Week 35: Web skimming on a food delivery website – when dinner costs more than you bargained for
Scammers use various methods to steal people's credit card details. Alongside classic phishing, where victims enter their card details on a deceptively genuine-looking website, criminals can also obtain credit card information through data breaches at online service providers. Another method was highlighted in a case reported to the NCSC: criminals attempted to steal credit card details directly from a legitimate food delivery website using web skimming.
When people think of credit card details being stolen online, phishing websites are often the first thing that comes to mind. With web skimming, however, the data is stolen from a legitimate website. The attackers manipulate the genuine website of an online shop or other online service by inserting malicious code. This code captures the credit card details entered by customers and sends these details to the attackers.
How websites can be manipulated
In order to alter the content or functionality of a website, attackers need a way to inject code or data into the server. This can be done, for example, by exploiting a vulnerability in the web application or the content management system (CMS), or by using compromised administrator accounts. Attackers can then modify content or inject their own JavaScript code. Another possible route is the supply chain. Modern websites rarely consist entirely of code developed by the website operator. They often incorporate JavaScript libraries, analytics tools or other external services directly into the site. If one of these providers is compromised, the consequences can be far-reaching even if the website operator itself is never directly attacked. To customers, the website appears completely normal: the web address and layout are unchanged, and the manipulation is only apparent on closer inspection of the code.
What happens during checkout
In the case reported to the NCSC, a food delivery website had been manipulated.
Once the hungry customer has selected their order, they proceed to the checkout page to choose a payment method. This is where the attackers intervene: the option that would normally offer TWINT as a payment method is altered by an injected JavaScript file.
The original ‘TWINT’ option is replaced with ‘Credit/Debit Card’:
A closer look at the injected JavaScript code shows where the original label is replaced:
This gives customers the impression that credit card payment is a legitimate option offered by the website. The only clue that something may be wrong is that the option is labelled in English – ‘Credit/Debit Card’ rather than ‘Kreditkarte’ – even though the rest of the website is in German.
When the customer selects this payment method, a pop-up window containing a form appears, asking them to enter their credit card details. There are warning signs here, too: the form does not match the design of the rest of the website and is again in English.
The payment details entered are then sent to a domain controlled by the scammers. To avoid arousing suspicion and allow the customer to complete the order as normal, a message appears claiming that credit card payments are still in a test phase and asking them to pay with TWINT instead. The legitimate TWINT option then reappears, while ‘Credit/Debit Card’ disappears. The customer can therefore complete the purchase as usual – but by this point, the scammers have already obtained their credit card details.
How to prevent web skimming attacks
Without specialist knowledge, this kind of manipulation is extremely difficult – if not impossible – to detect. This makes it all the more important for website and online shop operators to protect their customers and provide a secure shopping experience.
Recommendations for website operators
- Keep all components up to date and install security patches regularly.
- Keep an inventory of external JavaScript libraries and plugins, and regularly check that they come from trusted sources and are still up to date.
- Regularly test that the website is working as intended. Online shop operators should in particular check the checkout process for any irregularities. These checks can be automated.
- Use strong administrator passwords and two-factor authentication wherever possible.
- Use a restrictive Content Security Policy (CSP) to define which sources the browser is permitted to load JavaScript from, and to which destinations data can be sent.
Recommendations for victims of web skimming
- If you notice any unusual charges on your credit card after making a purchase from a trusted website, it is possible that the site may have been affected by web skimming.
- Report the incident to the NCSC. The NCSC can then contact the website operator.
- Contact your bank or credit card provider and ask them to reverse the transaction.
- In the event of financial loss, the NCSC recommends filing a complaint with the police. You can find your nearest police station on the Suisse ePolice website (available in German, French and Italian).
Current statistics
Last week's reports by category: