24 September 2019

JavaScript-sniffers knock on Singapore’s door

Group-IB, a Singapore-based cybersecurity company that specializes in preventing cyberattacks, has discovered and analyzed compromised payment cards related to Singaporean banks that could be related to the activity of JavaScript-sniffers — a type of malware designed to steal customer payment data from online stores. Group-IB urges Singaporeans to follow simple cyber hygiene rules while shopping online to avoid significant financial losses.

During the analysis of underground cardshops, Group-IB Threat Hunting Intelligence team has detected one spike in the sale of compromised raw cards data (type of compromised card which has all the information required for online purchases, including CVV, card number and expiration date) issued by Singaporean banks. In April 2019, 4,166 cards related to Singapore were uploaded to cardshops, while the mean in January-August 2019 was at 2,379 cards per month. This spike was due to the fact that on April 1 alone, a database named «31.03-SG_MIX_SNIFF» was uploaded to an underground cardshop, which contained 1,726 compromised cards issued by the Singaporean banks.

The cards could have likely been compromised as a result of Java Script-sniffers’ activity on online stores frequented by Singaporeans, and the name of the database supports this assumption. A JS‑sniffer is the online equivalent of a traditional credit card skimmer — a small device installed on ATMs that intercepts payment card details. Usually, a few lines of code injected into websites can capture data entered by customers, such as payment card numbers, names, addresses, passwords, etc. A multi-linked chain of victims of JS-sniffers includes online shoppers, online stores, payment systems, banks. Quite often neither a customer nor a website owner can detect the activity of JS-sniffers. JS-sniffers are capable of infecting websites which use different types of CMS (Content Management System) and are hard to be detected with the use of traditional signature-based detection methods, which makes them even more dangerous.

Even though it is the responsibility of online merchants to ensure customer data safety, many high profile data breaches due to the activity of JS-sniffers, such as British Airways and FILA UK data compromise, suggest that very few eCommerce merchants are aware of this cyber threat and taking steps to prevent the infection by JS-sniffers. Therefore, in order to minimize losses, in case an online store is infected with a JS-sniffer, we advise online shoppers in Singapore not to keep all eggs in one basket and have a separate pre-paid card for online payments or even a separate bank account exclusively for online purchases. The admins of eCommerce websites, in their turn, need to keep their software updated, carry out regular cybersecurity assessments of their websites and not hesitate to seek assistance from specialists. It should be noted, that the statistics that we observed could be higher if not for the vigilant cybersecurity authorities which have been prompt in detecting websites infected with JS-sniffers.

Ilya Sachkov

Ilya Sachkov

CEO and founder at Group-IB

Group-IB, has recently issued a comprehensive report «Crime without punishment» on the analysis of JavaScript-sniffers. Globally, a total of 2,440 infected eCommerce websites with around 1.5 million unique daily visitors, whose data could have been compromised, were analyzed by Group-IB threat researchers. The report features an in-depth analysis of JS‑sniffers’ darknet market, their entire infrastructure and the monetization methods, which generate millions of illicit dollars revenue for the cybercriminals behind them. Group-IB’s report contains detailed recommendations for all parties that may fall victim to JS‑sniffers: online shoppers, banks, payment systems, and eCommerce websites. The research on JS-sniffers continues. Descriptions of analyzed JS‑sniffers and new information about them are regularly uploaded to Group-IB’s Threat Hunting Intelligence system.

In the first eight months of 2019, Group-IB experts have detected 26,102 compromised payment cards issued by Singaporean banks put up for sale on dark web cardshops. The total underground market value of compromised cards detected in January-August 2019 is estimated at nearly USD 1.8 million. Among them, 19,037 were identified as raw cards data. While only 7,065 cards turned out to be «dumps» — unauthorized digital copies containing the card’s magnetic details, which can be clone to physical cards.

Notwithstanding, Singapore offers a higher level of protection compared to most countries in the Asia-Pacific region. A total of 766,055 compromised payment cards were put up for sale in January-August of this year in the rest of APAC, according to Group-IB’s data. Singaporean monetary authorities have put in place a number of security measures such as the mandatory one-time-password for card-not-present transactions and the exclusive use of EMV chip cards.

Group-IB is one of the leading providers of solutions dedicated to detecting and preventing cyberattacks, identifying online fraud, investigation of high-tech crimes and intellectual property protection, headquartered in Singapore. The company’s threat intelligence and research centers are located in the Middle East (Dubai), the Asia-Pacific (Singapore), Europe (Amsterdam), and Russia (Moscow).

Group-IB’s Threat Intelligence & Attribution system has been named one of the best in class by Gartner, Forrester, and IDC. Group-IB’s Threat Hunting Framework (earlier known as TDS) intended for the proactive search and the protection against complex and previously unknown cyberthreats has been recognized as one of the leaders in Network Detection and Response by the leading European analyst agency KuppingerCole Analysts AG, while Group-IB itself has been recognized as a Product Leader and Innovation Leader. Gartner identified Group-IB as a Representative Vendor in Online Fraud Detection for its Fraud Hunting Platform. In addition, Group-IB was granted Frost & Sullivan’s Innovation Excellence award for its Digital Risk Protection (DRP), an Al-driven platform for identifying and mitigating digital risks and counteracting brand impersonation attacks with the company’s patented technologies at its core.

Group-IB’s technological leadership and R&D capabilities are built on the company’s 18 years of hands-on experience in cybercrime investigations worldwide and 70,000 hours of cybersecurity incident response accumulated in our leading forensic laboratory, high-tech crime investigations department, and round-the-clock CERT-GIB. Group-IB is a partner of Europol and has been recommended by the OSCE as a cybersecurity solutions provider.

Group-IB’s experience in threat hunting and cyber intelligence has been fused into an ecosystem of highly sophisticated software and hardware solutions designed to monitor, identify, and prevent cyberattacks. Group-IB’s mission is to fight high-tech crime while protecting our clients in cyberspace and helping them achieve their goals. To do so, we analyze cyber threats, develop our infrastructure to monitor them, respond to incidents, investigate complex high-tech crimes, and design unique technologies, solutions, and services to counteract adversaries.

Report an incident

Get 24/7 incident response assistance from our global team

APAC: +65 3159-3798
Europe: +31 20 226-90-90
EMA: +971 4 508 1605

Thank you for the inquiry! We will contact you soon.
Cookies

We use cookies on the website to make your browser experience more personal, convenient and secure. You may block or manage the use of cookies, however, in some cases they’re essential to make this site work properly. Learn more about cookies in Group-IB Privacy And Cookies Policy.

 
Report an incident