‘Tis the Season for Credit Card Scraping and Malware Trends

Name: Joshua Hammer – Title: Sales Operations Manager

Valentin Vesa: Good morning everyone, and welcome back to the Sucuri short webinar series. This is your host, Val. It is my pleasure to welcome you to today’s episode and actually the last episode of this year. First of all, please excuse my voice, I’m really sick, but I really wanted to be here, so let’s go into the subject for today.

Valentin Vesa: During this webinar, we’ll talk about the apparent main focus for bad activity on Internet this month, which is credit card scraping, and of course about the malware trends. As presenters today, we have Joshua Hammer who’s our Sales Operations Manager. You’ve heard him before. Also an old friend of ours, Victor Santoyo, an account executive. Both are working for Sucuri.

Valentin Vesa: Before I hand it over to them, to introduce themselves and of course about the content for today, just a few housekeeping rules. First, we’d love to hear from you during today’s presentation, so if you have questions for our presenters, please feel free to send it through the Q&A tab in your Zoom window, or you can also tweet us at @SucuriSecurity using the hashtag #AskSucuri. Our panelists will be answering your questions at the end of the session. If we don’t get to your question during today’s webinar, no worries, we’ll post them to the webinar page, and also send them to you via email.

Valentin Vesa: Today’s webinar will also be available as a video recording, and slides will be sent to all registrants. We’d like to encourage you, as usual, to share today’s webinar with your friends and followers on your social profiles. With that, gentlemen, welcome to the last webinar of 2018. Thank you.

Joshua Hammer: Thanks, Val. Rest your voice, sir. Once again, my name’s Joshua. I’m a Sales Operation Manager here. A little bit about me, if you haven’t heard from me before. Been with Sucuri now for about four years. I’m married to a beautiful wife with two lovely little girls. I love games, board games, video games. I even look at security like it’s a game, so let’s play this game together. Let me hand it over to Victor.

Victor Santoyo: Thank you, Joshua. For those that know me, I’m an account executive with Sucuri, about four years now. That is my Twitter handle if you want to follow. I am a technology enthusiast, learning on expanding my knowledge in this space. A specific focus for me to end the year has been data security, so if you follow me on social, you’ll probably notice a trend there.

Victor Santoyo: Avid runner, trying to get back into the fold of things, taking a long break from that. Love spending time with my wife of almost five years, and our two and a half year old toddler, who has taken an interest in watching sports with us as a family, which is a great thing to do. From here, I’ll hand it back to Josh to set the expectation for what today’s about.

Joshua Hammer: Alright. What are we going to be doing today? Well, we’re just going to be looking at some malware trends and some simple steps to stop them. We’ll be going over what we’ve seen in the last year, but more focused on what we’re seeing going on right now. With that, let’s get started with some random facts.

Joshua Hammer: First random fact, because it’s related. If you blow air up an armadillo’s butt, causes it to jump three feet in the air. I had two questions when I saw this. The first was, how did they figure it out, and the second is, why did they figure it out. That always kills me. It’s like, “Hey this is something.” It’s probably government funded. Who knows?

Joshua Hammer: Anyway, more random facts. The majority of malware left on a site are backdoors. In 2017, about 78% of the malware that we removed from sites were backdoors, meaning entrances back into the site in case the hacker or attacker needed to get in. Now that is not the only malware that we cleaned from those sites, but that is the majority that every site had on it.

Joshua Hammer: Another random fact, most malware attacks are automated. Very few sites are actually targeted. It’s a fun one, because everybody asks, “Why me?” or “My site’s not important.” Well, you know what? You’re the lucky winner. Congratulations. You got targeted by an automated script. You’re actually more likely to get hit with malware than you are to win the lotto. Congratulations.

Joshua Hammer: With that, another random fact, Victor loves his crazy socks and is wearing some right now. If you’ve ever met Victor at any of the WordCamps or any of the events that we’ve gone to, take a look and ask him about his socks.

Victor Santoyo: That’s about half the collection. There’s much more.

Joshua Hammer: Alright. What kind of stuff have we seen? Well, we’ve seen a lot of SEO spam here recently. Almost half of the infections we clean are SEO spam. What is SEO spam? Well, it’s spam that’s hidden within the headers or somewhere on the site that helps other sites rank up within Google and other search engines. A lot of times, it may not even be noticeable for you. You may not see anything, but this is what is called black hat SEO. They’re using your site to link to their site so that their site goes up in the ranking.

Joshua Hammer: Tech support scams. This has been a big one here recently, and it’s the second highest scam our SiteCheck turns up. In the last 60 days, we’ve noticed about 30% of our SiteCheck scans have been tech support scams. What that is, and I don’t know how they still work, because I don’t know how anybody falls for these anymore. We’ve seen them. You know, you get that annoying popup box that won’t go away. It says, “Your computer’s been compromised. Call Microsoft,” which is really fun, especially when you’re on a Mac or something, and it’s telling you to call Microsoft. Yet it works, so whatever.

Joshua Hammer: Then the one that most people are probably here about, credit card stealing malware. Over the course of a holiday season, we see a trend where credit card scrapers start coming in. One thing that I’ve found interesting here is that these credit card scrapers, I always thought a trend would be we see more of them in November and December. We do, but it’s not throughout the whole month. It’s just for a few days. Right around Thanksgiving, we saw a huge increase in these.

Joshua Hammer: We’ve caught, over the last 30 days, about 1,000 credit card stealing scrapers on SiteCheck. There is probably a ton more, but a lot of the credit card stealing malware, one way that we catch it is through blocklisted sites that … We keep a blocklist on our own of sites that your site would redirect to to scrape this malware. We track that as a blocklist, not as a credit card scraper. Some interesting facts here. When we catch these blocklisted sites, 75% of them are on our personal blocklist here at Sucuri. The other 25% are due to third party blocklists such as Google or McAfee.

Joshua Hammer: I found this very interesting, because we just did a blog post about a week ago, maybe two weeks, about this specific credit card scraper, Magento. We listed two sites that we knew that these credit card scrapers were pulling information. Two weeks later, and they’re still not blocklisted on Google. This is an active hack that we know about, that we personally have blocklisted, but one of the biggest blocklisting agencies out there, Google, hasn’t caught it. What we’re finding is that they use really fudgy, fuzzy logic. Fudgey logic works too. But yeah, really fuzzy logic on what they consider is blocklist worthy, whereas because we have our own research department here, we tend to be very more targeted towards these website malwares, even more so that McAfee and those others. Holding our own personal blocklist has helped us out quite a bit. It’s been interesting.

Joshua Hammer: With that, I’m going to hand it over to Victor with some prevention techniques.

Victor Santoyo: Absolutely. As we go through the final part of this webinar, obviously for a lot of you, if you’ve been following the webinar series, either from the start of the year or over the course of the last two months as part of our Sales Enablement series, you’re going to be seeing a lot of the same notes being hit. It’s by design, because a lot of these things are just things that are consistently overlooked, or not followed up with. The same way that people are always going to remind you to lock your doors or to make sure you have everything configured correctly through automated email campaigns, it’s because a lot of people do forget.

Victor Santoyo: With that, first things first. When we talk about security and we talk about protecting your sites, one does that through a firewall of some variety. A web application firewall in particular, whether it’s cloud based or an endpoint based or otherwise, just something that allows you to set up something.

Victor Santoyo: YYes, if you’ve heard me talk on this before, I’m probably a broken record on this, going over this through blog posts and webinars, but I think there’s a lot of people forget to even procure one, much less even activate it. If you have gone through the effort of setting up a firewall, whether it’s through us or someone else or on your own, just make sure it is actively protecting your site, and it’s actively intercepting malicious traffic.

Victor Santoyo: If you’ve never had an opportunity to test one or it’s just been on the backlog, on a back burner for far too long.

Victor Santoyo: Now, there are a lot of other tactics and techniques out there that can help compromise your sites, which you also want to be conscious of. What’s trending today won’t be trending next year. I’m sure a year from now we’ll have a very different conversation about what new techniques are. Attacks are most prominent among the community. From here, of course, if you’re obviously implementing some type of online presence, you could likely utilizing some type of open source framework. For example, last week, WordPress came out with Gutenberg and 5.0.

Victor Santoyo: So, first thing to do, of course, is update. And every update won’t always be for performance or efficiency or features. A lot of updates are set up for security releases. So, for example, for the last, 4.9 release of WordPress, they came up with nine security related patches throughout that campaign. So, that speaks to other type of updates that go. other frameworks, with Joomla, Drupal and Magento, and the like are going to undergo a similar evolution.

Victor Santoyo: So, always make sure that whether you have it automated, somewhat managed to do so, or you do it by yourself, just be conscious of the fact that if you are utilizing a software like this that you’re up to date on these things, so that you don’t get caught within a window of opportunity when these zero day attacks, which is the term used to describe a period upon the discovery of a new vulnerability, that you’re not caught in the weeds to update while attackers are sort of feeding at a frenzy. This goes with the core themes, extensions, plugins, whatnot. Any type of publicly accessible component of the site can be targeted and exploited based on whatever, human error, allows for new updates.

Victor Santoyo: Last aspect, of course, is a updating your passwords, right? We could have the best web application firewall that is doing all the best virtual patching techniques to mitigate against new threats. On top of that, we can be doing our best in updating every component of software, either maybe on the server side as well, but ultimately if you have really weak password management, allowing access points like your cPanel, FTP, or any other publicly accessible end point to have weak passwords that anybody can use or guess, I mean, then all that security won’t help you. It’ll just be undermined by the fact that you had this one very large weakness that’s going to undermine the whole structure.

Victor Santoyo: That’ll happen all the time. Dictionary attacks are essentially what these are called, when you’re going to lean on something like “garden123” as your root password into something, let’s say, like your LastPass manager. I mean, you could be using LastPass to generate all these complex passwords underneath, but if your master password is really weak, you’re kind of doing yourself a disservice.

Victor Santoyo: So, just make sure that your passwords of course are reset every 90 days, that they’re long, they’re complex, not using anything that could identify you. Data is a big thing now, and if attackers can gain access to your data throughout other means, then it’s likely that they can utilize that path to a high check access that you have access to by using that data to sort of guesstimate what a password would look like, right? Some of us might use family members, birthdays, things like that nature, and we don’t want to get caught with our pants down for using something of that weaker structure.

Victor Santoyo: Yes.

Joshua Hammer: Now, having said that though, there are always other things you can do, right? I mean, you could always utilize other plugins to perform further hardening. We have a free WordPress plugin that will do a lot of that same stuff to help minimize exposure. But at the end of the day, this is all about reducing risk, and as we go into 2019, the biggest thing to understand is risk will never be zero, okay? Only if all these little things that we’re talking about, layering security on top of each other, is to just minimize risk as much as possible, but you’ll never eliminate it. So, just bear that in mind as tactics and techniques evolve all the time.

Victor Santoyo: With that though, of course, we’re always open to questions and understanding what kind of feedback you guys have. So, I’m sure we’ve generated a number of questions that we’d be more than happy to answer.

Joshua Hammer: Before we get into those, Val, just a couple things I want to add here. Passwords are funny, because not only is it important to make up good passwords for your stuff, but the fact that people don’t even change the default password kills me. There is actually a search engine out there for the Internet of Things of default passwords. There are devices that are on default passwords. And you can use a search engine just to find it.

Joshua Hammer: So, for you lawyers out there, yeah, go and look. You’ll find it. There’s web cameras, there’s everything. I’ve looked at it just because I’m interested into the security, and I can tell you a local law firm nearby has a default username and password on their router, and I was able to access their router. So, think about all the information I could hijack from there if I was an evil black hat person to do that. My wife was in the background. She’s going, “Hey, you should print out flyers using their printers, saying ‘Change your password.'” I really wanted to do that.

Joshua Hammer: Another trend I forgot to mention, I was supposed to mention back then, was cryptocurrency and crypto miner. That’s been a big thing. Over the last 60 days, we’ve seen 2.5 percent of our scans have been on crypto minors using your computer as a resource to mine currency. Forgot about that. Sorry. Take it away, Val.

Valentin Vesa: Yeah, no worries. Actually, that’s a very good thing to mention. And also to mention that we are not a business, but we do test, and if something is off, we also reach out to the people or businesses letting them know, and that’s a very good thing to do, by the way. It’s not only enough to find the issues, but report them back to the order.

Valentin Vesa: We do have a number of questions coming in. We’ll try, as usual, to keep this under 25 minutes. Just a note for everyone who sent questions, if you don’t see them answered in the live show, you will be getting all the questions and answers from above, Josh and Victor, published on the page. So, the same page you subscribed for the webinar, We will update that in the following days, hopefully within two or three days. And then you will be able to also watch the recording of this show, and also the questions, and we’ll have a transcript for anyone who it’s easier to access the information like that.

Valentin Vesa: So, the first question we have here is, let me just read the whole thing. “Are there common signs we can look for that may show a compromise?”

Joshua Hammer: Sure, there’s tons. Okay, so, here’s the thing. Malware is fun. By its nature, it wants to do as much damage as possible. And in order to do that, it needs to stay hidden as long as possible. So, a lot of times malware is designed not to be spotted. You may be looking at it through Chrome and it may not show anything, but through Internet Explorer, it may. Or on mobile, it may show something, but on any of the desktop browsers, it doesn’t show anything. So, it’s very fascinating.

Joshua Hammer: But, for companies that are taking credit cards and those kinds of things, if you start missing orders, that’s usually a good sign that something’s going on there. If you see a page is occasionally redirecting you, that’s a sign, or weird search results, that may be a sign. Or if your host is telling you, you have malware, that’s a really good sign. But yeah, just things, they kind of seem wonky or odd, that you’ve never seen before, is usually a good indicator that something is going on.

Valentin Vesa: Yeah. Seems pretty good. We have a question here from somebody who most likely did already a lot of shopping for the holidays. The question reads, “I love the protection of your plans, but I’m broke. What other options are there?”

Joshua Hammer: There’s a lot out there. I mean, if you want to come with us, and we hope you do, if you’re on WordPress, you can always use our plugin that Victor mentioned. The plugin combined with just the firewall gives you great budget protection, because the firewall protects your site. The plugin is going to do some free scans for you. The firewall, I mean, our least expensive plan for the firewall is $10 bucks a month. Hopefully you can scrounge that up. If not, break your kids piggy bank. No, I’m kidding. If you can’t even do that though, I mean, there are companies out there that will offer a really basic [inaudible 00:20:42] for free, that it may not be the best protection out there, but something is better than nothing.

Valentin Vesa: Totally. I may also mention that we do have, on Sucuri.net/guides, we have some guides, free guides anyone can employ to fix hex on their WordPress sites, Magentos, Joomlas, so forth. So, feel free to explore our website and get those as well. Third question is here from Mary. “Are those credit cards tailored specific to Magento?” We were just talking about Magento.

Victor Santoyo: Yeah. And a lot of Magento … It’s a very popular CMS platform. It’s being targeted for this because of the eCommerce-focused nature of that particular instance. But there have been other targets, in particular, earlier this year, and a couple of years ago as well, that targeted vBulletin, WooCommerce through WordPress, through a stored cross-site scripting vulnerability that was uncovered. So, just to see, if you are prepping their eCommerce store, attackers are going to look to identify what type of payment method that software you’re utilizing on your end.

Victor Santoyo: And they’re just E-commerce technology altogether, and they may look to exploit that to some extents. And There’s always gonna be some type of opportunity for them to try and steal credit card data, whether that’s using what the software’s own abilities to gain access to your database or perhaps trying to break through a weak SSL certificate workflow that you may have implemented right. So you’ve got a cloud setup where a front end is set up with an SSL certificate, but the back end from the vender to the host may not be encrypted.

Victor Santoyo: So there are a lot of different channels in which credit card thieves are out there trying to take our data. It’s not specific to Magento. If you’re running on WooCommerce, could be something to look up, too. That’s why updates are a big thing. You want to make sure that you are on the latest patches and security advances.

Joshua Hammer: And guys, these hackers are, they’re clever. We’ve seen some things in the past that we were talking right before this webinar about them hiding credit card numbers inside of images. I thought it was earlier this year because all my years blend together, but apparently that was back in 2016. So, I mean, we’re talking, you’re looking at a picture and you and I go, “Hey, it’s a picture.” But when you go and you look at the code behind the picture, it’s a bunch of credit cards. That, to me, was ingenious. These guys are smart. So we just have to be on our toes.

Valentin Vesa: So, that means especially around the holidays that we’re going into now and people shopping around online. There’ll be more instances of this happening, right?

Joshua Hammer: Absolutely.

Valentin Vesa: Okay. Good to know. Next question. Many of the data you quoted are 2017 based, and we saw your reports, so, yes, we do have a report out, published for 2017 and the question reads: is there a 2018 report coming soon?

Joshua Hammer: 2018’s not over yet. How can we report on it? Usually by the end of quarter one. I’ve been told it is in the works. I think it was February that we’re shooting for, but definitely end of first quarter you should see that.

Valentin Vesa: Awesome. So, yes, then we can compare. Maybe we’ll do another webinar in December of next year and compare the numbers we had this year. Yeah. Just to see what happened.

Valentin Vesa: Next question. Let’s just stick to 2 more questions if that’s alright with you guys?

Valentin Vesa: What type of spam will we see, so we know what’s been infected with that SEO attack? Maybe you can say more about the SEO attack and what it is and then answer the question, please?

Victor Santoyo: Yeah. SEO spam, SEO poisoning, the varying ways you can describe it. The biggest thing is like Hammer mentioned earlier in the webinar, they’re trying to leverage you’re standing to basically be produced on multiple search engine results and popular, you know, if you’re not on the first page you’re last. Trying to get up in there to, basically, spread either nefarious content or just there to sort of destroy your SEO, which is why it’s described as SEO poisoning.

Victor Santoyo: The things you should be looking out for are just keywords or things that you’re just noticing in your SERP, your search engine result pages that are not in line with what you’re doing. So if you’re a web agency that’s focused on dentistry, and you’re noticing keywords with drug pharmaceuticals or Viagra that are popping up in your results, that’s probably an indication that something has been embedded within the framework of your website that will result in SEO spam that needs to get cleared out. Because otherwise, that’ll, of course, hurt your standing if they start putting in some more vulgar stuff in there, which is something that happens all the time. So just looking for the keywords in your search results that aren’t in line with what you’re looking to do, is one of the most obvious things to identify.

Victor Santoyo: I’ve had a lot of agencies come through that have similar issues where they’ve had to battle google reporting on them and, kind of killing their ranking because all of a sudden, they were focused on a niche like [Cachure 00:26:27], high-end Cachure or whatever and then what happens is, yeah, they got Cialis and all this Viagra-related indications that are kind of spurting all over their headers and results. So those stats, just sort of off the top, something you can bear in mind and I can include links as part of the answer after the webinar is done, as examples of our blog post that speaks on this exact subject.

Joshua Hammer: Also, take a look at the top of your pages. A lot of times, some of these bots that upload the SEO, they miss a quote or add and extra quote and then all of a sudden, the top of your page just looks funky and you can see the link right there, which is always fun. Just side note, you probably shouldn’t use “Viagra” and “popping up” in the same sentence, it just doesn’t sound good.

Valentin Vesa: Yeah. Speaking to how smart hackers are, you would think that they would not let a source code not completely coded on the page.

Valentin Vesa: Last question here. We’re really actually overtime, but I’ll sneak it in, cause you mentioned cryptocurrency and the question is right about this one. Asking us if you can explain on that at all?

Joshua Hammer: So Bitcoin mining and those kind of things, it has actually gotten to a point now where it’s more expensive to mine the currency than the currency is worth. It’s kinda interesting and if you read anything about tech blogs and those kind of things, you’ll see that nVidia, which is a huge graphics processing unit cards actually had a surplus of cards because the crypto miners stopped buying them because the electricity that it cost to run these things is less than what you’re finding for the actual currency. So does that mean the currency is not worth mining anymore? Kind of. It means it’s not worth mining legally anymore. So what did they do? Well, they’ve got these~ world of machines out there that they can get to do their mining for them and it doesn’t cost them any electricity, it doesn’t cost many resources because they’re using yours. How nice of them.

Joshua Hammer: So, it’s big in the website industry. It’s a bigger trend there now. It is actually hitting personal PCs pretty heavily. I think it did that before it hit the websites, but there are codes out there now that you can visit a website and it uses your personal PC’s power while you’re on that page to mine cryptocurrency. So it’s fascinating. It really is, but…

Valentin Vesa: Okay. We’re really out of time. I just wanted to say thanks to everyone who participated. Thank you both for, I don’t know how many times, being here this year. And for everyone else watching, I hope you have a great holidays. I’ll let our speakers say goodbye, of course, and hopefully we’re gonna meet back in January.

Victor Santoyo: Yeah, sure. Thanks for joining us throughout the year. Of course, we’ll always be working to put together content for you to either help you gain knowledge on the subject or help you communicate that message on to your clients if you’re managing the sites for your clients. So we’re always open to questions or feedback and we’ll see you next year.

Joshua Hammer: And I appreciate the time, guys, and all the support from you guys and hopefully you’ve gained something from all of our webinars this year. Hope you’ve had great holidays if you’ve already had them, or great holidays coming up, and have a fantastic 2019. Guys, we’re always looking for webinar ideas so if you have one you want to see us on, shoot me an email or send an email to info@sucuri.net. I know you’d make Val’s life easier, because he’s pinging me like four times a day, “Hey, any ideas for a webinar?”. So if you guys started taking some of that off of our shoulders, that would be fantastic, so send us some ideas. Otherwise, have a great 2019.