Payment Page Random Attack Example

Payment Page - Random Attack Example

Cart

Digital Camera$328.00

Red headphones$214.99

USB Game Controller$43.89

Pumpkin Spice Candle$21.15

Subtotal $608.03

Shipping FREE!

Estimated Tax $54.72

Total $662.75

Hacker Demo Dashboard Random Number

Any time the random number generated is '2', the credit card data is stolen:

Key points:

In this demonstration, the random number is set between 0 and 3, providing a 1 in 4 chance of seeing the cardholder data stolen. In the real world attack, the random number was selected between 0 and 33, indicating that only 1 out of every 34 transactions would be compromised.

Here is the code from the real world script:

There is nothing inherently malicious about this code -- extremely difficult to detect.
E-skimming activity is only detectable when the random number is matched. Otherwise it is dormant.
The random element can be almost anything.
Allows bad actors to stay below card brand thresholds.
PCI DSS 4.0 Requirements 6.4.3 & 11.6.1 are critical to address this issue
Dormant code is easily whitelisted.