Month: October 2023

Putin met with Kyrgyz President Sadyr Zhaparov and was to take part on Friday in the Commonwealth of Independent States summit, which Kyrgyzstan is hosting. Leaders of Azerbaijan, Belarus, Kazakhstan, Tajikistan, Turkmenistan and Uzbekistan will also attend the summit.

Armenian Prime Minister Nikol Pashinyan will skip it, as Yerevan’s relationship with Moscow has frayed amid mutual accusations.

It is the first time this year that Putin has traveled outside Russia and Russian-held territories of Ukraine. Earlier this year, he visited the partially occupied Ukrainian regions of Donetsk, Luhansk and Kherson, as well as the annexed Crimean Peninsula.

In March, the ICC issued an arrest warrant for Putin over the deportation of children from Ukraine. Countries that have signed and ratified the Rome Statute, which created the ICC, are now bound to arrest the Russian leader if he sets foot on their soil.

The move caused Putin to skip an economic summit in South Africa in August and further strained Moscow’s ties with Armenia after it moved to ratify the Rome Statute earlier this month, even as Armenian officials sought to assure the Kremlin that the Russian leader would not be arrested if he entered the country.

The Kremlin has said that Russia doesn’t recognize the jurisdiction of the ICC and considers the warrant null and void.

Kyrgyzstan is not a signatory of the Rome Statute. In Central Asia, only Tajikistan is. Putin traveled to both countries last year after the invasion of Ukraine and amid increasing international isolation. He also visited other Central Asian nations in 2022, as well as Armenia, Belarus, China, India and Iran.

Later this month, Putin is expected to travel to China again. Last month, he also accepted an invitation to visit North Korea, although it remains unclear when that might happen. 

Russia’s parliament will vote next week on withdrawing Moscow’s ratification of the global treaty that bans nuclear tests, lawmakers said on Thursday.

At a time of acute tension with the West over Russia’s war in Ukraine, the move could provide Moscow with legal cover to conduct a test involving a nuclear explosion for the first time since 1990, even though it says it has no such intention.

Parliament’s lower house, the State Duma, said it would hold a first reading on the bill next Tuesday. Leonid Slutsky, head of the Duma’s international affairs committee, said he expected it to complete its passage two days later.

All 450 members of the Duma would sponsor the motion, Slutsky said, a sign that its unanimous approval is guaranteed. He said Russia would then notify the United Nations Secretary-General of the move.

Russia ratified the Comprehensive Test Ban Treaty (CTBT) in 2000; the United States has signed but never ratified it. The Duma is acting on a cue from President Vladimir Putin, who said last week that the point of de-ratifying would be to “mirror” the U.S. position.

Duma speaker Vyacheslav Volodin said: “For 23 years we have been waiting for Washington to ratify the treaty. What is this? Double standards, meanness and an irresponsible attitude. There is no other name for it.

“In this situation, we must be guided exclusively by the interests of the citizens of our country, our state.”

Russia has placed repeated emphasis on the role of nuclear weapons in its military posture, at a time when its conventional forces have struggled in Ukraine.

Its shift on the CTBT follows its suspension earlier this year of the New START treaty that limits the number of Russian and U.S. nuclear warheads, another key pillar of nuclear arms control in the 21st century.

While nudging the Duma to implement the CTBT move, Putin said last week he was not ready to say whether Russia should actually resume tests involving nuclear explosions.

A test could dramatically escalate tensions with the West, already at their highest levels for 60 years because of the war in Ukraine, and prompt the United States, China and others to resume their own tests for the first time this century, security analysts say.

Russian Deputy Foreign Minister Sergei Ryabkov accused the United States on Tuesday of carrying out preparations at its nuclear test site in Nevada, but said Russia would not resume testing unless Washington did.

The State Department rejected his allegation as “a disturbing effort by Moscow to heighten nuclear risks and raise tensions in the context of its illegal war in Ukraine”.

The United Auto Workers (UAW) snap strike on Wednesday at Ford’s largest and most profitable factory is raising pressure on Stellantis NV and General Motors as negotiators are expected to resume contract talks on Thursday.

UAW negotiators are expected to turn their attention on Thursday to talks with Chrysler-parent Stellantis (STLAM.MI), sources said.

The Kentucky walkout is a warning to Stellantis and General Motors (GM.N), whose wage and benefits offers fall short of Ford’s, based on summaries the automakers and the UAW have released.

Some analysts saw UAW President Shawn Fain’s decision to shut down Ford’s Kentucky Truck plant, which builds Super Duty pickips and Linoln Navigator SUVs, as a sign that the endgame could be starting in the nearly month-long round of coordinated walkouts at the Detroit Three.

“Pressure was always needed to force a deal,” Evercore ISI analyst Chris McNally wrote in a note on Thursday.

Ford’s shares fell 2.2% to $11.98 in premarket trade while GM’s shares were marginally lower at $30.95.

Last Friday, Fain said if needed, the UAW would strike the GM assembly plant in Arlington, Texas that builds Cadillac Escalade, Chevy Suburban and other large, high-priced SUVs. GM’s Flint heavy duty truck assembly plant is another potential strike target.

High-profit targets at Stellantis include the automaker’s Ram pickup truck factories in Sterling Heights and Warren, Michigan, as well as two Jeep SUV factories in Detroit.

“This puts everybody on notice,” said Sam Fiorani, vice president of global vehicle forecasting at AutoForecast Solutions. “If they haven’t brought anything new to the table since last week, GM and Stellantis should be worried.”

Analysts at Wells Fargo estimated that Ford will lose about $150 million per week in core profit from the Kentucky plant strike.

“We think this escalation is a sign that the UAW could be close to a contract proposal with Ford in the next 1-2 weeks,” Wells Fargo analyst Colin Langan said in the note.

Automakers have more than doubled initial wage hike offers, agreed to raise wages along with inflation and improved pay for temporary workers, but the union wants higher wages still, the abolishment of a two-tier wage system and the expansion of unions to battery plants.

The UAW has room to expand its walkouts and increase the pressure on the Detroit Three to offer bigger wage gains, richer retirement packages and more assurances that new electric vehicle battery plants will be unionized.

Even with 8,700 workers at Ford’s Kentucky Truck plant now on strike, less than a quarter of the 150,000 UAW workers at the Detroit Three automakers are now on strike. However, thousands more have been furloughed from jobs at operations that are not on strike because automakers said the walkouts made their work unnecessary.

Ford warned on Wednesday that workers at a dozen other factories could be sent home because of the truck plant walkout.

Its Kentucky truck plant, the company’s most profitable operation, generates $25 billion in annual sales, about a sixth of Ford’s global automotive revenue.

“There are very expensive products here that are extremely profitable,” Fiorani said. “With the Super Duty in this plant, this is Ford’s largest plant. They’re on target to build 400,000 vehicles this year.”

Fain and other UAW officials called a meeting with Ford at 5:30 pm ET (21:30 GMT) on Wednesday and demanded a new offer, which Ford did not have, a Ford official said.

“You just lost Kentucky Truck,” Fain said, according to the Ford official and a union source, speaking on condition of anonymity because the talks are not public.

“This is all you have for us? Our members’ lives and my handshake are worth more than this,” Fain added, according to the union source.

Ford said the decision was “grossly irresponsible but unsurprising given the union leadership’s stated strategy of keeping the Detroit 3 wounded for months through ‘reputational damage’ and ‘industrial chaos.’”

Fain has said his aim is to keep the automakers off balance by taking targeted action rather than a full strike at all operations.

“We’re not gonna wait around forever,” he said on social media platform X on Wednesday evening. “If Ford can’t get that after four weeks on strike, these 8,700 workers shutting down their biggest plant will help them understand it.”

The Detroit automakers will report third-quarter financial results between Oct. 24 and 31, and the UAW could use what are expected to be robust profits to press their case for a richer contract.

Before Wednesday’s Ford announcement, the union had ordered walkouts at five assembly plants, including two Ford assembly plants, at the three companies and 38 parts depots operated by GM and Stellantis.

The death toll from a missile strike on the village of Hroza in northeastern Ukraine has risen to 59 after police finished identifying the victims, Interior Minister Ihor Klymenko said on Thursday.

Ukraine said a Russian missile hit a cafe in the village in the Kharkiv region last week as people gathered to mourn a fallen Ukrainian soldier. Moscow denies targeting civilians in its full-scale invasion, a position it repeated in response to a question at a Kremlin briefing about the strike on Hroza.

“The Russians killed 59 people with a direct hit with an Iskander (missile) on the village of Hroza,” Klymenko said on the Telegram messaging app.

“All victims are local residents. They were pensioners, medics, farmers, teachers, entrepreneurs. All were civilians. Entire families of several generations died.”

The toll is one of the biggest among civilians in any single Russian strike in nearly 20 months of the war.

Forensic experts worked round the clock for six days to identify the victims. They needed mobile DNA laboratories to identify 19, and one person – a 60-year-old man – was identified only after 20 body parts were collected, Klymenko said.

Ukraine’s SBU security service has accused two villagers who it said had fled to Russia of helping guide the missile strike.

The Czech Foreign Ministry will summon Russia’s ambassador over the attack on Hroza, CTK news agency reported on Thursday.

Researchers observed a new Magecart web skimming campaign changing the websites’ default 404 error page to steal credit cards.

Researchers from the Akamai Security Intelligence Group uncovered a Magecart web skimming campaign that is manipulating the website’s default 404 error page to hide malicious code.

The attacks are targeting a large number of Magento and WooCommerce websites, including large organizations in the food and retail industries.

“In this campaign, all the victim websites we detected were directly exploited, as the malicious code snippet was injected into one of their first-party resources.” reads the report published by Akamai.

“In some instances, the malicious code was inserted into the HTML pages; in other cases, it was concealed within one of the first-party scripts that was loaded as part of the website.”

The attack chain of this campaign consists of three main parts: loader, malicious attack code, and data exfiltration.

1. Loader — Short, obscure JavaScript code snippets responsible for loading the full malicious code of the attack
2. Malicious attack code — The primary JavaScript code that executes the attack; it detects sensitive inputs, reads the data, disrupts the checkout process, and injects fake forms
3. Data exfiltration — The method used to transmit the stolen data to the attacker’s command and control (C2) server

The researchers observed three variations of the attack flaw, in two of them the software skimmer injected a malformed HTML image tag with an onerror attribute into the exploited website

In the third variant, once the loader is executed, the attack sends a fetch request to /icons, which is a relative path that doesn’t actually exist. This request causes a “404 Not Found” error.

The analysis of the loader revealed the presence of a regex match for the string “COOKIE_ANNOT” in the 404 HTML.

After this string, a lengthy Base64-encoded string has been appended. This encoded string is the obfuscated JavaScript attack code. The loader retrieves this string from the comment, decodes it, and initiates the attack, stealing the personal information provided by users.

Unlike variations one and two, data exfiltration in the third variation relies on the injection of fake form that closely resembles the original payment form and overlays it.

Upon the user’s submission of data into the counterfeit form, an error message is displayed. Then the fake form is concealed, the legitimate payment form reappears, and the user is instructed to re-enter their payment information.

The stolen data are sent to the server as a Base64-encoded string in the query parameter of an image network request to the attacker’s C2 server-

“This concealment technique is highly innovative and something we haven’t seen in previous Magecart campaigns. The idea of manipulating the default 404 error page of a targeted website can offer Magecart actors various creative options for improved hiding and evasion.” concludes the report.

“In some of the cases we’ve identified, the malicious loader had already been removed from the affected websites’ pages at the time of writing. However, the malicious comment in the default 404 page remained, potentially allowing the skimmer to easily reactivate the attack. This highlights the complexity of detecting, and the importance of mitigating, this approach.”

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Magecart web skimming campaign)

The post A new Magecart campaign hides the malicious code in 404 error page appeared first on Security Affairs.