The Magecart threat and how you can mitigate the risk to your - PowerPoint PPT Presentation

May 18, 2023 •150 likes •471 views

15:20 15:40 The Magecart threat and how you can mitigate the risk to your organisation Benjamin Sims Founder Tech City Labs #teissamsterdam1 9 MAGECART: HOW TWO HUGE COMPANIES LOST 450,000 CUSTOMERS DETAILS AND HOW YOU CAN STOP IT

15:20 – 15:40 The Magecart threat and how you can mitigate the risk to your organisation Benjamin Sims Founder Tech City Labs #teissamsterdam1 9
MAGECART: HOW TWO HUGE COMPANIES LOST 450,000 CUSTOMERS’ DETAILS AND HOW YOU CAN STOP IT HAPPENING TO YOU
ABOUT ME Benjamin Sims - Founder of Tech City Labs DATA - Background in data engineering and security - Advise law firms on litigation around hacking, DETECTIVE phishing on fraud cases
ABOUT THIS TALK - Based on public information and (a little) speculation - No inside knowledge - Check out riskiq.com
TICKETMASTER
BRITISH AIRWAYS
WHO DID IT? - ‘Magecart’ - Background in shopping cart hacks - Actually 6 or 7 groups - Card numbers sold on to carding forums in bulk
MORE AND MORE SOPHISTICATED - Deliberate targeting - SSL certificates - Infrastructure designed to blend in - A whole industry: marketplaces, specialist suppliers
DATA LOST Names ● Addresses ● Credit card numbers ● Phone numbers ● CVC codes ●
3RD PARTY JAVASCRIPT INJECTION:
EVERY WEBSITE AFFECTED 91
THE TICKETMASTER HACK HACK
WHAT IT WAS SUPPOSED TO DO
INCLUDED ON EVERY PAGE ON THE SITE
… AND SOMEBODY HACKED IT
… TO INCLUDE SKIMMER CODE
PEOPLE START TO NOTICE Text May 10th (46 days) April 12th (28 days)
BRITISH AIRWAYS - Targeted attack, script highly modified to work only on ba.com - Hidden in edited version of the open source Modernizr library - Hosted on BA’s *own website* - Most likely the CMS compromised in some way
PEOPLE START TO NOTICE
PEOPLE START TO NOTICE Text: 6th June (73 days)
THEY REALISE… 130 days, 40,000 sets of user details (in the UK)
BRITISH AIRWAYS 14 days... 380,000 customer details taken
MANY MORE
HOW TO AVOID BEING THE NEXT VICTIM? 1. Who can make changes? 2. Who have you trusted? 3. Listen to your users and partners 4. Technical solutions
WHO CAN MAKE CHANGES? MARKETING? DESIGN?
WHO HAVE YOU TRUSTED?
LISTEN WHEN PEOPLE TELL YOU YOU'VE BEEN HACKED
TECHNICAL SOLUTIONS - iFrame sandboxing - source code monitoring - SRI
SRI Magecart don't want you to know this one simple trick! Subresource integrity checking ● W3C recommendation from 2016 ● Supported by 90% of browsers ●
ALL YOU NEED TO DO srihash.org
Available for questions / consulting @techcitylabs benjamin@techcitylabs.com

Recommend

Assessment What is Threat Assessment Threat assessment is the process of gathering

Threat Assessment What is Threat Assessment Threat assessment is the process of gathering information to understand the threat of violence posed by a person. Threat management is the process of developing and executing plans to mitigate

332 views • 15 slides

Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to

Honeymoon Threat Restoration Rescue Phases of Disaster Despair Threat Threat Phase: Small events serve as a warning or threat to normal living. A disaster has not yet oc- curred, but there is a sense of impending doom. Individual

604 views • 6 slides

What Does This Advanced Threat Landscape Look Like? Advanced Threat Landscape

DDoS & Modern Threat Motives Dan Holden Director, ASERT What Does This Advanced Threat Landscape Look Like? Advanced Threat Landscape Geo-poli:cal More defenses ? App/Content t a

1.13k views • 44 slides

Active Threat on Campus Prevention & Response Active threat defined An active threat can be

Active Threat on Campus Prevention & Response Active threat defined An active threat can be defined as: A person whose immediate activity can cause death and/or serious injury An active threat can involve a firearm or another

395 views • 15 slides

Offensive Threat Modeling for Attackers turning threat modeling on its head Rafal M. Los

Offensive Threat Modeling for Attackers turning threat modeling on its head Rafal M. Los Chief Security Evangelist HP Software Shane MacDougall Principal Tactical Intelligence Modern threat modeling is a defensive response to

783 views • 52 slides

Threat Modeling and S haring S ummary Proposal to kick off Threat Modeling proj ect

Threat Modeling and S haring S ummary Proposal to kick off Threat Modeling proj ect Multi-phase approach Initially: create Cyber Domain PIM and S TIX PS M with UML Profile for NIEM Expand to other PS M, create Threat Meta

211 views • 10 slides

Proposed Low-Threat Petroleum UST Closure Policy SWRCB Low-Threat UST Closure Policy Task Force

Proposed Low-Threat Petroleum UST Closure Policy SWRCB Low-Threat UST Closure Policy Task Force Los Angeles RWQCB Presentation September 15, 2011 Prologue Low-Threat Policy: An Evolutionary Process STATE WATER RESOURCES CONTROL BOARD

528 views • 31 slides

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go

Web Security What should be the Threat Model for the Web? Goal and Threat Model Much can go wrong on the web! Clients encounter malicious content Web servers are target of break-ins Fake content/servers trick users Data sent

446 views • 16 slides

Integrated Threat Management Appliance 1 http://www.youtube.com/watch?v=F 7pYHN9iC9I 2 3

Integrated Threat Management Appliance 1 http://www.youtube.com/watch?v=F 7pYHN9iC9I 2 3 Denial of Service Attack (DoS) 4 THREAT CATEGORY THREAT ACTION TYPE Malware/Badware Send data to the external entity/site, Trapdoor/Backdoor Entry,

719 views • 23 slides

Threat Models CS 5431 February 10, 2017 Threat Models Threats (CS 5430)

Introduction Threat Models CS 5431 February 10, 2017 Threat Models Threats (CS 5430) Inquisitive people, unintentional blunders Hackers driven by technical challenges Disgruntled employees or

357 views • 23 slides

How to use soft OA methods to explore future IED threat and their countermeasures 27 ISMOR

How to use soft OA methods to explore future IED threat and their countermeasures 27 ISMOR 2010 Introduction Cause Current threat around IEDs is continuously changing Little known about possible future threat Goal List

210 views • 16 slides

and Research Programs Threat to Aquatic Life and Water Quality Threat to local economy

Harmful Algal Blooms, Agricultural Initiatives, and Research Programs Threat to Aquatic Life and Water Quality Threat to local economy (Fisheries, Recreation, Tourism etc.) Sources: both Urban & Rural Whats Agricultures

520 views • 24 slides

Topics 1 . Building national interest in threat assessm ent 2 . Virginia threat assessm ent m

The Virginia Model of School Threat Assessment June 19, 2019 Dewey Cornell, Ph.D. The Virginia Model of School Threat Assessm ent Dewey Cornell, Ph.D. Curry School of Education University of Virginia 434-924-8929 Email:

299 views • 15 slides

Insider Threat Insider Threat (Database Intrusion Detection) 1 Insider Threats: Motivation and

Insider Threat Insider Threat (Database Intrusion Detection) 1 Insider Threats: Motivation and Challenges Challenges Mission critical information = High value target Threatens Government organizations and large corporations

435 views • 39 slides

Counterintelligence & Insider Threat Detection National Insider Threat Special Interest Group

Counterintelligence & Insider Threat Detection National Insider Threat Special Interest Group July 18, 2017 Douglas D. Thomas Director, Counterintelligence Operations & Corporate Investigations Lockheed Martin Counterintelligence

706 views • 16 slides

Th The ABC BCs of of ICS Th Threat Act ctiv ivit ity y Grou oups Au August st 2 26, 2

Th The ABC BCs of of ICS Th Threat Act ctiv ivit ity y Grou oups Au August st 2 26, 2 2020 Sergio Caltagirone Dave Bittner VP Threat Intelligence Producer & Host Dragos The CyberWire Podcast Before we get started - The

874 views • 17 slides

Outline Starting synchronous lecture recording CSci 4271W More perspectives on threat modeling

Outline Starting synchronous lecture recording CSci 4271W More perspectives on threat modeling Development of Secure Software Systems Threat modeling: printer manager Day 7: More Threat Modeling Stephen McCamant Logistics update, incl.

564 views • 4 slides

THE ANATOMY OF CYBER THREAT INTELLIGENCE (CTI) Noureen Njoroge OVERVIEW Define Cyber Threat

THE ANATOMY OF CYBER THREAT INTELLIGENCE (CTI) Noureen Njoroge OVERVIEW Define Cyber Threat Intelligence (CTI) Define Cyber Intelligence (CI) Understand the importance of CTI to an organization Components of Threat Sources of

197 views • 19 slides

Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence GREM, EnCE, GCFA, MBA 3

Threat Intelligence Jeremy Batterman Global Leader Threat Intelligence GREM, EnCE, GCFA, MBA 3 October 2018 What is Intelligence Convincing evidence Probable cause, beyond a reasonable doubt, or preponderance of

646 views • 25 slides

Topics skew ed picture 1 . Public fears versus facts about school shootings 2 . Virginia threat

Before the Gunman Arrives: School Threat Assessment Sept 25, 2019 Dewey Cornell, Ph.D. Before the Gunm an Arrives: Dewey G. Cornell, Ph. D. School Threat Assessm ent Professor of Education in the Curry School of Education and Human

423 views • 13 slides

AN INTRODUCTION TO THREAT MODELING IN PRACTICE Thorsten Tarrach, Christoph Schmittner WHAT IS

AN INTRODUCTION TO THREAT MODELING IN PRACTICE Thorsten Tarrach, Christoph Schmittner WHAT IS THREAT MODELING Introduction WHAT IS THREAT MODELING Structured Process Examination of a system for potential weaknesses

391 views • 28 slides

Assessing the Biological Threat: A Delphi Study Crystal Boddie, MPH December 16, 2015 BWC MSP,

Assessing the Biological Threat: A Delphi Study Crystal Boddie, MPH December 16, 2015 BWC MSP, Geneva Assessing the Bioweapons Threat In assessing the threat posed by biological weapons use we often rely on expert opinion There are few

441 views • 10 slides

Lessons from Star Wars Adam Shostack @adamshostack Agenda What is threat modeling? A

Threat Modeling: Lessons from Star Wars Adam Shostack @adamshostack Agenda What is threat modeling? A simple approach to threat modeling Top 10 lessons Learning more What is threat modeling? A SIMPLE APPROACH TO THREAT

606 views • 41 slides

Practical Approach For Lightway Threat Modeling Automation Vitaly Davidoff CISSP , CSSLP

Practical Approach For Lightway Threat Modeling Automation Vitaly Davidoff CISSP , CSSLP Agenda What is Threat Modeling Existing Methodologies Problems in common solution Lightway Threat Modeling As a Code

659 views • 34 slides