Wed. Sep 30th, 2020

Hackers Using Google Analytics to Bypass Web Security and Steal Credit Cards

Researchers reported on Monday that hackers are now exploiting Google’s Analytics service to stealthily pilfer credit card information from infected e-commerce sites.

According to several independent reports from PerimeterX, Kaspersky, and Sansec, threat actors are now injecting data-stealing code on the compromised websites in combination with tracking code generated by Google Analytics for their own account, letting them exfiltrate payment information entered by users even in conditions where content security policies are enforced for maximum web security.

“Attackers injected malicious code into sites, which collected all the data entered by users and then sent it via Analytics,” Kaspersky said in a report published yesterday. “As a result, the attackers could access the stolen data in their Google Analytics account.”

The cybersecurity firm said it found about two dozen infected websites across Europe and North and South America that specialized in selling digital equipment, cosmetics, food products, and spare parts.

Bypassing Content Security Policy
The attack hinges on the premise that e-commerce websites using Google’s web analytics service for tracking visitors have whitelisted the associated domains in their content security policy (CSP).

CSP is an added security measure that helps detect and mitigate threats stemming from cross-site scripting vulnerabilities and other forms of code injection attacks, including those embraced by various Magecart groups.
The security feature allows webmasters to define a set of domains the web browser should be allowed to interact with for a specific URL, thereby preventing the execution of untrusted code.

“The source of the problem is that the CSP rule system isn’t granular enough,” PerimeterX’s VP of research Amir Shaked said. “Recognizing and stopping the above malicious JavaScript request requires advanced visibility solutions that can detect the access and exfiltration of sensitive user data (in this case, the user’s email address and password).”

To harvest data using this technique, all that is needed is a small piece of JavaScript code that transmits the collected details like credentials and payment information through an event and other parameters that Google Analytics uses to uniquely identify different actions performed on a site.

“Administrators write *.google-analytics.com into the Content-Security-Policy header (used for listing resources from which third-party code can be downloaded), allowing the service to collect data. What’s more, the attack can be implemented without downloading code from external sources,” Kaspersky noted.

To make the attacks more covert, the attackers also ascertain if developer mode — a feature that’s often used to spot network requests and security errors, among other things — is enabled in the visitor’s browser, and proceed only if the result of that check is negative.

See more details

Leave a Reply

Your email address will not be published. Required fields are marked *