?v=2.4	Primum Data Global Gateway
nr-public.com/api.js?v=2.5	PsiGate
nr-public.com/api.js?v=2.6	Authorize.Net
nr-public.com/api.js?v=2.7	Authorize.Net
nr-public.com/api.js?v=2.8	Moneris
nr-public.com/api.js?v=2.9	Authorize.Net
nr-public.com/api.js?v=3.1	Sapiens Esto
nr-public.com/api.js?v=3.2	Verisign
nr-public.com/api.js?v=3.3	Moneris
nr-public.com/api.js?v=3.5	PayPal
nr-public.com/api.js?v=3.6	LinkPoint
nr-public.com/api.js?v=3.7	Westpac Payway
nr-public.com/api.js?v=3.8	Authorize.Net
nr-public.com/api.js?v=4.0	Moneris
nr-public.com/api.js?v=4.0.2	PayPal
nr-public.com/api.js?v=4.0.3	Adyen
nr-public.com/api.js?v=4.0.4	PayPal
nr-public.com/api.js?v=4.0.5	Authorize.Net
nr-public.com/api.js?v=4.0.6	USAePay
nr-public.com/api.js?v=4.0.7	EBizCharge
nr-public.com/api.js?v=4.0.8	Authorize.Net
nr-public.com/api.js?v=4.0.9	Verisign
nr-public.com/api.js?v=4.1.2	Verisign
ordercheckpays.com/api.js?v=2.11	Authorize.Net
ordercheckpays.com/api.js?v=2.12	PayPal
ordercheckpays.com/api.js?v=2.13	Moneris
ordercheckpays.com/api.js?v=2.14	Authorize.Net
ordercheckpays.com/api.js?v=2.15	PayPal
ordercheckpays.com/api.js?v=2.16	PayPal
ordercheckpays.com/api.js?v=2.17	Westpac Payway
ordercheckpays.com/api.js?v=2.18	Authorize.Net
ordercheckpays.com/api.js?v=2.19	Authorize.Net
ordercheckpays.com/api.js?v=2.21	Sapiens Esto
ordercheckpays.com/api.js?v=2.22	Verisign
ordercheckpays.com/api.js?v=2.23	Authorize.Net
ordercheckpays.com/api.js?v=2.24	PayPal
ordercheckpays.com/api.js?v=2.25	PayFort
ordercheckpays.com/api.js?v=2.29	Cyber ​​Source
ordercheckpays.com/api.js?v=2.4	PayPal Payflow Pro
ordercheckpays.com/api.js?v=2.7	Authorize.Net
ordercheckpays.com/api.js?v=2.8	Authorize.Net
ordercheckpays.com/api.js?v=2.9	Verisign
ordercheckpays.com/api.js?v=3.1	Authorize.Net
ordercheckpays.com/api.js?v=3.2	Authorize.Net
ordercheckpays.com/api.js?v=3.3	Sapiens Esto
ordercheckpays.com/api.js?v=3.4	Authorize.Net
ordercheckpays.com/api.js?v=3.5	livorem
ordercheckpays.com/api.js?v=3.6	Authorize.Net
ordercheckpays.com/api.js?v=3.7	Authorize.Net
ordercheckpays.com/api.js?v=3.8	Verisign
ordercheckpays.com/api.js?v=3.9	PayPal
ordercheckpays.com/api.js?v=4.0	Authorize.Net
ordercheckpays.com/api.js?v=4.1	Authorize.Net
ordercheckpays.com/api.js?v=4.2	Sapiens Esto
ordercheckpays.com/api.js?v=4.3	Authorize.Net
reactjsapi.com/api.js?v=0.1.0	Authorize.Net
reactjsapi.com/api.js?v=0.1.1	PayPal
reactjsapi.com/api.js?v=4.1.2	quod iusserat Dominus
reactjsapi.com/api.js?v=4.1.4	PayPal
reactjsapi.com/api.js?v=4.1.5	Sapiens Esto
reactjsapi.com/api.js?v=4.1.51	Verisign
reactjsapi.com/api.js?v=4.1.6	Authorize.Net
reactjsapi.com/api.js?v=4.1.7	Authorize.Net
reactjsapi.com/api.js?v=4.1.8	livorem
reactjsapi.com/api.js?v=4.1.9	Crassus Zebra
reactjsapi.com/api.js?v=4.2.0	Sapiens Esto
reactjsapi.com/api.js?v=4.2.1	Authorize.Net
reactjsapi.com/api.js?v=4.2.2	Primum Data Global Gateway
reactjsapi.com/api.js?v=4.2.3	Authorize.Net
reactjsapi.com/api.js?v=4.2.4	eWAY Celeri
reactjsapi.com/api.js?v=4.2.5	Adyen
reactjsapi.com/api.js?v=4.2.7	PayPal
reactjsapi.com/api.js?v=4.2.8	Mercator QuickBooks Services
reactjsapi.com/api.js?v=4.2.9	Verisign
reactjsapi.com/api.js?v=4.2.91	Sapiens Esto
reactjsapi.com/api.js?v=4.2.92	Verisign
reactjsapi.com/api.js?v=4.2.94	Authorize.Net
reactjsapi.com/api.js?v=4.3.97	Authorize.Net
reactjsapi.com/api.js?v=4.5	Sapiens Esto
reactjsapi.com/react.js	Authorize.Net
sydneysalonsupplies.com/gtm.js	eWAY Celeri
tagsmediaget.com/react.js	Authorize.Net
tagstracking.com/tag.js?v=2.1.2	ANZ eGate
tagstracking.com/tag.js?v=2.1.3	PayPal
tagstracking.com/tag.js?v=2.1.5	Cyber ​​Source
tagstracking.com/tag.js?v=2.1.7	Authorize.Net
tagstracking.com/tag.js?v=2.1.8	Sapiens Esto
tagstracking.com/tag.js?v=2.1.9	Realex
tagstracking.com/tag.js?v=2.2.0	Cyber ​​Source
tagstracking.com/tag.js?v=2.2.1	PayPal
tagstracking.com/tag.js?v=2.2.2	PayPal
tagstracking.com/tag.js?v=2.2.3	PayPal
tagstracking.com/tag.js?v=2.2.4	Verisign
tagstracking.com/tag.js?v=2.2.5	eWAY Celeri
tagstracking.com/tag.js?v=2.2.7	Sapiens Esto
tagstracking.com/tag.js?v=2.2.8	Sapiens Esto
tagstracking.com/tag.js?v=2.2.9	Verisign
tagstracking.com/tag.js?v=2.3.0	Authorize.Net
tagstracking.com/tag.js?v=2.3.1	Authorize.Net
tagstracking.com/tag.js?v=2.3.2	Primum Data Global Gateway
tagstracking.com/tag.js?v=2.3.3	Authorize.Net
tagstracking.com/tag.js?v=2.3.4	Authorize.Net
tagstracking.com/tag.js?v=2.3.5	Moneris
tagstracking.com/tag.js?v=2.3.6	Authorize.Net
tagstracking.com/tag.js?v=2.3.8	PayPal

Password sniffer

Una commoda JavaScript sniffers laborantis in parte clientis loci versatilis est: malitiosa in loco posita in pagina cuiuslibet generis notitiarum furari potest, fiat solutionis notitia vel rationis et tesserae rationis usoris. Societas-IB speciales detexerunt exemplum sniffer pertinens ad familiam ReactGet, electronicas electronicas furandi et passwords utentium sitorum destinatum.

Intersectio cum ImageID sniffer

In analysi cuiusdam e thesauris infectis repertum est eius situs bis infectam esse: praeter codicem malignum sniffer ReactGet familiae, codicem familiae ImageID umiferum deprehensum est. Hoc aliudque argumentum esse potest quod operarii post utrumque sniffers similes technicis utuntur ut malignum codicem injiciant.

Sniffer universalis

Analysis unius e nominum domain domain cum ReactGet sniffer infrastructurae adjunctis declaravit eundem usorem tria alia nomina domain retulisse. Haec tria dominia fundos websites realis-vitae imitati sunt et antea sniffers hospites usi sunt. Cum examinare codicem trium legitimarum situum, sniffer ignota deprehensa est, et ulterior analysis ostendit emendatam versionem ReactGet sniffer fuisse. Omnes ante monitores huius familiae snifferum versiones quaerebantur ad unicam solutionis rationem, hoc est, singulae solutionis ratio postulabat peculiarem versionem sniffer. Tamen, hoc in casu, deprehensa est universalis versio sniffer quae potest notitias furari ex formis ad 15 varias rationes solvendas et modulos e-commercii situs ad solvendas online praestationum.

Itaque, in principio operis, sniffer quaesivit agros formas fundamentales continens informationes personales victimae: nomen plenum, inscriptio corporis, numerus telephonicus.

Snifer deinde perscrutatus est super 15 diversas praepositiones respondentes diversis rationibus solutionis et modulorum online solutionum.

Deinceps notitia personalis notitiae et solutionis victimae collectae sunt et ad locum ab oppugnante regente missae: in casu particulari, duae versiones universalis ReactGet sniffer repertae sunt, in duobus locis diversis laceratus sitae. Sed ambae versiones furtivae datae ad eundem detruncati locum miserunt zoobashop.com.

Analysis praefixionum quam sniffer usus est ad quaerendas agros in quibus notitiae solutionis victimae nobis permisit determinare hoc stimiferum specimen in sequentibus systematibus solvendis intendisse:

• Authorize.Net
• Verisign
• primo Data
• USAePay
• livorem
• PayPal
• ANZ eGate
• Braintree
• DataCash (MasterCard)
• Realex liberate
• PsiGate
• Heartland Payment Systems

Quae instrumenta sunt ad mercedem notitia furari?

Primum instrumentum, infrastructurae oppugnantium in analysi deprehensum, malitiosis scriptoribus obfuscare adhibetur, quae furti argentariis mandatur. Scriptum bash usus CLI project scriptor inventus est in una oppugnantis exercituum JavaScript-obfuscator ad automate obfuscatio sniffer codice.

Alterum instrumentum repertum designatum est ad codicem generandum responsalem ad sniffer principale onerandum. Hoc instrumentum generat JavaScript codicem qui coercet num usor in pagina solutione sit quaerendo usoris electronicam pro chordis. Checkout, cart et sic de aliis, et si effectus positivus est, signum onerat maxime stimulus ab oppugnatoribus servo. Ut actio malitiosa celetur, omnes lineae, inter lineas experimentales ad paginam solutionis determinandam, necnon nexum ad snifferum, usui sunt encoded. base64.

Phishing impetus

Analysis retis infrastructurae oppugnantium patefactum est coetus criminalis saepe utitur hamatis ut aditus ad tabulam administrativam scopo online reponat. Impugnatores dominium subcriptio quod uisum est similis fundi horrei, ac deinde fictum Magento tabulam administrationis aperias in eam formam login. Si prospere, oppugnatores accessum habebunt ad tabulam administrativam Magento CMS, quae eis facultatem dat websites emendandi et stimulum efficiendi ut fidem schedulam datam surripiat.

infrastructure

Домен	Date inventionis / species
mediapack.info	04.05.2017
adsgetapi.com	15.06.2017
simcounter.com	14.08.2017
mageanalytics.com	22.12.2017
maxstatics.com	16.01.2018
reactjsapi.com	19.01.2018
mxcounter.com	02.02.2018
apitstatus.com	01.03.2018
orderracker.com	20.04.2018
tagstracking.com	25.06.2018
adsapigate.com	12.07.2018
trust-tracker.com	15.07.2018
fbstatspartner.com	02.10.2018
billgetstatus.com	12.10.2018
www.aldenmlilhouse.com	20.10.2018
balletbeautlful.com	20.10.2018
bargalnjunkie.com	20.10.2018
payselector.com	21.10.2018
tagsmediaget.com	02.11.2018
hs-payments.com	16.11.2018
ordercheckpays.com	19.11.2018
geisseie.com	24.11.2018
gtmproc.com	29.11.2018
livegetpay.com	18.12.2018
sydneysalonsupplies.com	18.12.2018
newrelicnet.com	19.12.2018
nr-public.com	03.01.2019
cloudodesc.com	04.01.2019
ajaxstatic.com	11.01.2019
livecheckpay.com	21.01.2019
asianfoodgracer.com	25.01.2019

G-Analytics

Haec familia snifferum telonium de thesauris interretialibus furari solebat. Primum nomen regio in usu relatus est mense Aprili 2016, quod significare potest coetus actionem in medio 2016 incepisse.

In hodierna expeditione coetus nomina domain utitur quae officia realia vitae imitantur, ut Google Analytica et jQuery, navitatem snifferorum cum legitimis scripturis et nominibus domain legitimis similia larvant. Sites cursus Magento CMS oppugnati sunt.

Quomodo G-Analytica in codicem copiae annalis impleatur?

Proprium notam huius familiae variis modis est usus ut informationes usoris subripiat. Praeter classicam iniectionem JavaScript codicem in clientelam situs, coetus criminalis etiam usus est iniectio technicae artis in server parte situs, scilicet PHP scriptorum processus usoris-ingressi notitia. Haec ars periculosa est quia investigatores tertiae factionis difficilem codicem malignum deprehendere facit. Societas-IB speciales detexerunt versionem sniffer immersam in PHP codice situs, utens ditione pro porta dittm.org.

Prima versio odoris etiam inventa est, quae utitur eadem provincia ad notitias furtivas colligendas dittm.org, sed haec versio destinata est ad institutionem in parte clientis angularis.

Coetus postea rationem suam mutavit et magis in occultatione malitiosae actionis et camouflage versari coepit.

Ineunte MMXVII, coetus dominico uti coepit jquery-js.com, errans ut CDN pro jQuery: cum ad locum oppugnantium iens, user ad locum legitimum determinatur. jquery.com.

Et in medio-2018 coetus nomen dominium assumpsit g-analytics.com et actiones sui legitimi Google Analytics dissimulare coepit.

Version Analysis

In analysi ditionum usus ad codicem reponunt, repertum est situm ingentem numerum versionum continere, quae coram obfuscatione differunt, necnon praesentia vel absentia codici impossibilis additae tabellae ad attentionem distrahendam. et absconde malignum codicem.

Totalis ad locum jquery-js.com Sex versiones narium notata sunt. Hi snifferes mittunt notitias furtivas ad electronicam in eodem loco positam cum ipsa sniffer: hxxps://jquery-js[.]com/latest/jquery.min.js:

• hxxps://jquery-js[.]com/jquery.min.js
• hxxps://jquery-js[.]com/jquery.2.2.4.min.js
• hxxps://jquery-js[.]com/jquery.1.8.3.min.js
• hxxps://jquery-js[.]com/jquery.1.6.4.min.js
• hxxps://jquery-js[.]com/jquery.1.4.4.min.js
• hxxps://jquery-js[.]com/jquery.1.12.4.min.js

Postea domain g-analytics.com, adhibita caterva in oppugnationibus post medium 2018 , promptuario pro more narium. In summa, 16 variae versiones snffer inventae sunt. Hoc in casu, porta in notitia furtivae mittendae simulatae nexus imaginis format GIF: hxxp://g-analytics[.]com/__utm.gif?v=1&_v=j68&a=98811130&t=pageview&_s=1&sd=24-bit&sr=2560×1440&vp=2145×371&je=0&_u=AACAAEAB~&jid=1841704724&gjid=877686936&cid
= 1283183910.1527732071:

• hxxps://g-analytica[.]com/libs/1.0.1/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.10/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.11/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.12/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.13/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.14/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.15/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.16/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.3/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.4/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.5/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.6/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.7/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.8/analytica.js
• hxxps://g-analytica[.]com/libs/1.0.9/analytica.js
• hxxps://g-analytica[.]com/libs/analytica.js

Monetization de furto notitia

Coetus criminalis monetae furtivas notitias venditantium per chartas vendentes per specialiter creatum sub terra, quae officia cardariis praebet. Analysis ditionum ab oppugnatoribus adhibita nobis permittitur ut definiamus google-analytics.cm relatus ab eodem usuario ac dominio cardz.vc. Domain cardz.vc refert ad cellarium venditionis furtivae pectoris argentariae Cardsurfs (Flysurfs), quae favorem reportavit in diebus activitatis subterraneis mercaturae catastae AlphaBay quasi cellae venditionis schedulae argentariae furtivae utentis sniffer.

Examinare domain analytical.is, sita in eodem servo ac ditiones ab snifferibus ad colligendas notitias furtivas adhibitas , specialitas Group-IB tabellam in qua crustulum abreptum tigna reperit , quae postea ab elits derelicta fuisse apparet . Una viscus in sextario continebat domain iozoz.comquae antea in 2016 narium activa adhibita est. Scilicet, haec regio antea ab oppugnatore ad chartas colligendas surreptas adhibito stimulo adhibita erat. Haec domain relatus est inscriptionem electronicam [Inscriptio protected], quod etiam ad actis ditionibus cardz.su и cardz.vcad Cardsurfs chartae pertinentes.

Fundata ex notitia consecuta, assumere potest quod familia G-analyticorum narium et subterranea tabernae venditionis schedulae argentariae Cardsurfs ab eisdem tractantur, et promptuarium ad schedulas argentariae vendendas subrepta utens sniffer.

infrastructure

Домен	Date inventionis / species
iozoz.com	08.04.2016
dittm.org	10.09.2016
jquery-js.com	02.01.2017
g-analytics.com	31.05.2018
google-analytics.is	21.11.2018
analytical.to	04.12.2018
google-analytics.to	06.12.2018
google-analytics.cm	28.12.2018
analytical.is	28.12.2018
google-analytics.cm	17.01.2019

Illum familia

Illum est familia snifferorum ad commeatus onlines Magento CMS currentes oppugnandos. Praeter codicem malitiosum introducendum, operarii huius odoris utuntur inductione fictorum plenae mercedis formis, quae datas ad portas ab oppugnatoribus coercendas mittunt.

Cum retiaculum infrastructuram enucleando ab operariis huius snifferis adhibitis, numerus scriptorum malignorum, facinorum, quaestuum fictorum formarum, tum collectio exemplorum cum malitiosorum narium a competitoribus notabantur. Ex informationibus circa tempora apparentiae nominum regionum a coetu adhibitorum, assumi potest expeditionem in fine anni 2016 inceptam esse.

Quomodo Illum impleatur in codice copiae online?

Primae versiones sniffer repertae directe in codice suspecti positi sunt. Quod furatus notitia missus est cdn.illum[.]pw/records.phpporta in usu erat encoded base64.

Postea, versio fasciculata sniffer inventa est quae alia porta utitur. records.nstatistics[.]com/records.php.

secundum fama Willem de Groot, eadem hospita in sniffer adhibita, quae ad effectum deducta est copia websitea factione Germanica possessa CSU.

Analysis oppugnantium website

Societas-IB speciales inventae et enucleatae a loco illo utuntur coetus criminalis ad instrumenta reponenda et notitias furtivas colligendas.

Inter instrumenta in servo oppugnantium inventa fuerunt scripta et res gestae privilegiis in Linux OS: exempli gratia, Linux Privilegium Escalationis Moderare Scriptum a Mike Czumak evolvit, necnon res pro CVE-2009-1185.

Oppugnatores duas res gestas directe oppugnare online stores: первый potest immittere malivoli codice into core_config_data opprimunt CVE-2016-4010; secundus vulnerabilitas RCE in plugins gerit pro CMS Magento, sino arbitrarium codicem in servo telae vulnerabili exsecutioni mandandam.

Etiam, in analysi servientis, varia exempla snifferorum et fictorum solutionum formae inventae sunt, ab oppugnatoribus ad colligendas solutiones informationes ex locis detruncatis adhibita. Ut videre potes ex indice infra, quaedam scripta singillatim pro unoquoque situ detruncata creata sunt, cum solutio universalis pro quibusdam portis CMS et solutione adhibita est. Exempli gratia, scriptor segapay_standart.js и segapay_onpage.js disposito ad exsequendum in locis utens Sapiens redde mercedem porta.

Index scriptorum pro variis portis mercedem

Script	Payment porta
sr.illum[.]pw/mjs_special/visiondirect.co.uk.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/topdierenshop.nl.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/tiendalenovo.es.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/pro-bolt.com.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/plae.co.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/ottolenghi.co.uk.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/oldtimecandy.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/mylook.ee.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs_special/luluandsky.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/julep.com.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs_special/gymcompany.es.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/grotekadoshop.nl.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/fushi.co.uk.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/fareastflora.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/compuindia.com.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs/segapay_standart.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/segapay_onpage.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/replace_standart.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs/all_inputs.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/add_inputs_standart.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/magente/payment_standart.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/magente/payment_redirect.js	//payrightnow[.]cf/?payment=
sr.illum[.]Pw/magente/payment_redcrypt.js	//payrightnow[.]cf/?payment=
sr.illum[.]pw/magente/payment_forminsite.js	// paymentnow[.]tk/?payment=

exercitum paymentnow [.] tk, uti porta in scripto payment_forminsite.jsRepertum est subjectAltName in compluribus libellis ad CloudFlare servitium pertinentibus. Praeterea, exercitum continebat scriptum evil.js. Nomen scriptionis iudicans, partem abusionis CVE-2016-4010 adhiberi potuit, ob quam malitiosam codicem inicere in Magento CMS currentem. Hospes uti hoc scriptum est in porta request.requestnet[.]tkper libellum idem quod hospes paymentnow [.] tk.

Fake mercedem formae

Figura infra exemplum formae ad schedulam datam ingrediendam ostendit. Haec forma online copia inlinquere adhibita erat et chartae notitiae furantur.

Sequens figura exemplum demonstrat ficti PayPal solutionis formae quae ab oppugnatoribus ad infiltrandas sites cum hac solutione adhibita est.

infrastructure

Домен	Date inventionis / species
cdn.illum.pw	27/11/2016
records.nstatistics.com	06/09/2018
request.payrightnow.cf	25/05/2018
paymentnow.tk	16/07/2017
solucionis-line.tk	01/03/2018
paymentpal.cf	04/09/2017
requestnet.tk	28/06/2017

CoffeeMokko familia

CoffeMokko familia snifferorum, quae ad chartas argentariae e copia usorum online furandi destinata est, in usu fuit quia saltem Maio MMXVII. Scilicet, operarii huius familiae snifferorum sunt coetus criminalis Group 2017, descriptis peritioribus RiskIQ in MMXVI. Sites currentes CMSs ut Magento, OpenCart, WordPress, OsCommerce, et Shopify aggressi sunt.

Quomodo CoffeMokko in codicem repositorii annales impleatur?

Operatores huius familiae unicam narium pro unaquaque contagione creant: fasciculus sniffer in indicem situm est src aut js in hostium calculonis servi. Incorporatio in codice situs exercetur per nexum directum ad sniffer.

Sniffer code hardcodes nomina formae agrorum ex quibus notitia furari debet. sniffer etiam sistit num usor in pagina solutionis sit annotando indicem keywords cum inscriptione usoris utentis.

Nonnullae versiones sniffer inventae obfuscatae sunt et chorda encryptata continebantur in quibus summa rerum copia reposita erat: nomina formarum agrorum pro variis systematibus solvendis, necnon portae inscriptionis ad quas notitia furtiva mittenda erat.

Recepta solucionis notitia missus est ad scriptum in hostes' server per viam /savePayment/index.php or /tr/index.php. Utique, hoc scriptum a porta ad praecipuum ministratorem mittere solebat, quae notitias ab omnibus emantariis consolidat. Ut transmissa notitia celare, omnes solutionis informationes victimae encrypted utens base64ac deinde plures substitutiones;

• "e" charactere substituitur cum ":"
• symbolum "w" substituitur cum "+"
• the "o" character is replaced with "%"
• in "d" character substituitur cum "#"
• the character "a" is replaced with "-"
• symbolum "7" substituitur cum "^"
• character "h" reponitur cum "_"
• symbolum cum "@" substituitur.
• character "0" substituitur per "/"
• in "Y" character substituitur "*"

Ex substitutionibus character utens encoded base64 Data decoqueri non possunt sine conversione adversa faciendo.

Hoc est illud fragmentum sniffer Codicis non obfuscato simile:

Infrastructure Analysis

In primis expeditionibus oppugnatores nomina domain descripserunt similes illis sitibus legitimis online shopping. Eorum dominium a legitimo uno symbolo vel alio TLD differre potuit. Ditiones descripserunt solebant codicem sniffer reponunt, nexum cui in codice copia infixa est.

Circulus hic etiam usus est nomina domain reminiscentia popularium jQuery plugins (slickjs[.]org in locis utens plugin slick.js) , portae solucionis (sagecdn[.]org pro locis utens Sapientis Redde mercedem ratio).

Postea coetus ditiones creandi incepit quorum nomina nihil ad rem ditionis aut thema promptuarium pertinerent.

Singula domain correspondebant sedi in quo indicem creatus est /js aut /src. Scripta sniffer in hoc indice reposita sunt: ​​unum sniffer pro qualibet nova contagione. Sniffer in codice interretiali per nexum directum immersit, sed in casibus raris, oppugnatores unum e lima paginarum paginarum modificaverunt et codicem malignum ei addiderunt.

Code Analysis

Primo obfuscatio algorithmus

In nonnullis exemplaribus narium huius familiae repertis, codicem obfuscatae et encryptae notae necessariae ad stimulum operandum inclusae sunt: ​​praesertim, inscriptionem portae sniferam, indicem mercedis agrorum formant, et in quibusdam, codicem fictum. forma solutionis. In codice intra munus, opes in usu erant XOR per clavem, quae ad idem munus argumentum lata est.

Per chordas decryptas cum clave convenienti, singulare pro singulis specimen, chorda omnia chordarum a codice odoriferae charactere separato separatam obtinere potes.

Secunda obfuscatio algorithmus

In postea exempla narium huius familiae, alia mechanismus obfuscatio adhibita est: hoc in casu, notitia encryptata est utendo algorithmo auto-scripto. Filum in quo notitiae encryptae necessariae sunt ad odoriferum ad operandum necessaria lata est ut argumentum ad munus decryptionis.

Utens navigatro consolatorium, notitia encrypted minutum potes et ordinatam sniffer opum obtine.

Connection ad mane MageCart impetus

In analysi unius ditionum quam portae ad colligendas notitias furtivas per globum adhibitae, inventa est hanc aream hosted infrastructuram pro furto scidularum creditarum, idem cum quo usus est Group 1, unus e primis coetibus; inventum a RiskIQ tortoribus.

Duo fasciculi in CoffeMokko familiae narium ornatus inventae sunt:

• mage.js - fasciculus continens Group 1 sniffer code cum porta electronica js-cdn.link
• mag.php - PHP scriptor reus colligendis notitia furatus sniffer

Contenta mage.js fasciculi
Propositum etiam est ut antiquae ditiones a coetu post CoffeMokko familia snifferorum descripti die 17 mensis Maii anno 2017;

• link-js[.]link
• info-js[.]link
• track-js[]link
• map-js[.]link
• smart-js[.]link

Forma horum domain nominum aequet Group 1 nomina domain quae in oppugnationibus 2016 adhibita erant.

Ex factis repertis, sumi potest nexum inter operatores CoffeMokko sniffers et coetus criminalis Group 1 . Scilicet, CoffeMokko operariorum instrumenta et programmata mutuatus ab antecessoribus suis ut chartas furandi possent. Verisimilius tamen est quod coetus criminalis post usum CoffeMokko familiae snifferorum sunt iidem homines qui oppugnationes Group 1 perduxerunt. obsessa et instrumenta studuit singillatim descripta. Coetus interna sua instrumenta expolire et codicem umiferum rescribere coactus est ut impetus suos continuare et latent.

infrastructure

Домен	Date inventionis / species
link-js.link	17.05.2017
info-js.link	17.05.2017
track-js.link	17.05.2017
map-js.link	17.05.2017
smart-js.link	17.05.2017
adorebeauty.org	03.09.2017
security-payment.su	03.09.2017
braincdn.org	04.09.2017
sagecdn.org	04.09.2017
slickjs.org	04.09.2017
oakandfort.org	10.09.2017
citywlnery.org	15.09.2017
dobell.su	04.10.2017
childrensplayclothing.org	31.10.2017
jewsondirect.com	05.11.2017
shop-rnib.org	15.11.2017
closetlondon.org	16.11.2017
misshaus.org	28.11.2017
altilium-force.org	01.12.2017
kik-vape.org	01.12.2017
greatfurnituretradingco.org	02.12.2017
etradesupply.org	04.12.2017
replacemyremote.org	04.12.2017
all-about-sneakers.org	05.12.2017
mage-checkout.org	05.12.2017
nililotan.org	07.12.2017
lamoodbighat.net	08.12.2017
walletgear.org	10.12.2017
dahlie.org	12.12.2017
davidsfootwear.org	20.12.2017
blackriverimaging.org	23.12.2017
exrpesso.org	02.01.2018
parks.su*	09.01.2018
pmtonline.su	12.01.2018
otocap.org	15.01.2018
christohperward.org	27.01.2018
coffetea.org	31.01.2018
energycoffe.org	31.01.2018
energytea.org	31.01.2018
teaoffe.net	31.01.2018
adaptivecss.org	01.03.2018
coffemokko.com	01.03.2018
londontea.net	01.03.2018
ukcoffe.com	01.03.2018
labbe.biz	20.03.2018
altiliumnart.com	03.04.2018
btosports.net	09.04.2018
chicksaddlery.net	16.04.2018
paypaypay.org	11.05.2018
ar500arnor.com	26.05.2018
authorizecdn.com	28.05.2018
slickmin.com	28.05.2018
bannerbuzz.info	03.06.2018
kandypens.net	08.06.2018
mylrendyphone.com	15.06.2018
freshchat.info	01.07.2018
3lift.org	02.07.2018
abtasty.net	02.07.2018
mechat.info	02.07.2018
zoplm.com	02.07.2018
zapaljs.com	02.09.2018
foodandcot.com	15.09.2018
freshdepor.com	15.09.2018
swappastore.com	15.09.2018
verywellfitnesse.com	15.09.2018
elegrina.com	18.11.2018
majsurplus.com	19.11.2018
top5value.com	19.11.2018

Source: www.habr.com