Last week, British Airways acknowledged that someone had hacked its main website. The worst part? The attack was carried out with impressive subtlety. The available data so far suggests that the hack was carried out by a group called Magecart, linked to the attack that TicketMaster suffered in the United Kingdom a few months earlier. This time, Magecart managed to compromise the data of 380,000 British Airways customers, and only needed 22 lines of JavaScript code.
The Scope of the Breach
Despite e-commerce continuing to grow by leaps and bounds, this is one of the cases why some people still hesitate to share their card data over the Internet. Between August 21 and September 5 of this year, British Airways was the victim of an attack that exposed the payment processing information of some 380,000 customers who used the official website and mobile app during that period. Representatives immediately notified affected customers and recommended getting in touch without delay with their banks and/or card providers. The only “good” news is that the leaked data (names, addresses, phone numbers, and card details) does not include passport references or travel destinations, but that is cold comfort compared to the magnitude of the breach.
How the Attack Worked
The most disturbing aspect is the precision with which the attack was carried out. The group involved, which several computer security groups have identified as Magecart, only had to inject 22 lines of JavaScript code, using a malicious build of version 2.6.2 of the Modernizr library. The code’s job was to call “baways.com”, a virtual server located in Lithuania that used a certificate registered by Comodo (that is, they took the trouble to pay for it). The key to the attack is that it never interrupted the user’s actions. Once the payment form was filled with personal data and Submit was pressed, the malicious code did nothing more than export a copy of that data as JSON. No errors.
Aftermath and Consequences
If we compare the initial date of the incident with the issuance date of the certificate, and add the high degree of knowledge that enabled such a surgical attack, it is not hard to conclude that Magecart elements managed to enter British Airways’ system long before activating their campaign. RiskIQ has diligently explored all the technical details of the attack, including the involvement of the mobile app. Now, what happens with British? By not closely monitoring file changes on its production servers, the company’s negligence was enormous. Even so, purging its IT department may not be enough. A law firm, SPG Law, is considering filing a lawsuit against British Airways for £500 million. And that’s just the tip of the iceberg. I only hope it doesn’t end up like another Equifax, which basically walked away after its breach.
