Just two and a half hours of desk research conducted by Aite Group uncovered more than 80 global eCommerce sites were actively leaking consumer credit card data through security holes in their web applications exploited by Magecart groups.
The research – commissioned by Arxan for its research report In Plain Sight II: On the Trail of Magecart, to examine tactics and techniques used by Magecart to compromise servers – found thatthese groups are increasingly now targeting ecommerce sites to make money.
“Magecart” is an umbrella term given to multiple threat groups that use credit card skimming technology to infect eCommerce platforms and websites with the goal of stealing personal and financial information — without being detected for months or even years at a time. Virtual credit card skimmers, also known as formjacking, are inserted into a web application, often the shopping cart, and are used to steal credit cards and customer information to sell on the black market and for shipping scams to traffic goods purchased with stolen cards.
In 2018 they made headlines as the threat actors responsible for high-profile mega-breaches of global brands including Ticketmaster, Forbes, British Airways, Newegg and more.
“Once again we’re disappointed in what the research uncovered: the systemic lack of web-app protection being used by eCommerce websites and the inability of network and endpoint security solutions to completely protect consumers against this pervasive threat,” says Aaron Lint, Chief Scientist and VP of Research, Arxan. “The push toward a modern website user experience creates a lucrative attack surface inside the web content delivered via browser and mobile. Any interface which takes user input becomes a target for exfiltration. Additionally, the widespread use of third-party components has created a supply chain where an attacker can easily compromise thousands of sites with a mere few lines of code.”
As organisations continue to rely on revenue from eCommerce – estimates project the global market to hit more than $3.5 trillion in 2019 – the potential financial impact of Magecart is dire. The fallout from digital skimming breaches in 2018 cost organizations hundreds of millions of dollars in government penalties alone.
Making matters worse, an estimated 20 percent of websites hit by Magecart become reinfected within five days of remediating the original problem. It’s a bleak picture for an industry about to embark on the busiest shopping season of the year.
She continues: “It’s important to adopt solutions that implement multiple layers of security, such as detection of code tampering and analysis, active response that shuts a browser down upon detection of formjacking, along with threat detection and real-time alerting and response.”
The research showed that the most common similarity across the 80 sites was the use of Magento, all of which are running old versions that are vulnerable to an unauthenticated upload and remote code execution vulnerability that has published exploits available for it.
Knight also found that 100% of the 80 sites discovered had no in-app protection implemented, such as tamper detection and code obfuscation; and,25% of the sites discovered were large, reputable brands.
To combat this growing threat, here are some steps that retailers and eCommerce organisations can take to protect their customers by updating or patching their eCommerce platforms to the latest version, audit web code to ensure websites, including any third party apps, have not been compromised, andimplement a security solution that can provide alerts when suspicious activity targets web application code.