Why post it here?#

I figured that since I’m having a lot of fun messing with this little website project, and I’ve effectively turned my website into some sort of blog, I’ll inspire myself by uploading my school assignments here as posts. Perhaps, in the future, I can look back and see how awful my takes are, and have a stronger sense of understanding.

Or maybe I’m the next cybersecurity geniu- okay. Nope. That joke’s too foolish.

So, here’s one of my assignments from my time in University. I talk about, and learn, from the 2023 incident that hit the Ontario’s Liquor Control Board. It also gives me a good opportunity to learn Terminal and Hugo’s markup language better.

Also, as a sidenote… It’s absolutely fucking wild, that when I look at the submitted file, there’s a paragraph that’s not indented. My instructor did not mention it, but at my previous job, it’s an offense worthy of a minimum of 40 hours of additional work and no longer being allowed to see your brother’s wedding. It’s almost like my instructor graded me on the content, and didn’t look for reasons to push me down and make me fail. I legitimately panicked and re-checked my instructor’s grade and comments when I saw that mis-typed paragraph. It’s been weeks since I’ve written this. Grade’s still 100%. It’s possible this mindset has been holding me back substantially.

Why a Liquor Store?#

At the end of Feburary, 2026, Youtube channel Veratasium covered an attempt to install a backdoor on almost all major Linux distributions. While I felt this was an interesting topic to cover, the attack ultimately failed, detected by a Microsoft developer, of all people.

We could talk about massive world-wide changing attacks, and focus on how massive scale events could happen, and we’ll be the big heros for putting a stop to it by analysing and asking “Why does this request take 300ms, instead of 50?” or we can look at a more realistic scenario with notable consequences hitting an organisation that had all of the resources required to prevent this, but was still successfully attacked. This isn’t just some small business either. The LCBO is a Canadian Government owned organisation.

People are negligent everywhere. People don’t check their work. Big business, small business, critical-to-life organisations and governments. Even this very university. Yes. I noticed “Copy of Copy of Copy of Copy of Copy of Copy of Untitled Design – ITCassignment_2025.pdf” So, let’s focus our efforts on a boring topic. Get ready for your eyes to glaze over, and I know you’ll be eyeballing that bottle on the other side of your desk. Probably graciously purchased from a LCBO near you!

I also want to add an addendum. Someone told me, “Don’t think yourself above everyone else. Your work will get sloppy, you’ll resent your co-workers, and you’ll hate your job.” People outside of Cybersecurity are negligent, yes. But so are people inside, and everyone lets something slip now and then. Yourself, and myself included.

Analysis: What is MageCart?#

On January 12th, 2023 Ontario’s Liquor Control Board reported not one, but two cybersecurity breaches. The first breach was identified as running from December 28th, until January 4th. The exploit was then deployed from a period starting on January 5th, where it remained unnoticed until January 10th.

In the real world, we may encounter a credit-card skimmer. A hardware device installed on a payment processor, designed to capture payment card data, alongside the PIN number for validation. That information is then transmitted to another computer either locally, or online.

A Magecart Attack takes this to the online space. Same idea, the user inputs their credit card details on a website, and then that data is transmitted to a 3rd party. Credit card details can then be sold to a 3rd party who can use those details to siphon money from victims.

Although the LCBO never disclosed how the malicious code entered their systems, we can make some assumptions based on what happened. Generally, the weakest link in any Cybersecurity setup is social engineering, after all, why have a padlock is someone will simply give the attacker the key? Other Magecart incidents were compromised with either stolen or compromised administration credentials or an outdated module. I believe that it was likely an outdated module, largely due to how the initial incident (Dec28 – Jan5) was handled.

Hackers injected code into a Google Tag Snippit. These snippits are often used for things like analytics, advertising, and sometimes to help manage store-fronts. In this case, a javascript code injection was obfuscated by a Base64 string. This function not only forwarded entered information to the LCBO, as intended, but also to another address via a POST Request. The POST request is a statement held in the body of the request, making it more difficult to detect. Using a POST request was also better, as larger amounts of data could be transferred undetected.

This attack resulted in all input customer information getting forwarded to the attackers server. This included credit card details, personally identifying information, passwords, and aeroplan (Loyalty points) information. This occurred over two periods of time, spanning from December 28, until January 10th.

Once discovered, the LCBO in response shut down their e-commerce website. This resulted in the loss of sales while customers contacted the LCBO in regards to their data security and privacy. All user accounts were required to reset their passwords. This attack resulted in damaged confidence in online shopping with the LCBO, which, in the end, could have resulted in lost sales.

It is also worth noting that the LCBO is a crown corporation. This resulted in an increased resource usage in other parts of the provincial government.

Response: Swift and capable.#

Again, the Magecart exploit is a well known, well document incident that has occurred many times in the past. This incident is unique in the sense that it was much more difficult to detect than others. The use of Google Tag Managers and Base64 encoding made this a very challenging script to detect and understand!

revention tactics could include routine logging and consistent checks. If the GTM was installed by a 3rd party, logging practices could have detected the change as an early warning sign. Better education in regards to social engineering tactics could have possibly prevented it. However, this is largely speculation, as the LCBO never disclosed how the attack initially started. Potentially, enforcing a whitelist to where changes to the the main website could only have been done from specific locations. The LCBO already had a 3rd party monitoring the website, but detection still took some time.

After reading more into this, I believe the LCBO took a reasonable response, immediately shutting down the ability to use the website and make further purchases while they performed a more in-depth investigation. Once they had fully understood the extend of the breach, two days later, the LCBO started to inform their customers that their data had been breached.

In terms of future prevention, many of the tactics we’ve seen before were already employed. 3rd party audits were done on regular intervals, and when they noticed that the checkout system was exhibiting abnormal behaviour, they shut things down.

That said, perhaps more eyes on the customer experience could have helped? Observing how the webpage reacted through these purchases could have resulted in a more rapid detection? After all, with how the exploit worked, it was the individual users’ browsers that sent the information, not LCBO’s servers.

In conclusion:#

I kept the statement in my introduction about the LCBO being negligent, but after doing more research I found that this was a rather sophisticated attack. I saw that there was a breach on December 28th, and the LCBO seemed to respond to it in one news article, but after using Lumo to find more resources, I found other articles indicating that the attackers gained access on the 28th of December, and then installed the exploit on the 5th of January. The exploit was discovered, handled, and responded to by the 12th of January.

I felt that this breach was interesting for a multitude of reasons. Not every every cybersecurity incident is extreme, nor world-ending. Cybersecurity incidents are present in places like nuclear reactors, or affecting millions of mission critical computers on such a level as a core component of Linux, sure. But we shouldn’t discount or ignore the smaller problems. Yes, the LCBO handled this incident better than I thought initially, but we can still learn something from it. Both teams can learn something major from this.

Honestly, I’m also looking at things from the perspective of the Black Hat’s here as well. Disguising part of the URL as “checkou” (Note the lack of ‘T’) was clever, and likely slowed detection. The Base64 encoding made part of the script unreadable, but if the attackers acted faster, they could have gotten more data. I find myself more curious to explore the Black Hat’s story, than the Blue Team’s. Though, it’s entirely possible that my current group of friends is starting to rub off on me. Either that, or maybe I find far more joy in reverse engineering someone else’s work, picking it apart to see how it works to improve it. My previous five years working in Blender and Unity was most certainly full of that.

How could we improve the attacker’s efforts here? Now… That’s an interesting topic. I’ll likely be talking about that over a few (Non-alcoholic) drinks in the near future.

Sources:#

News:

“Hackers compromised Ontario liquor board website, stole customer data”, Channel Daily News, 12 Jan. 2023, https://channeldailynews.com/news/hackers-compromised-ontario-liquor-board-website-stole-customer-data/79662

Antiviral:

“Web skimmer found on website of Liquor Control Board of Ontario”, MalwareBytes Labs, 17 Jan. 2023, https://www.malwarebytes.com/blog/news/2023/01/web-skimmer-found-on-website-of-liquor-control-board-of-ontario

“New Kritec Magecart skimmer found on Magento stores”, MalwareBytes Labs, 22 Mar. 2023, https://www.malwarebytes.com/blog/threat-intel/2023/03/new-kritec-skimmer

“Magecart Attack: Hacker steals credit card info from Canada’s largest alcohol retailer”, Feroot, 26 Jan. 2023, https://www.feroot.com/blog/magecart-attack-hacker-steals-credit-card-info-from-lcbo/

“What is a Magecart Attack?”, Feroot, 20 Aug. 2021, https://www.feroot.com/education-center/what-is-a-magecart-attack/

Security:

“Largest alcohol retailer in Canada hacked”, Galaxkey, 24 Jan. 2023, https://www.galaxkey.com/largest-alcohol-retailer-in-canada-hacked/

“Magecart Attack: Hacker steals credit card info from Canada’s largest alcohol retailer”, Ivan Tsarynny, 26 Jan. 2023, https://securityboulevard.com/2023/01/magecart-attack-hacker-steals-credit-card-info-from-canadas-largest-alcohol-retailer/

Other:

“Use Google Tag Manager to install third-party code snippets”, membership.io, n.d. https://help.membership.io/use-google-tag-manager-to-install-third-party-code-snippets