eCommerce Retailers Experiencing Active Security Leaks
September 05, 2019
Share this

Research conducted by Aite Group uncovered more than 80 global eCommerce sites that were actively being compromised by Magecart groups, according to a new report, In Plain Sight II: On the Trail of Magecart commissioned by Arxan Technologies.

In 2018, Magecart groups made headlines as the threat actors responsible for high-profile mega-breaches of global brands including Ticketmaster, Forbes, British Airways, Newegg and more. "Magecart" is an umbrella term given to multiple threat groups that use credit card skimming technology to infect eCommerce platforms and websites with the goal of stealing personal and financial information — without being detected for months or even years at a time. Virtual credit card skimmers, also known as formjacking, are inserted into a web application, often the shopping cart, and are used to steal credit cards to sell on the black market and for shipping scams to traffic goods purchased with stolen cards.

"Once again we're disappointed in what the research uncovered: the systemic lack of web-app protection being used by eCommerce websites and the inability of network and endpoint security solutions to completely protect consumers against this pervasive threat," says Aaron Lint, Chief Scientist and VP of Research, Arxan. "The push toward a modern user experience creates a lucrative attack surface inside the web content delivered via browser and mobile. Any interface which takes user input becomes a target for exfiltration. Additionally, the widespread use of third-party components has created a supply chain where an attacker can easily compromise thousands of sites with a mere few lines of code."

As organizations continue to rely on revenue from eCommerce – estimates project the global market to hit more than $3.5 trillion in 20191 – the potential financial impact of Magecart is dire. The fallout from digital skimming breaches in 2018 cost organizations hundreds of millions of dollars in government penalties alone. Making matters worse, an estimated 20 percent of websites hit by Magecart become reinfected within five days of remediating the original problem. It's a bleak picture for an industry about to embark on the busiest shopping season of the year.

"The threat of formjacking is a widespread and growing problem. Because so many web applications are lacking in-app protection, adversaries are able to easily debug and read a web app's JavaScript or HTML5 in plain text. Once the web app code is understood, malicious Javascript is then inserted into the web pages of target servers that delivers the web checkout form. Once weaponized, these credential pages will simultaneously send a consumer's credit card information to an off-site server under the control of the Magecart group while also allowing the compromised site to process the credit card so the consumer and the organization is unaware of the theft," says Alissa Knight, cybersecurity analyst for Aite Group and author of the In Plain Sight series of research. "It's important to adopt solutions that implement multiple layers of security, not just obfuscation, such as detection of code tampering and analysis, active response that shuts a browser down upon detection of formjacking, along with threat detection and real-time alerting and response."

To conduct this research, Knight used a source code search engine that scoured the web for obfuscated JavaScript that she found in repeating patterns of previously published Magecart breaches. Just 2.5 hours of initial research led to the discovery of over 80 compromised eCommerce sites globally that were actively sending credit card numbers to off-site servers under the control of the Magecart groups.

The research showed that:

■ The most common similarity across the 80 sites was the use of Magento, all of which are running old versions that are vulnerable to an unauthenticated upload and remote code execution vulnerability that has published exploits available for it.

■ 100 percent of the 80 sites discovered had no in-app protection implemented, such as tamper detection and code obfuscation.

■ 25 percent of the sites discovered were large, reputable brands in the motorsports industry and luxury apparel.

To combat this growing threat, here are some steps that retailers and eCommerce organizations can take to protect their customers:

■ Update or patch eCommerce platforms to the latest version.

■ Audit web code to ensure websites, including any third party apps, have not been compromised.

■ Implement a security solution that can provide alerts when suspicious activity targets web application code.

Share this

The Latest

September 27, 2023

Navigating observability pricing models can be compared to solving a perplexing puzzle which includes financial variables and contractual intricacies. Predicting all potential costs in advance becomes an elusive endeavor, exemplified by a recent eye-popping $65 million observability bill ...

September 26, 2023

Generative AI may be a great tool for the enterprise to help drive further innovation and meaningful work, but it also runs the risk of generating massive amounts of spam that will counteract its intended benefits. From increased AI spam bots to data maintenance due to large volumes of outputs, enterprise AI applications can create a cascade of issues that end up detracting from productivity gains ...

September 25, 2023

A long-running study of DevOps practices ... suggests that any historical gains in MTTR reduction have now plateaued. For years now, the time it takes to restore services has stayed about the same: less than a day for high performers but up to a week for middle-tier teams and up to a month for laggards. The fact that progress is flat despite big investments in people, tools and automation is a cause for concern ...

September 21, 2023

Companies implementing observability benefit from increased operational efficiency, faster innovation, and better business outcomes overall, according to 2023 IT Trends Report: Lessons From Observability Leaders, a report from SolarWinds ...

September 20, 2023

IT leaders are driving an increasing number of automation initiatives as a way to stay competitive, reduce costs and scale as they navigate an unpredictable social and economic environment, according to the 2023 State of Automation in IT survey conducted by Jitterbit ...

September 19, 2023

Customer loyalty is changing as retailers get increasingly competitive. More than 75% of consumers say they would end business with a company after a single bad customer experience. This means that just one price discrepancy, inventory mishap or checkout issue in a physical or digital store, could have customers running out to the next store that can provide them with better service. Retailers must be able to predict business outages in advance, and act proactively before an incident occurs, impacting customer experience ...

September 18, 2023
Digital transformation is key to ensuring companies keep up with the competitive market landscape. Putting digital at the core of a business can significantly reduce operating expenses and inefficiencies. However, this process often means changing the way internal teams work with one another. To help with the transition, this blog offers chief experience officers (CXOs) advice on how to lead a successful digital transformation project ...
September 14, 2023

Earlier this year, New Relic conducted a study on observability ... The 2023 Observability Forecast reveals observability's impact on the lives of technical professionals and businesses' bottom lines. Here are 10 key takeaways from the forecast ...

September 13, 2023
On September 10, MGM Resorts experienced what it called a "cybersecurity issue" that had a major impact on the company's systems, showing how cyberattacks can bring down applications, ultimately causing problems for a company in many ways ...
September 12, 2023

Only 33% of executives are "very confident" in their ability to operate in a public cloud environment, according to the 2023 State of CloudOps report from NetApp. This represents an increase from 2022 when only 21% reported feeling very confident ...