Now, I guess you'd like to look at some code,
because we can look at some code about how this happens.
Code I'll understand.
Maybe.
Probably more than NIST guidance sometimes.
Yeah.
Here's some actual real code that somebody saved.
It's an attack from a couple of years ago.
It was against actually the Republican Senate store in the state,
so when you are buying, you know, ash trays,
I don't know what they sell in this store,
but when you were buying whatever it was you were buying it was owned.
And you can see here's the real own, so there's a script src JQuery code,
and then it's put in this lite.
js from somewhere.
So it doesn't say criminal JS, it just looks like some piece of JavaScript.
So when we look at this block here, this entire block is from the attacker,
some of it looks benign, so that you would expect that something from ups.
com would be benign, particularly if it says JQuery,
but the final point there around a script tag with a source of jquery-code.
su, that doesn't look legit.
It doesn't, does it.
But it kind of looks legit because it says JQuery.
Yeah.
So this is just deception.
It's deception, yeah.
So that if you're parsing it, you think,
oh, that looks like something that should be there.
Sure.
And just to be clear, again,
like that entire block someone has found a vulnerability on the web server
that has allowed them to get that onto the merchant's site.
Yeah.
Okay, cool.
And then here's the unpacked version of what's been
loaded from the criminal website.
So, can you scroll up just one second, because that looks like that was,
so this is the contents of this jquery-code.
su path, that's all obviously obfuscated JavaScript,
which we won't read the top bit,
but once we do obfuscate and we go down a little bit,
this is, just by eyeballing it,
looking for changes in form elements and then base64
encoding the contents of that,
and then at some point sending it off to another host.
Yeah, here's the bit where it sends it to the other host,
it's making it look like a call for the PayPal logo.
Right.
So again,
it looks like something that you'd --- But it's making a post
to load an image with base64 encoded data,
which inevitably has the data from the form fields on the page.
Yeah.
Because not many people post to the PayPal logo with card data in it.
And of course it's async as well,
so you're not going to be seeing anything unload.
Yeah.
And so this is, you know, this is very typical.
Okay, cool.
So that all stemmed from that one piece of earlier code which
embedded the couple of script files as well,
and ultimately we have this issue posting code.
I guess this is, I was going to say it's kind of nice,
but it's a criminal act-- it's kind of elegant in terms of how it works,
because it's just looking for changes in these fields,
concatenating them all together, sending them off async,
you could take this same attack and put it on all sorts of different websites.
And, in fact, there is about, there's two versions of this code.
I think two different people wrote it originally,
and so if you look at the forensics that comes back from card breaches,
use like the code A or code B, they're all certainly different,
they keep morphing, but there's about two original sources for this type of code.
Some of the code is really clever, it says what page I'm on,
I'm on the checkout page, I'm going to activate.
Right, okay cool.