Story image

Ticketmaster breach part of massive digital credit card skimming campaign

12 Jul 2018

The recent breach of Ticketmaster was not a one-off event as initially reported, but part of a digital credit card-skimming campaign by the threat group Magecart affecting over 800 e-commerce sites around the world.

Digital threat management company RiskIQ revealed these findings in a report by its researchers today.

According to Ticketmaster’s official statement, the breach impacted Ticketmaster International, Ticketmaster UK, GETMEIN! and TicketWeb from February 2018 until June 23rd of 2018, but RiskIQ researchers found evidence the skimmer was active on additional Ticketmaster websites including Ireland, Turkey, and New Zealand since as early as December 2017.

The report highlights how Magecart has evolved tactically from hacking sites directly, to now targeting widely used third-party components.

This approach grants them access to even more victims - sometimes 10,000 or more instantly.

According to RiskIQ researchers, Magecart likely breached the systems of Inbenta and SociaPlus, both third-party suppliers integrated with Ticketmaster websites, and added to or replaced custom javascript modules with their digital credit card skimmer code.

Like physical skimmers that criminals hide in compromised POS machines, gas pumps, and ATMs, digital card skimmers steal credit card data from unwitting customers via scripts injected into e-commerce websites to record the credit card data they enter into online payment forms.

RiskIQ has been tracking Magecart’s activities since 2015 and studying how its credit card skimming attacks have been continuously ramping up in frequency, sophistication, and impact.

RiskIQ researchers found that other suppliers, web analytics provider PushAssist, CMS Clarity Connect, Annex Cloud, and likely many others, were also compromised by the Magecart actor.

RiskIQ has been tracking a highly-targeted Magecart campaign dubbed SERVERSIDE, which has used access to these third-party components to claim over a 100 top-tier victims including some of the world's largest online brands.

RiskIQ threat researcher Yonathan Klijnsma says, "While Ticketmaster received the publicity and attention, the Magecart problem extends well beyond them."

"We believe it's cause for far greater concern. Magecart is bigger than any other credit card breach to date and isn’t stopping any day soon.”

Many of the publicly reported breaches are wrongly interpreted as individual events but are in reality part of the SERVERSIDE campaign, and often not individual breaches at all.

RiskIQ researchers also found that the Command and Control server used in the Ticketmaster attack has been active since December 2016.

Opinion: BYOD can be secure with the right measures
Companies that embrace BYOD are giving employees more freedom to work remotely, resulting in increased productivity, cost savings, and talent retention.
Sonatype and HackerOne partner on open source vulnerability reporting
Without a standard for responsible disclosure, even those who want to disclose vulnerabilities responsibly can get frustrated with the process.
OutSystems and Boncode team up for better code analysis
The Boncode and OutSystems alliance aims to help organisations to build fast and feel comfortable that the work they're delivering is at peak quality levels.
Nuance biometrics fight back against fraud
Nuance Communications has crunched the numbers and discovered that it has prevented more than US$1 billion worth of fraud from being passed on to users of its Nuance Security Suite.
Attacks targeting Cisco Webex extension explode in popularity - WatchGuard
WatchGuard's Internet Security Report for Q4 2018 also finds growing use of a new sextortion phishing malware customised to individual victims.
Developing APAC countries most vulnerable to malware - Microsoft
“As cyberattacks continue to increase in frequency and sophistication, understanding prevalent cyberthreats and how to limit their impact has become an imperative.”
Worldwide spending on security to reach $103.1bil in 2019 - IDC
Managed security services will be the largest technology category in 2019.
Privacy: The real cost of “free” mobile apps
Sales of location targeted advertising, based on location data provided by apps, is set to reach $30 billion by 2020.