2

A recent blog post shows hackers owning a web server - at least the content and injecting a web skimming attack. https://blog.malwarebytes.com/hacking-2/2020/03/criminals-hack-tupperware-website-with-credit-card-skimmer/

Should this be detectable in web server logs? The bad guys redirected to legitimate checkout page after skimming, and since they controlled the main page, referring url could have looked normal there; but would any of malicious iframe request have been logged?

I would expect some log entry for deskofhelp.com to show somewhere - assuming web logs are intact?

Improve this question

2 Answers 2

Reset to default
3

I don't see how. When creating an iframe, a GET request is sent to the iframes src, but not to the server hosting the iframe.

So deskofhelp[.]com will likely have tupperware.com in its logs as referer header, but not the other way around.

Cross-origin frames can be logged by using a frame-src CSP directive combined with report-uri (or the newer report-to), but it seems that tupperware.com isn't using CSP at all.

Improve this answer
1
  • Thanks for the answer, that is what i suspected. I guess the only log indication may be the get request for the faq_icon.png would appear as an anomaly if they were logging or graphing get requests. The story makes it sound like this file was added(not original) as it is hidden when invoked. The only other anomaly I can think of that could be in the logs would be checkout timing between clicks - the average checkout time would be longer as the person when to the malicious iframe first, then to the legit checkout site.
    – Johann
    Mar 30, 2020 at 14:45
0

This boils down to how the expected flow of interaction is supposed to work. If the end user detracts from the flow, for example, is redirected off site and suddenly returns, then this can be seen from the log, only if you can reconstruct the user journey. If you suddenly have a mass of users that don't seem to follow how you've constructed the user interaction flow, then you can tell that there's a problem.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.