Full Report
Analysis of the E1RB JS sniffer family
Analysis Summary
# Tool/Technique: E1RB (JS Sniffer Family)
## Overview
E1RB is a sophisticated family of JavaScript (JS) sniffers—a type of malware designed to infect e-commerce websites to steal payment card information and personally identifiable information (PII). It operates by intercepting data entered into web forms (digital skimming) before it is encrypted or sent to the legitimate payment processor. The E1RB family is notable for its longevity, evolving techniques to bypass security, and its broad targeting of various e-commerce platforms.
## Technical Details
- **Type:** Malware Family (JS Sniffer / Magecart)
- **Platform:** Web Browsers / E-commerce CMS (Magento, Shopify, WooCommerce, etc.)
- **Capabilities:** Form grabbing, credit card skimming, anti-debugging/anti-analysis, PII theft, data exfiltration.
- **First Seen:** Identified as active since at least 2016-2017 (with continuous evolution).
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1190 - Exploit Public-Facing Application (CMS vulnerabilities)
- **TA0003 - Persistence**
- T1505.003 - Server Software Component: Web Shell
- **TA0007 - Discovery**
- T1082 - System Information Discovery (Browser/Environment checks)
- **TA0009 - Collection**
- T1185 - Browser Session Hijacking
- T1056.003 - Input Capture: Digital Stealing
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Digital Skimming:** Automatically identifies payment forms and "grabs" data from fields such as card number, CVV, and expiration date.
- **Data Exfiltration:** Sends stolen data to attacker-controlled gateways (C2) via HTTP POST requests, often disguised as image files or legitimate scripts.
- **Cross-Platform Compatibility:** Designed to function across various e-commerce Content Management Systems (CMS) by targeting standard HTML form attributes.
### Advanced Features
- **Anti-Analysis & Anti-Debugging:** The script checks if the browser's developer tools are open or if it is running in a sandbox environment to prevent analysis by researchers.
- **Domain Shadowing:** Use of compromised subdomains of legitimate sites to host malicious payloads, making detection via reputation filtering difficult.
- **Obfuscation:** High levels of JavaScript obfuscation to hide the intent of the code and evade signature-based scanners.
- **Selective Loading:** The sniffer may only activate when specific strings (e.g., "checkout," "onepage") are present in the URL to minimize its footprint.
## Indicators of Compromise
*Note: Indicators vary by variant; these are representative of the family.*
- **Network Indicators (Defanged):**
- `e1rb[.]me`
- `jquery-js[.]com`
- `google-analytucs[.]com`
- `payment-mastercard[.]com`
- `cdn-static-assets[.]com`
- **Behavioral Indicators:**
- Unauthorized modification of `core_config_data` in Magento databases.
- Injection of `<script>` tags pointing to external, unknown domains in the checkout page source code.
- Network requests to external domains triggered immediately after a user clicks "Submit" or "Place Order."
## Associated Threat Actors
- **Magecart Groups:** Various subgroups (Group 4, Group 7) have been linked to E1RB-style activities.
- **General Cybercrime Underground:** E1RB is often sold or leased as a service (MaaS) to multiple independent actors.
## Detection Methods
- **Signature-based detection:** Utilizing YARA rules to scan server-side files for known E1RB obfuscation patterns.
- **Behavioral detection:** Monitoring for unexpected outbound network connections from the client browser to non-whitelisted domains during the checkout process.
- **Integrity Monitoring:** Using File Integrity Monitoring (FIM) to detect unauthorized changes to static JS files or CMS templates.
- **Content Security Policy (CSP):** Monitoring CSP violation reports for attempts to load scripts from unauthorized sources.
## Mitigation Strategies
- **Content Security Policy (CSP):** Implement a strict CSP to prevent the execution of scripts from untrusted domains and restrict where data can be sent (Connect-Src).
- **Subresource Integrity (SRI):** Use SRI hashes for all third-party scripts to ensure they haven't been modified.
- **System Hardening:** Regularly update CMS platforms (Magento, etc.) and plugins to patch vulnerabilities exploited for initial access.
- **Two-Factor Authentication (2FA):** Enforce 2FA for all administrative access to the e-commerce backend.
## Related Tools/Techniques
- **Inter JS Sniffer:** Another prominent family often compared to E1RB.
- **Magecart:** The umbrella term for the technique of injecting malicious JS into payment pages.
- **Web Shells:** Often used by E1RB operators to maintain access to the web server for script injection.