As people become more aware of the threat of targeted "phishing" attacks via e-mail and social media, malware-armed attackers are turning to new ways to target specific victims where they least expect it—by exploiting the legitimate websites they frequent and assume to be secure. Last week, Swiss security firm Hi-Tech Bridge disclosed that the Web store of a corporate customer had been used to deliver a targeted attack against a specific site visitor. The attackers were also able to retrieve the store's customer database, which they may have used to search for desirable targets.
The attack exploited a current and patched version of osCommerce Online Merchant (version 2.3.4, released last June), a common Web store content management system used by a number of high-profile companies—including Canonical's Ubuntu Shop. The attacker inserted malicious PHP script that provided a backdoor into the site and could be configured to check users' IP addresses and login credentials for specific targets as they visit the site. Once a desired target is detected, the script attempts to download malware to the victim from another site. The attacker can then remotely delete the backdoor and altered PHP files and replace them with the original by connecting to the script with a "?del" parameter added to its URL.
The backdoor script is labeled as "osCommerce 2.x.x universal pwner by Piht0z," and it's just that: a generic PHP-based backdoor for osCommerce sites. According to Ilia Kolochenko, High-Tech Bridge's CEO, there have been similar cases of targeted attacks on users of e-commerce sites before, but "it's the first time we see a universal backdoor for a large e-commerce platform," he said in a blog post about the discovery. "This means that hackers started using this vector on a regular basis to achieve their goals."
Read on Ars Technica | Comments