Identifying a rival company stealing from you

I’ve spent a lot of my time doing security bits ‘n bobs for a large  takeaway EPOS company. Usually this entails a full review all every  repository to patch SQL injection vulnerabilities, Cross-Site Scripting  vulnerabilities, and loopy logic vulnerabilities or mitigating random  DDoS attacks, however on occasion I get to handle something a little  different.

A lot of the images here have had details removed to protect the privacy of both those I work for and those I don’t.

I was monitoring the CPU Utilisation on AWS and noticed a weird spike to  just over 10% utilisation (for some context, this is out of hours for  most takeaways and CPU utilisation had been around 2% for the past few  hours). Considering this database instance isn’t exactly underpowered I  thought I’d take a look at it.

Monyog showed a pretty dramatic jump from 152k queries to 1.4m queries.  There are a number of pages I’m aware of do a lot of heavy queries but  for such a high change seems weird for normal traffic.

New Relic confirmed that a large amount of this time was dedicated to  handling a few specific queries (DELETE, in this case) likely triggered  from someone going on a few random pages.

New Relic also allowed me to confirm that this wasn’t a DoS attack (or  even an extremely weak DDoS attack) by verifying that the requests per  minute hadn’t gone up dramatically.

I decided to look a little further into the matter so I took the  opportunity to fire up my log analysis tool. I first decided to look at  if there were any unusual numbers of requests from any IPs within the 10  minutes that might indicate a web crawler or a non-user pattern.

It was clear that there was one IP that stood out in this 10 minute  period between 12:30 and 12:40. It had made 1073 requests on one of the  web server instances (Normal users make between 20 to 100 requests. This  was the only IP to make more than that during this timeframe). It was  likely that there were another 1000 or so requests on the other instance  that was also up.

While still on this server I decided to have a quick look at what the  user agents for this IP were. A sign of a malicious web crawler is  randomly selected user agents that change in quick succession. However  this IP only had two User agents:

The one that caught my eye: Mozilla/4.5 (compatible; HTTrack 3.0x; Windows 98)

HTTrack, as many of you will know, is a popular website copier. As an  EPOS company, there have been a number of times in the past where a  rival company stealing a takeaway’s website and adapting it for them to  use for their own product (One even forgot to change part of the ToS  where the company name was formatted slightly differently).

As I started to get a little more suspicious, I looked back over some of the files that were accessed and /order********.php?*****=11781***** jumped out at me. That wasn’t HTTrack, that was the person themselves who’d ordered food before running HTTrack.
I ran a query on the RDS to find out details of the order.

One thing I noticed was that the IP was different to the one I’d  found in the log file. Almost as if the person had ordered food, jumped  on a VPN, and ran HTTrack but forgot to close the order page that may  have been sending AJAX requests to refresh the information displayed  (Whoops!).

To confirm the VPN theory, I did a simple geolocate of both the order  IP and the suspected VPN IP. The order IP was in a nearby city to the  takeaway location whereas the suspected VPN was located a significant  distance away from the takeaway. The suspected VPN IP linked to a Cisco  VPN and so I felt a little more certain about my theory on the above  events.

I did a quick query to see if either IP had been used before and I  noticed something weird; A random EPOS name had been used on a few  orders in either the comments section, or as the name… almost like an  advert…

A quick search lead me to their website. Almost all the takeaways  they handled were in the same city that the takeaway they were ordering  from was located.

Finally I decided to do one more check to verify what I’d found even more. I whois’d their domain name.

Surprise surprise, the domain was registered to the same street the orders were going to.

And with that, I passed what I’d found onto my manager and then the CEO.

Another day another job, eh?