Web skimming with Google Analytics

guest · Jun 22, 2020

Web skimming with Google Analytics
June 22, 2020
https://securelist.com/web-skimming-with-google-analytics/97414/

Web skimming is a common class of attacks generally aimed at online shoppers. The principle is quite simple: malicious code is injected into the compromised site, which collects and sends user-entered data to a cybercriminal resource. If the attack is successful, the cybercriminals gain access to shoppers’ payment information.

Recently, we identified several cases where this service was misused: attackers injected malicious code into sites, which collected all the data entered by users, and then sent it via Analytics. As a result, the attackers could access the stolen data in their Google Analytics account. We found about two dozen infected sites worldwide. The victims included stores in Europe and North and South America selling digital equipment, cosmetics, food products, spare parts etc.
Click to expand...

What’s the danger
Google Analytics is an extremely popular service (used on more than 29 million sites, according to BuiltWith) and is blindly trusted by users: administrators write *.google-analytics.com into the Content-Security-Policy header (used for listing resources from which third-party code can be downloaded), allowing the service to collect data. What’s more, the attack can be implemented without downloading code from external sources.
Click to expand...

guest · Jun 23, 2020

mood said: ↑

Web skimming with Google Analytics June 22, 2020
Click to expand...

Google Analytics as a data exfiltration channel
June 22, 2020
https://www.kaspersky.com/blog/web-skimming-with-ga/35986/

Web skimming, a fairly common method of getting cardholder data from visitors of online stores, is a time-honored cybercriminal practice. Recently, however, our experts discovered a rather dangerous innovation involving the use of Google Analytics to exfiltrate stolen data. Let’s explore why this is dangerous and how to deal with it.
How Web skimming works
The basic idea is that attackers inject malicious code into pages on the target website.
The injected code logs all user actions (including entered bank card data) and transfers everything to its owner. Hence, in the vast majority of cases, Web skimming is a type of cross-site scripting.
Why Google Analytics
The most convenient tool for this purpose is Google Analytics.
The likelihood that data transfer to Google Analytics is allowed in the CSP header of an online store is extremely high.
Click to expand...

Log in or Sign up

Web skimming with Google Analytics

guest Guest

guest Guest

Log in or Sign up

Web skimming with Google Analytics

guest Guest

guest Guest

Useful Searches