Magecart kamida 20 ta Magento kengaytmasidagi zaifliklardan foydalanadi

Mutaxassis muammoli kengaytmalarni aniqlashda yordam so’radi.

Foydalanuvchilarning bank karta ma’lumotlarini o’g’irlashga ixtisoslashgan Magecart guruhi a’zolari kamida 20 ta Magento kengaytmasidagi zaifliklardan foydalanmoqdalar. Hujumchilar izchil naqshga amal qilishadi: turli veb-saytlarni buzib kirish va to’lov sahifalariga JavaScript kodini kiritish, foydalanuvchi tomonidan kiritilgan moliyaviy ma’lumotlarni (bank karta raqamlari, ismlar, manzillar va boshqalar) o’g’irlash. Guruh ilgari TicketMaster mijozlari ma’lumotlarining sizib chiqishi, shuningdek, British Airways, Feedify va AQShning yirik chakana sotuvchisi Neweggga qilingan hujumlar bilan bog’liq bo’lgan. Yaqinda o’tkazilgan Magecart kampaniyasini kuzatib borayotgan mustaqil xavfsizlik tadqiqotchisi Villem de Groot guruh tomonidan ishlatilgan 20 ta kengaytmadan faqat ikkitasini aniqlay oldi: Webcooking_SimpleBundle va TBT_Rewards. Birinchisini ishlab chiquvchilar allaqachon zaifliklarni tuzatuvchi yamoqni chiqargan, ammo mutaxassis TBT_Rewards kengaytmasini o’chirishni tavsiya qiladi, chunki u tashlab ketilgan va hech qanday yamoqlar kutilmaydi.

De Groot mutaxassislar hamjamiyatidan qolgan 18 ta muammoli kengaytmani aniqlashda yordam so’radi. Ro’yxat quyida keltirilgan.

Tadqiqotchining so’zlariga ko’ra, aniqlangan barcha 20 ta kengaytmadagi zaifliklar deyarli bir xil. Barcha holatlarda, tajovuzkorlar jabrlanuvchilarning veb-saytlariga zararli kodni kiritish uchun unserialize() funktsiyasidan foydalanadilar. Magento jamoasi 2016-yil oktyabr oyida PHP unserialize() funktsiyasini json_decode() bilan almashtirgan bo’lsa-da, barcha kengaytma ishlab chiquvchilari ham shunday yo’l tutishmadi.

TicketMaster, British Airways va Neweggga qilingan hujumlar xuddi shu kiberjinoyatchilar guruhining ishi bo’lsa-da, de Groot yangi kampaniya tashkilotchisi boshqa guruh ekanligiga ishonch bildiradi. Uning so‘zlariga ko‘ra, ayni paytda bir nechta jinoiy guruhlar xuddi shunday stsenariydan foydalanmoqda.

Muammoli kengaytmalar ro’yxati

POST /index.php/advancedreports/chart/tunnel/ POST /index.php/aheadmetrics/auth/index/ POST /index.php/ajax/Showroom/submit/ POST /index.php/ajaxproducts/index/index/ POST /index.php/bssreorderproduct/list/add/ POST /index.php/customgrid/index/index/ POST /index.php/customgrid/Blcg/Column/Renderer/index/index/ POST /index.php/customgrid/Blcg_Column_Renderer_index/index/ POST /index.php/customgrid/index/index/ POST /index.php/emaildirect/abandoned/restore/ POST /index.php/freegift/cart/gurlgift/ POST /index.php/gwishlist/Gwishlist/updategwishlist/ POST /index.php/layaway/view/add/ POST /index.php/madecache/varnish/esi/ POST /index.php/minifilterproducts/index/ajax/ POST /index.php/multidealpro/index/edit/ POST /index.php/netgocust/Gwishlist/updategwishlist/ POST /index.php/prescription/Prescription/amendQuoteItemQty/ POST /index.php/qquoteadv/download/downloadCustomOption/ POST /index.php/rewards/customer/notifications/unsubscribe/ [Alreadu identified as «TBT_Rewards»] POST /index.php/rewards/customer_notifications/unsubscribe/ [Alreadu identified as «TBT_Rewards»] POST /index.php/rewards/notifications/unsubscribe/ [Alreadu identified as «TBT_Rewards»] POST /index.php/simplebundle/Cart/add/ [Already identified as «Webcooking_SimpleBundle»] POST /index.php/tabshome/index/ajax/ POST /index.php/vendors/credit/withdraw/review/ POST /index.php/vendors/credit_withdraw/review/ POST /index.php/vendors/withdraw/review/