Image copyright Getty Images Image caption The data breach affected 380,000 transactions by BA customers

A cyber-security firm has said it found malicious code injected into the British Airways website, which could be the cause of a recent data breach that affected 380,000 transactions.

A RiskIQ researcher analysed code from BA's website and app around the time when the breach began, in late August.

He claimed to have discovered evidence of a "skimming" script designed to steal financial data from online payment forms.

BA said it was unable to comment.

A very similar attack, by a group dubbed Magecart, affected the Ticketmaster website recently, which RiskIQ said it also analysed in depth.

The company said the code found on the BA site was very similar, but appeared to have been modified to suit the way the airline's site had been designed.

"This particular skimmer is very much attuned to how British Airway's payment page is set up, which tells us that the attackers carefully considered how to target this site instead of blindly injecting the regular Magecart skimmer," the researcher wrote in a report on the findings.

"The infrastructure used in this attack was set up with British Airways in mind and purposely targeted scripts that would blend in with normal payment processing to avoid detection."

Hacks like this make use of an increasingly common phenomenon, in which large websites embed multiple pieces of code from other sources or third-party suppliers.

Such code may be needed to do specific jobs, such as authorise a payment or present ads to the user. But malicious code can be slipped in instead - this is known as a supply chain attack.

In BA's case, hackers stole names, email addresses and credit card details - including the long number, expiry date and the three-digit CVV security code.

"As this is a criminal investigation, we are unable to comment on speculation," said BA in a statement.

A spokesman for the UK's National Crime Agency said it was aware of the RiskIQ report but would not be commenting at this time.

Data grab

RiskIQ said the malicious script consisted of just 22 lines of code. It worked by grabbing data from BA's online payment form and then sending it to the hackers' server once a customer hit the "submit" button.

The cyber-security firm added that the attackers had apparently been able to gather data from mobile app users as well because the same script was found loaded into the app on a page describing government taxes and carrier charges.

"The page [in the app] is built with the same... components as the real website, meaning design and functionality-wise, it's a total match," the RiskIQ report noted.

Media playback is unsupported on your device Media caption British Airways' chairman and CEO says affected customers will be 100% compensated

RiskIQ recommended that BA customers affected by the breach get a new debit or credit card from their bank.

The firm pointed out that whoever was behind the attack had apparently decided to target specific brands and that more breaches of a similar nature were likely.

"There is a very clear emerging risk where the weakest link in payment processes is being actively targeted," cyber-security expert Kevin Beaumont told the BBC.

"And that weakest link in the chain is often by placing older systems or third-party code into the payment chain."

Andrew Dwyer, a cyber-security researcher at the University of Oxford added that the attackers appeared to have gone to "extraordinary lengths" to tailor their code to the BA site.

According to RiskIQ, they also acquired a Secure Socket Layer (SSL) certificate - which suggests to web browsers, not always accurately, that a web page is safe to use.

If this was indeed how the attack worked, he added, there are ways of preventing third-party code taking data from sensitive web pages.

"BA should have been able to see this," he told the BBC.</s>Luke covers sports, tech and lifestyle for Verdict. You can reach him at luke.christou@verdict.co.uk

The recent British Airways data breach was caused by a malicious script injected into the company’s website, cybersecurity firm RiskIQ has found.

Analysis of code from BA’s website around the time when the breach is thought to have occurred shows evidence of a script designed to steal financial data entered into BA’s online payment forms.

The airline has admitted that the data of more than 380,000 customers was stolen as the breach went undetected for 16 days.

But who was behind the latest attack on a mainline airline, following attacks on Air Canada and Delta Air Lines earlier this year?

RiskIQ has settled on the conclusion that Magecart, a cybercriminal group that has been operating since 2015, was behind the hack. The group has been linked with attacks on over 7,000 online stores in the last three years.

According to RiskIQ, the latest breach can be linked to the group due to the similarities between the code placed on the BA site and the code used to steal the payment data of tens of thousands of Ticketmaster customers earlier this year, another attack thought to have been carried out by Magecart.

The code is designed to steal payment card information entered into checkout pages, as well as sensitive information such as credit card numbers, names and addresses. However, on this occasion the script’s appearance had been altered in order to make it blend in on the BA site.

This certainly seems to suggest that the breach is the work of a more organised group, given that the breach went undetected for so long.

What does this mean for those affected?

Having your data stolen is concerning at the best of times. However, the type of data that was potentially compromised in the BA breach is particularly worrying.

It’s still too early to know how much damage the breach has or will cause. However, if an organised group like Magecart is behind it, then it is highly likely that this data will be used to maliciously target BA customers in the future.

According to Bill Conner, CEO of cybersecurity specialist SonicWall, personal information that doesn’t change frequently, such as credit card numbers, drive a high price on the Dark Web.</s>A security firm says credit card skimming malware installed by hackers on British Airways’ website a few months ago was to blame for a data breach of over 380,000 credit cards.

Payments through the airline’s website and mobile app were stolen over the three week period, but a key clue was that travel information wasn’t affected.

Yonathan Klijnsma, a threat researcher at RiskIQ, suspected it might be the same group that was behind the Ticketmaster breach, in which hackers targeted a third-party that loaded code on Ticketmaster’s various sites. From there, it could siphon off thousands of transactions.

This time, Klijnsma said the group took an even more “highly targeted approach,” describing a wave of attacks that the “Magecart” collective has used to steal thousands of records from various sites in recent months.

“This British Airways attack was just an extension of this campaign,” he said, prior to the release of his research.

His research, out Tuesday, points to hackers injecting code directly onto the company’s website which the airline used shared on both the website and the mobile app. Using his company’s proprietary web crawling technology, he found that code hosted on the airline’s global site was compromised on August 21 — the reported date of the breach — and malicious code was injected without anyone noticing.

When a customer clicked bought plane tickets, the code would scrape the credit card information the open payment page and forward the data to a fake site run by the hackers from a private server in Romania.

Names, billing address, email address, and all bank card details were collected by the code.

“This attack is a simple but highly targeted approach compared to what we’ve seen in the past with the Magecart skimmer which grabbed forms indiscriminately,” said Klijnsma. “This particular skimmer is very much attuned to how British Airway’s payment page is set up, which tells us that the attackers carefully considered how to target this site instead of blindly injecting the regular Magecart skimmer.”

That would explain why the financial data was collected but not the travel and passport data. It also explains why the mobile app was affected, Klijnsma said, because an analysis of the mobile app also loaded the same data-scraping script.

“There’s so many ways they could have stolen the payment or [personal] information, they went for this really simple method, but its super effective,” said Klijnsma.

But, he said, “they went from super advanced to simplifying their attacks — and their [returns are] more insane than ever.”</s>Last week, British Airways revealed that all the payment information processed through the airline's website and mobile app between August 21 and September 5 had been exposed. As many as 38,000 British Airways customers may have had their contact and financial information stolen in the breach, which evidence suggests was the result of malicious JavaScript code planted within British Airway's website.

According to a report by RiskIQ's Head Researcher Yonathan Klijnsma published Tuesday, RiskIQ detected the use of a script associated with a "threat group" RiskIQ calls Magecart. the same set of actors believed to be behind a recent credit card breach at Ticketmaster UK. While the Ticketmaster UK breach was the result of JavaScript being injected through a third-party service used by the Ticketmaster website, the British Airways breach was actually the result of a compromise of BA's own Web server, according to the RiskIQ analysis.

"This attack is a highly targeted approach compared to what we’ve seen in the past with the Magecart skimmer,” said Klijnsma. "This skimmer is attuned to how British Airways’ payment page is set up, which tells us that the attackers carefully considered how to target this site in particular."

The suspect scripts were detected based on a daily crawl of websites conducted by RiskIQ, which gathers data on more than two billion pages a day. Focusing on how the scripts on the BA site changed over time, the RiskIQ researchers found a modified script within the BA site. Code added to a JavaScript library utilized by the BA site called an API on a malicious Web server at baways.com—a virtual private server hosted by a provider in Lithuania, using a TS certificate registered through Comodo (apparently to raise its appearance of legitimacy) on August 15.

The 22 lines of code are targeted to export the data entered in the BA website's payment form to the malicious server when the "submit" button was clicked by a customer, with the data being sent as a JSON object. As a result, the transaction would go through for the customer without any errors, while the attackers received a full copy of the customer's payment information despite the payment apparently being over a secure session. The attackers also added a "touchend" callback to the script, which made the attack functional for users of BA's mobile app—which called the same, modified script.

While the modified script file's timestamp matches with the beginning of the attack reported by British Airways, the registration date for the malicious site's certificate, Klijnsma said, "indicates [the attackers] likely had access to the British Airways site before the reported start date of the attack on August 21st—possibly long before. Without visibility into its Internet-facing web assets, British Airways were not able to detect this compromise before it was too late."

British Airways would not comment on the RiskIQ report, as a criminal investigation is still underway.</s>A group of hackers called Magecart, which is believed to have links to Romania and Lithuania, may have been responsible for the attack on British Airways last week, according to researcher Yonathan Klinjsma from the cyber-security company RiskIQ, quoted by the British publication The Telegraph.

Magecart is active since 2015 and is known for several scams in online credit card transactions, including a cyber attack on Ticketmaster, local Agerpres reported.

British Airways announced last week that the credit card data of about 380,000 of its customers had been stolen between August 21 and September 5. The data included passenger names, home addresses and credit card data.

Five Romanian hackers arrested for spreading ransomware in Europe, US</s>On Friday, British Airways disclosed a data breach impacting customer information from roughly 380,000 booking transactions made between August 21 and September 5 of this year. The company said that names, addresses, email addresses, and sensitive payment card details were all compromised. Now, researchers from the threat detection firm RiskIQ have shed new light on how the attackers pulled off the heist.

RiskIQ published details tracking the British Airways hackers' strategy on Tuesday, also linking the intrusion to a criminal hacking gang that has been active since 2015. The group, which RiskIQ calls Magecart, is known for web-based credit card skimming—finding websites that don't secure payment data entry forms, and vacuuming up everything that gets submitted. But while Magecart has previously been known to use the same broadly targeted code to scoop up data from various third-party processors, RiskIQ found that the attack on British Airways was much more tailored to the company's specific infrastructure.

"We’ve been tracking the Magecart actors for a long time and one of the developments in 2017 was ... they started to invest time into targets to find ways to breach specific high-profile companies, like Ticketmaster," says RiskIQ threat researcher Yonathan Klijnsma. "The British Airways attack we see as an extension of this campaign where they’ve set up specialized infrastructure mimicking the victim site."

In its initial disclosure, British Airways said that the breach didn't impact passport numbers or other travel data. But the company later clarified that the compromised data included payment card expiration dates and Card Verification Value codes—the extra three or four-digit numbers that authenticate a card—even though British Airways has said it does not store CVVs. British Airways further noted that the breach only impacted customers who completed transactions during a specific timeframe—22:58 BST on August 21 through 21:45 BST on September 5.

These details served as clues, leading analysts at RiskIQ and elsewhere to suspect that the British Airways hackers likely used a "cross-site scripting" attack, in which bad actors identify a poorly secured web page component and inject their own code into it to alter a victim site's behavior. The attack doesn't necessarily involve penetrating an organization's network or servers, which would explain how hackers only accessed information submitted during a very specific timeframe, and compromised data that British Airways itself doesn't store.

Klijnsma, who pinned the recent Ticketmaster breach on Magecart and saw similarities with the British Airways situation, started looking through RiskIQ's catalog of public web data; the company crawls more than two billion pages per day. He identified all the unique scripts on the British Airways website, which would be targeted in a cross-site scripting attack, and then tracked them through time until he found one JavaScript component that had been modified right around the time the airline said the attack began.

The script is connected to the British Airways baggage claim information page; the last time it had been modified prior to the breach was December 2012. Klijnsma quickly noticed that attackers revised the component to include code—just 22 lines of it—often used in clandestine manipulations. The malicious code grabbed data that customers entered into a payment form, and sent it to an attacker-controlled server when a user clicked or tapped a submission button. The attackers even paid to set up a Secure Socket Layer certificate for their server, a credential that confirms a server has web encryption enabled to protect data in transit. Attackers of all sorts have increasingly used these certificates to help create an air of legitimacy—even though an encrypted site is not necessarily safe.

The airline also said in its disclosure that the attack impacted its mobile users. Klijnsma found a part of the British Airways Android app built off of the same code as the compromised portion of the airline's website. It's normal for an app's functionality to be based in part on existing web infrastructure, but the practice can also create shared risk. In the case of the British Airways Android app, the malicious JavaScript component the attackers injected on the main site hit the mobile app as well. Attackers seem to have designed the script with this in mind by accommodating touchscreen inputs.

While the attack wasn't elaborate, it was effective, because it was tailored to the specific scripting and data flow weaknesses of the British Airways site.

British Airways said in a statement to WIRED on Tuesday, "As this is a criminal investigation, we are unable to comment on speculation."1 RiskIQ says it gave the findings to the UK's National Crime Agency and National Cyber Security Centre, which are investigating the breach with British Airways. "We are working with partners to better understand this incident and how it has affected customers," an NCSC spokesperson said of the breach on Friday.

RiskIQ says it is attributing the incident to Magecart because the skimmer code injected into the British Airways website is a modified version of the group's hallmark script. RiskIQ also views the attack as an evolution of the techniques used in the recent Ticketmaster breach, which RiskIQ linked to Magecart, though with the added innovation of directly targeting a victim's site rather than compromising a third party. And some of the attack infrastructure, like the web server hosting and domain name, point to the group as well.

So far British Airways and law enforcement haven't publicly commented on this attribution, but Klijnsma says the other takeaway for now is the prevalence of tiny website vulnerabilities that can quickly turn into huge exposures.

"It comes down to knowing your web-facing assets," Klijnsma says. "Don’t overexpose—only expose what you need. The consequences, as seen in this incident, can be really, really bad."

1Update 9/11/18 10:15am ET to include a statement from British Airways.
• This hyper-real robot will cry and bleed on med students
• Tips to get the most out of Gmail’s new features
• How NotPetya, a single piece of code, crashed the world
• Looking for more? Sign up for our daily newsletter and never miss our latest and greatest stories</s>SAN FRANCISCO, Sept. 11, 2018 (GLOBE NEWSWIRE) -- , the global leader in digital risk management, today revealed that its researchers traced the breach of 380,000 sets of payment information belonging to customers of British Airways to Magecart, the credit-card skimming group made infamous for its .



Because the attack was reported by British Airways to be web-based and targeting credit card data, RiskIQ researchers strongly suspected Magecart was behind it. Leveraging the company's global web-crawling network, which maintains a map of the internet and enables security practitioners to analyze web pages and their components as they appear through time, they confirmed that assumption.

The attack was similar to the one leveled against Ticketmaster with one key difference: instead of compromising commonly used third-party functionality to gain access to hundreds of sites at once, Magecart operatives compromised the British Airways site directly and planned their attack around the site's unique structure and functionality. RiskIQ's data shows that scripts supporting the functionality of the payment forms on the British Airways' website were copied and modified to deliver payment information to an attacker-controlled server while maintaining their intended functionality to avoid detection.

The attackers were also aware of the way the British Airways mobile app was constructed, leveraging the fact that it used much of the same functionality as the web-app and could, therefore, victimize users in the same way.

"This attack is a highly targeted approach compared to what we've seen in the past with the Magecart skimmer," said Yonathan Klijnsma, Head Researcher at RiskIQ. "This skimmer is attuned to how British Airways' payment page is set up, which tells us that the attackers carefully considered how to target this site in particular."

The researchers also found evidence that Magecart operatives may have breached the British Airways site several days before the skimming began. RiskIQ web-crawling data shows that a certificate used on the attacker's command and control server was issued on August 15th, nearly a week before the reported start date of the attack on August 21st.

RiskIQ, which detects internet-scale threats, is alerted to new Magecart breaches hourly, a clear indication that the group is extremely active and a very real threat to all organizations offering online payment facilities. For a full analysis of this campaign, including a list of compromised components and IOCs, visit the report here: https://www.riskiq.com/blog/labs/magecart-british-airways-breach/

RiskIQ is the leader in digital threat management, providing the most comprehensive discovery, intelligence and mitigation of threats associated with an organization's digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social and mobile exposures. Trusted by thousands of security analysts, security teams and CISO's, RiskIQ's platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk and take action to protect the business, brand and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners and MassMutual Ventures.

Visit https://www.riskiq.com or follow us on Twitter. Try RiskIQ Community Edition for free by visiting https://www.riskiq.com/community/

© 2018 RiskIQ, Inc. All rights reserved. RiskIQ is a registered trademark of RiskIQ, Inc. in the United States and other countries. All other trademarks contained herein are the property of their respective owners.</s>In only 22 lines of code, hackers took on the UK's largest airline and stole data from up to 380,000 people.

But the hackers behind British Airways' data breach left behind a trail of evidence showing just how the major airliner had suffered its cyberattack, said researchers from cybersecurity firm RiskIQ.

The clues showed that the attacker was likely Magecart, the same cybercriminal group behind Ticketmaster UK's breach in June, said Yonathan Klijnsma, a head researcher with RiskIQ.

Cybercriminal gangs represent a new, more potent threat to businesses because the organized efforts don't just steal from companies, but also the millions of customers paying for their services. While hackers can act alone, coordinated cyberattacks mean the potential to affect more people.

The FBI announced in August that it arrested three alleged members of FIN7, another cybercrime group that hacked restaurants like Chipotle, Chili's and Arby's and got its hands on the credit card info of more than 15 million people.

Magecart is set to be "bigger than any other credit card breach to date," security researchers said in July.

The British Airways hack is part of Magecart's massive skimming campaign, as it almost identically follows the script from previous attacks, RiskIQ's researchers said. Credit card skimmers are usually a physical problem, with thieves putting fake readers on ATMs to steal financial data from people swiping their cards. But Magecart has brought that threat online, compromising more than 800 e-commerce websites and stealing financial data.

And the attacks are getting smarter. While previous attacks from Magecart used the same code that researchers could find automatically, RiskIQ's blacklist missed the British Airways attack because the hack was customized this time, Klijnsma said.

"We're now seeing them target specific brands, crafting their attacks to match the functionality of specific sites," the threat researcher said.

The group stashed some modified code in British Airways' baggage claim webpage, where customers would fill in their names, addresses, email and financial information. Looking through data logs, RiskIQ's researchers found a slight change on the page's code from mid-August.

The baggage claim page contained a JavaScript library that sent all the data on the screen to the URL "baways.com." The hackers would obtain a copy of the data while the victim was sending that personal and financial information to the airliner and not know anything was wrong.

To an unsuspecting eye, "Baways" might look like short-hand for British Airways, but RiskIQ found that the URL was hosted in Romania and only registered on Aug. 15 -- just six days before Magecart started stealing data from the airliner.

It's still unclear how Magecart's hackers were able to inject its custom JavaScript into British Airways' website. The only way that Magecart would have been able to do that is through server-side access to British Airways' infrastructure, Klijnsma said.

RiskIQ warns that with British Airways' customized attack, it's likley Magecart will carry out more sophisticated attacks against major companies.

"Magecart is extremely cunning and will continue to find ways to exploit the lack of visibility many e-commerce brands have into the code running on their websites to victimize more and more customers," Klijnsma said in an email. "We get alerts for new Magecart attacks almost hourly, so we don't see this stopping any time soon."

Security: Stay up-to-date on the latest in breaches, hacks, fixes and all those cybersecurity issues that keep you up at night.

Blockchain Decoded: CNET looks at the tech powering bitcoin -- and soon, too, a myriad services that will change your life.</s>British Airways reported a breach last week that affected about 380,000 customers’ data. Threat management firm RiskIQ revealed today that the same criminal group behind a Ticketmaster UK breach also attacked British Airways.

In a previous report, RiskIQ found that Ticketmaster’s breach was the work of the criminal group Magecart. It injected scripts onto a compromised customer service product on Ticketmaster’s site in order to steal personal data. According to RiskIQ, Magecart tends to use scripts to steal customer data that are entered on online payment forms, usually through compromised third-party services these sites use.

RiskIQ analyzed the source code from British Airways’ webpages and its mobile app and found Magecart injected a few lines of JavaScript on the card checkout pages of both; although, in this case, Magecart didn’t first target a third-party vendor. The breach occurred from August 21st to September 5th and affected payments on mobile and web. Magecart set up custom, targeted scripts that wouldn’t be noticed on the British Airways website, indicating that the group had access before the attack began. RiskIQ calls it “a stark reminder about the vulnerability of web-facing assets.”

Users affected by the British Airways breach should get a new credit or debit card from their bank and cancel the old one.</s>The attackers behind a data breach that left thousands of British Airways customer details exposed have been identified by security researchers.

RiskIQ has named the Magecart hacking group as the suspected perpetrators behind last week's attack, which saw ore than 300,000 accounts compromised.

The group was able to obtain the names, street and email addresses, credit card numbers, expiry dates and security codes of the airlines customers, which could potentially have allowed them to steal from user accounts.

Magecart first hit the headlines back in June when it was identified as being behind an attack on ticket sales site Ticketmaster.

RiskIQ said that the fact the BA attack bore several trademarks of the group, as it was web-based and targeting credit card data.

However there was one key difference to the Ticketmaster attack, with Magecart directly targeting the British Airways site, rather than a third-party service as they had done previously, showing that they planned their attack around BA's unique site structure and functionality.

Magecart was also apparently highly aware aware of the way the British Airways mobile app was built, and took advantage of the fact it used much of the same functionality as the website, and could therefore be hijacked in the same way.

"This attack is a highly targeted approach compared to what we’ve seen in the past with the Magecart skimmer,” said Yonathan Klijnsma, head researcher at RiskIQ. "This skimmer is attuned to how British Airways’ payment page is set up, which tells us that the attackers carefully considered how to target this site in particular."
• Looking to stay safe online? These are the best antivirus of 2018
RiskIQ, a cybersecurity firm, reports that it has discovered the software that was used to gather credit card information from the British Airways website. The firm further states that the "supply chain attack" was very similar to an earlier attempt to skim data from the Ticketmaster website.