eCommerce Retailers Experiencing Active Security Leaks
September 05, 2019
Share this

Research conducted by Aite Group uncovered more than 80 global eCommerce sites that were actively being compromised by Magecart groups, according to a new report, In Plain Sight II: On the Trail of Magecart commissioned by Arxan Technologies.

In 2018, Magecart groups made headlines as the threat actors responsible for high-profile mega-breaches of global brands including Ticketmaster, Forbes, British Airways, Newegg and more. "Magecart" is an umbrella term given to multiple threat groups that use credit card skimming technology to infect eCommerce platforms and websites with the goal of stealing personal and financial information — without being detected for months or even years at a time. Virtual credit card skimmers, also known as formjacking, are inserted into a web application, often the shopping cart, and are used to steal credit cards to sell on the black market and for shipping scams to traffic goods purchased with stolen cards.

"Once again we're disappointed in what the research uncovered: the systemic lack of web-app protection being used by eCommerce websites and the inability of network and endpoint security solutions to completely protect consumers against this pervasive threat," says Aaron Lint, Chief Scientist and VP of Research, Arxan. "The push toward a modern user experience creates a lucrative attack surface inside the web content delivered via browser and mobile. Any interface which takes user input becomes a target for exfiltration. Additionally, the widespread use of third-party components has created a supply chain where an attacker can easily compromise thousands of sites with a mere few lines of code."

As organizations continue to rely on revenue from eCommerce – estimates project the global market to hit more than $3.5 trillion in 20191 – the potential financial impact of Magecart is dire. The fallout from digital skimming breaches in 2018 cost organizations hundreds of millions of dollars in government penalties alone. Making matters worse, an estimated 20 percent of websites hit by Magecart become reinfected within five days of remediating the original problem. It's a bleak picture for an industry about to embark on the busiest shopping season of the year.

"The threat of formjacking is a widespread and growing problem. Because so many web applications are lacking in-app protection, adversaries are able to easily debug and read a web app's JavaScript or HTML5 in plain text. Once the web app code is understood, malicious Javascript is then inserted into the web pages of target servers that delivers the web checkout form. Once weaponized, these credential pages will simultaneously send a consumer's credit card information to an off-site server under the control of the Magecart group while also allowing the compromised site to process the credit card so the consumer and the organization is unaware of the theft," says Alissa Knight, cybersecurity analyst for Aite Group and author of the In Plain Sight series of research. "It's important to adopt solutions that implement multiple layers of security, not just obfuscation, such as detection of code tampering and analysis, active response that shuts a browser down upon detection of formjacking, along with threat detection and real-time alerting and response."

To conduct this research, Knight used a source code search engine that scoured the web for obfuscated JavaScript that she found in repeating patterns of previously published Magecart breaches. Just 2.5 hours of initial research led to the discovery of over 80 compromised eCommerce sites globally that were actively sending credit card numbers to off-site servers under the control of the Magecart groups.

The research showed that:

■ The most common similarity across the 80 sites was the use of Magento, all of which are running old versions that are vulnerable to an unauthenticated upload and remote code execution vulnerability that has published exploits available for it.

■ 100 percent of the 80 sites discovered had no in-app protection implemented, such as tamper detection and code obfuscation.

■ 25 percent of the sites discovered were large, reputable brands in the motorsports industry and luxury apparel.

To combat this growing threat, here are some steps that retailers and eCommerce organizations can take to protect their customers:

■ Update or patch eCommerce platforms to the latest version.

■ Audit web code to ensure websites, including any third party apps, have not been compromised.

■ Implement a security solution that can provide alerts when suspicious activity targets web application code.

Share this

The Latest

September 30, 2022

For businesses with vast and distributed computing infrastructures, one of the main objectives of IT and network operations is to locate the cause of a service condition that is having an impact. The more human resources are put into the task of gathering, processing, and finally visual monitoring the massive volumes of event and log data that serve as the main source of symptomatic indications for emerging crises, the closer the service is to the company's source of revenue ...

September 29, 2022

Our digital economy is intolerant of downtime. But consumers haven't just come to expect always-on digital apps and services. They also expect continuous innovation, new functionality and lightening fast response times. Organizations have taken note, investing heavily in teams and tools that supposedly increase uptime and free resources for innovation. But leaders have not realized this "throw money at the problem" approach to monitoring is burning through resources without much improvement in availability outcomes ...

September 28, 2022

Although 83% of businesses are concerned about a recession in 2023, B2B tech marketers can look forward to growth — 51% of organizations plan to increase IT budgets in 2023 vs. a narrow 6% that plan to reduce their spend, according to the 2023 State of IT report from Spiceworks Ziff Davis ...

September 27, 2022

Users have high expectations around applications — quick loading times, look and feel visually advanced, with feature-rich content, video streaming, and multimedia capabilities — all of these devour network bandwidth. With millions of users accessing applications and mobile apps from multiple devices, most companies today generate seemingly unmanageable volumes of data and traffic on their networks ...

September 26, 2022

In Italy, it is customary to treat wine as part of the meal ... Too often, testing is treated with the same reverence as the post-meal task of loading the dishwasher, when it should be treated like an elegant wine pairing ...

September 23, 2022

In order to properly sort through all monitoring noise and identify true problems, their causes, and to prioritize them for response by the IT team, they have created and built a revolutionary new system using a meta-cognitive model ...

September 22, 2022

As we shift further into a digital-first world, where having a reliable online experience becomes more essential, Site Reliability Engineers remain in-demand among organizations of all sizes ... This diverse set of skills and values can be difficult to interview for. In this blog, we'll get you started with some example questions and processes to find your ideal SRE ...

September 21, 2022

US government agencies are bringing more of their employees back into the office and implementing hybrid work schedules, but federal workers are worried that their agencies' IT architectures aren't built to handle the "new normal." They fear that the reactive, manual methods used by the current systems in dealing with user, IT architecture and application problems will degrade the user experience and negatively affect productivity. In fact, according to a recent survey, many federal employees are concerned that they won't work as effectively back in the office as they did at home ...

September 20, 2022

Users today expect a seamless, uninterrupted experience when interacting with their web and mobile apps. Their expectations have continued to grow in tandem with their appetite for new features and consistent updates. Mobile apps have responded by increasing their release cadence by up to 40%, releasing a new full version of their app every 4-5 days, as determined in this year's SmartBear State of Software Quality | Application Stability Index report ...

September 19, 2022

In this second part of the blog series, we look at how adopting AIOps capabilities can drive business value for an organization ...