Four JavaScript sniffer that lurk you in online stores

During the analysis of the domains used to store sniffer code, it was found that the site has a large number of versions that differ in the presence of obfuscation, as well as the presence or absence of unreachable code added to the file to distract attention and hide the malicious code.

In total, six versions of sniffers were identified on jquery-js.com. These sniffers send the stolen data to the address located on the same site as the sniffer itself: hxxps: // jquery-js [.] Com / latest / jquery.min.js:

• hxxps://jquery-js[.]com/jquery.min.js
• hxxps://jquery-js[.]com/jquery.2.2.4.min.js
• hxxps://jquery-js[.]com/jquery.1.8.3.min.js
• hxxps://jquery-js[.]com/jquery.1.6.4.min.js
• hxxps://jquery-js[.]com/jquery.1.4.4.min.js
• hxxps://jquery-js[.]com/jquery.1.12.4.min.js

The later g-analytics.com domain, used by the group in attacks since mid-2018, serves as a repository for more sniffers. A total of 16 different sniffer versions were discovered. In this case, the gate to send the stolen data was disguised as a link to a format image GIF: hxxp://g-analytics[.]com/__utm.gif?v=1&_v=j68&a=98811130&t=pageview&_s=1&sd=24-bit&sr=2560×1440&vp=2145×371&je=0&_u=AACAAEAB~&jid=1841704724&gjid=877686936&cid
=1283183910.1527732071:

• hxxps://g-analytics[.]com/libs/1.0.1/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.10/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.11/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.12/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.13/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.14/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.15/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.16/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.3/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.4/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.5/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.6/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.7/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.8/analytics.js
• hxxps://g-analytics[.]com/libs/1.0.9/analytics.js
• hxxps://g-analytics[.]com/libs/analytics.js

Monetization of stolen data

The criminal group monetizes the stolen data by selling cards through a specially created underground store that provides services to carders. An analysis of the domains used by the attackers revealed that google-analytics.cm was registered by the same user as the cardz.vc domain. Domain cardz.vc refers to the Cardsurfs (Flysurfs) store for stolen bank cards, which gained popularity even during the activity of the underground trading platform AlphaBay as a store for selling bank cards stolen using a sniffer.

Analyzing the analytic.is domain located on the same server as the domains used by sniffers to collect stolen data, Group-IB specialists found a file containing cookie-styler logs, which, it seems, was later abandoned by the developer. One of the entries in the log contained the iozoz.com domain, which was previously used in one of the sniffers active in 2016. Presumably, this domain was previously used by an attacker to collect cards stolen using a sniffer. This domain was registered to the email address kts241@gmail.com, which was also used to register cardz.su and cardz.vc domains related to the Cardsurfs carding store.

Based on the data obtained, it can be assumed that the G-Analytics family of sniffers and the underground Cardsurfs bank card store are managed by the same people, and the store is used to sell bank cards stolen using the sniffer.

Infrastructure

Domain	Discovery / Appearance Date
iozoz.com	08.04.2016
dittm.org	10.09.2016
jquery-js.com	02.01.2017
g-analytics.com	31.05.2018
google-analytics.is	21.11.2018
analytic.to	04.12.2018
google-analytics.to	06.12.2018
google-analytics.cm	28.12.2018
analytic.is	28.12.2018
googlc-analytics.cm	17.01.2019

Family illum

Illum is a sniffer family used to attack online stores running CMS Magento. In addition to introducing malicious code, the operators of this sniffer also use full fake payment methods that send data to gates controlled by cybercriminals.

When analyzing the network infrastructure used by the operators of this sniffer, a large number of malicious scripts, exploits, fake payment forms, as well as a collection of examples of malicious sniffers of competitors were noted. Based on the information about the dates of the appearance of domain names used by the group, it can be assumed that the campaign began at the end of 2016.

How Illum Embeds Online Store Code

The first sniffer versions discovered were embedded directly in the code of the compromised site. The stolen data was sent to cdn.illum [.] Pw / records.php, the gate was encoded using base64.

A packaged version of the sniffer was later discovered using a different gate -records.nstatistics[.]com/records.php.

According to a Willem de Groot report, the same host was used in a sniffer that was embedded on the website of a store owned by the German political party CSU.

Analysis of the site of intruders

Group-IB specialists discovered and analyzed the site used by this criminal group to store tools and collect stolen information.

Among the tools detected on the attacker’s server, scripts and exploits for escalating privileges on Linux were found: for example, Linux Privilege Escalation Check Script, developed by Mike Czumak, as well as an exploit for CVE-2009-1185.

The attackers used two exploits directly to attack online stores: the first is able to inject malicious code into core_config_data by exploiting CVE-2016-4010, the second exploits an RCE vulnerability in plug-ins for CMS Magento, allowing arbitrary code to be executed on a vulnerable web server.

Also, during the analysis of the server, various samples of sniffers and fake payment forms were used, used by attackers to collect payment information from hacked sites. As you can see from the list below, some scripts were created individually for each hacked site, while a universal solution was used for certain CMS and payment gateways. For example, the scripts segapay_standart.js and segapay_onpage.js are intended for implementation on sites that use the Sage Pay payment gateway.

List of scripts for various payment gateways

Script	payment gateways
sr.illum[.]pw/mjs_special/visiondirect.co.uk.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/topdierenshop.nl.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/tiendalenovo.es.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/pro-bolt.com.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/plae.co.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/ottolenghi.co.uk.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/oldtimecandy.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/mylook.ee.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs_special/luluandsky.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/julep.com.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs_special/gymcompany.es.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/grotekadoshop.nl.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs_special/fushi.co.uk.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/fareastflora.com.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs_special/compuindia.com.js	//request.payrightnow[.]cf/alldata.php
sr.illum[.]pw/mjs/segapay_standart.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/segapay_onpage.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/replace_standart.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/mjs/all_inputs.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/mjs/add_inputs_standart.js	//request.payrightnow[.]cf/checkpayment.php
sr.illum[.]pw/magento/payment_standart.js	//cdn.illum[.]pw/records.php
sr.illum[.]pw/magento/payment_redirect.js	//payrightnow[.]cf/?payment=
sr.illum[.]pw/magento/payment_redcrypt.js	//payrightnow[.]cf/?payment=
sr.illum[.]pw/magento/payment_forminsite.js	//paymentnow[.]tk/?payment=

The paymentnow [.] Tk host, used as a gate in the payment_forminsite.js script, was detected as subjectAltName in several certificates related to the CloudFlare service. In addition, the evil.js. script was located on the host. Judging by the name of the script, it could be used as part of the operation of CVE-2016-4010, thanks to which it is possible to inject malicious code into the footer of a site running CMS Magento. As a gate, this script used the request.requestnet [.] Tk host, which uses the same certificate as the paymentnow [.] Tk host.

Fake Payment Forms

The figure below shows an example of a form for entering map data. This form was used to embed the online store website and steal card data.

The following figure is an example of a fake PayPal payment form that was used by cybercriminals to deploy to sites with this payment method.

Infrastructure

Domain	Date of discovery / appearance
cdn.illum.pw	27/11/2016
records.nstatistics.com	06/09/2018
request.payrightnow.cf	25/05/2018
paymentnow.tk	16/07/2017
payment-line.tk	01/03/2018
paymentpal.cf	04/09/2017
requestnet.tk	28/06/2017

CoffeMokko Family

The CoffeMokko family of sniffers designed to steal bank cards from users of online stores has been used since at least May 2017. Presumably, the operators of this family of sniffers are the criminal group Group 1, described by RiskIQ specialists in 2016. Attacks were made by sites running such CMS as Magento, OpenCart, WordPress, osCommerce, Shopify.

How CoffeMokko is implemented in the code of the online store

The operators of this family create unique sniffers for each infection: the sniffer file is located in the src or js directory on the attacker server. Implementation in the site code is carried out by a direct link to the sniffer.

In the sniffer code, the names of the form fields from which data must be stolen are hardcoded. The sniffer also checks whether the user is on the payment page, checking the list of keywords with the current address of the user.

Some detected sniffer versions were obfuscated and contained an encrypted string in which the main array of resources was stored: it contained the names of the form fields for various payment systems, as well as the gate address to which the stolen data should be sent.

The stolen payment information was sent to the script on the attacker server along the path /savePayment/index.php or /tr/index.php. Presumably, this script is used to send data from the gate to the main server, consolidating data from all sniffers. To hide the transmitted data, all the victim’s payment information is encoded using base64, and then several symbol replacements occur:

the character “e” is replaced by “:”
the character “w” is replaced by “+”
the character “o” is replaced by “%”
character “d” is replaced by “#”
the character “a” is replaced by “-”
character “7” is replaced by “^”
the character “h” is replaced by “_”
the character “T” is replaced by “@”
the character “0” is replaced by “/”
the character “Y” is replaced by “*”

As a result of character substitutions, base64 encoded data cannot be decoded without reverse conversion.

This is the sniffer code snippet that has not been obfuscated:

Infrastructure analysis

In early campaigns, attackers registered domain names similar to the domains of legitimate online shopping sites. Their domain could differ from the legitimate one character or another TLD. Registered domains were used to store the sniffer code, the link to which was embedded in the store code.

Also, this group used domain names resembling the name of popular plugins for jQuery (slickjs [.] Org for sites using the slick.js plugin), payment gateways (sagecdn [.] Org for sites using the Sage Pay payment system).

Later, the group began to create domains whose name had nothing to do with either the store’s domain or the store’s theme.
This is the sniffer code snippet that has not been obfuscated:

Each domain corresponded to a site on which the / js or / src directory was created. Sniffer scripts were stored in this directory: one sniffer for each new infection. The sniffer was injected into the site code via a direct link, but in rare cases, attackers modified one of the site files and added malicious code to it.

Code analysis

The first obfuscation algorithm

In some detected sniffer samples of this family, the code was obfuscated and contained the encrypted data necessary for the sniffer to work: in particular, the address of the sniffer gate, a list of payment form fields, and in some cases a fake payment form code. In the code inside the function, the resources were encrypted using XOR using the key, which was passed by the argument of the same function.

Having decrypted the string with the corresponding key, unique for each sample, you can get a string containing all the lines from the sniffer code through the separator character.

Second obfuscation algorithm

In later samples of sniffers of this family, another obfuscation mechanism was used: in this case, the data was encrypted using a self-written algorithm. A string containing the encrypted data necessary for the sniffer to work was passed as an argument to the decryption function.

Using the browser console, you can decrypt the encrypted data and get an array containing sniffer resources.

Linkage to Early MageCart Attacks

An analysis of one of the domains used by the group as a gate to collect stolen data revealed that the domain has a credit card theft infrastructure identical to that used by Group 1, one of the first groups discovered by RiskIQ specialists.

Two files were found on the host of the CoffeMokko sniffer family:

mage.js – file containing Group 1 sniffer code with gate address js-cdn.link
mag.php – PHP script responsible for collecting sniffer-stolen data

Mage.js file contents

It was also found that the earliest domains used by the group behind the CoffeMokko sniffer family were registered on May 17, 2017:

link-js [.] link
info-js [.] link
track-js [.] link
map-js [.] link
smart-js [.] link

The format of these domain names is the same as the Group 1 domain names used in the 2016 attacks.

Based on the facts discovered, it can be assumed that there is a connection between the CoffeMokko sniffer operators and the Group 1 criminal group. Presumably, CoffeMokko operators could borrow card theft tools and software from their predecessors. However, it is more likely that the criminal group behind the use of the CoffeMokko family of sniffers is the same people who carried out the attacks as part of the activities of Group 1. After the publication of the first report on the activities of the criminal group, all their domain names were blocked, and the tools were thoroughly studied and are described. The group was forced to take a break, refine their internal tools and rewrite the sniffer code in order to continue their attacks and go unnoticed.

Domain
link-js.link	17.05.2017
info-js.link	17.05.2017
track-js.link	17.05.2017
map-js.link	17.05.2017
smart-js.link	17.05.2017
adorebeauty.org	03.09.2017
security-payment.su	03.09.2017
braincdn.org	04.09.2017
sagecdn.org	04.09.2017
slickjs.org	04.09.2017
oakandfort.org	10.09.2017
citywlnery.org	15.09.2017
dobell.su	04.10.2017
childsplayclothing.org	31.10.2017
jewsondirect.com	05.11.2017
shop-rnib.org	15.11.2017
closetlondon.org	16.11.2017
misshaus.org	28.11.2017
battery-force.org	01.12.2017
kik-vape.org	01.12.2017
greatfurnituretradingco.org	02.12.2017
etradesupply.org	04.12.2017
replacemyremote.org	04.12.2017
all-about-sneakers.org	05.12.2017
mage-checkout.org	05.12.2017
nililotan.org	07.12.2017
lamoodbighats.net	08.12.2017
walletgear.org	10.12.2017
dahlie.org	12.12.2017
davidsfootwear.org	20.12.2017
blackriverimaging.org	23.12.2017
exrpesso.org	02.01.2018
parks.su	09.01.2018
pmtonline.su	12.01.2018
ottocap.org	15.01.2018
christohperward.org	27.01.2018
coffetea.org	31.01.2018
energycoffe.org	31.01.2018
energytea.org	31.01.2018
teacoffe.net	31.01.2018
adaptivecss.org	01.03.2018
coffemokko.com	01.03.2018
londontea.net	01.03.2018
ukcoffe.com	01.03.2018
labbe.biz	20.03.2018
batterynart.com	03.04.2018
btosports.net	09.04.2018
chicksaddlery.net	16.04.2018
paypaypay.org	11.05.2018
ar500arnor.com	26.05.2018
authorizecdn.com	28.05.2018
slickmin.com	28.05.2018
bannerbuzz.info	03.06.2018
kandypens.net	08.06.2018
mylrendyphone.com	15.06.2018
freshchat.info	01.07.2018
3lift.org	02.07.2018
abtasty.net	02.07.2018
mechat.info	02.07.2018
zoplm.com	02.07.2018
zapaljs.com	02.09.2018
foodandcot.com	15.09.2018
freshdepor.com	15.09.2018
swappastore.com	15.09.2018
verywellfitnesse.com	15.09.2018
elegrina.com	18.11.2018
majsurplus.com	19.11.2018
top5value.com	19.11.2018