English
Magyar
Shoppers spent nearly 40 billion US dollars during Cyber Week last year, in 2021. The average American adult shopper spent 430 dollars on Black Friday alone, meaning this period remains one of the biggest online shopping events of the year.
Unfortunately, as well as targeting online retailers, hackers are also setting up fake banks. With the start of the festive season, online shops are under increased threat from security risks such as skimmers, MageCart, ransomware and phishing. Last year, the UK’s National Cyber Security Centre (NCSC) reported several thousand MageCart attacks on compromised payment gateways in the run-up to Black Friday.
Software vulnerabilities remain among the most common threats affecting online shops – Magecart attacks are known to cause serious losses to unprepared online shops and organisations.
Don’t let Black Friday be a sweet deal for skimmers. Here are six e-commerce security threats to watch out for during Black Friday and Cyber Monday.
Skimmers and Magecart
Magecart attacks are notorious for stealing credit card details and other confidential information from compromised websites. These attackers are often referred to as card skimmers or credit card thieves, as they collect and leak the stolen information whilst users are filling in checkout pages and payment forms.
Attackers are capable of stealing data in real time during the checkout process – even before the data is sent to the relevant page. This means that if you (or any other potential customer) enter personal details and credit card information on a compromised website, even if you do not complete the submission of the form, there is still a risk that this data will be stolen.
Although some types of hijacking operate solely at server level, Magecart attacks often take the form of malicious JavaScript injections.
In most cases, developers and website owners do not monitor who has uploaded new scripts or created
Whilst Magecart takes its name from credit card thieves who targeted the popular Magento e-commerce CMS, the attacks have since spread to platforms such as WordPress, OpenCart and Prestashop.
The effects of a Magecart attack may include the following:
- Data theft: Although Magecart’s primary target is credit card details, the attacks can also steal personal data.
- Lost website revenue: A small or medium-sized online shop may experience a loss of revenue and a decline in sales due to infection and damage to its reputation.
- Cross-site infection: These infections are known to spread across shared server or hosting environments and can also affect other retail or online shop websites.
- Legal liabilities and compliance issues: Magecart attacks spell disaster in terms of legal sanctions and PCI compliance, which can lead to heavy fines and the inability to accept credit card payments.
Phishing
Phishing attacks will continue to pose a pervasive threat in 2022. This malicious software can be distributed in a number of ways, but most commonly spreads via popular communication channels such as email, text messages and messaging apps, for example Facebook or Instagram.
Data from Statista reveals that 14.6 per cent of phishing attacks in the first quarter of 2022 targeted the retail and e-commerce sectors. According to SOCRadar, tens of thousands of phishing domains were registered in 2021 and posed as popular e-commerce websites, such as Amazon. This clearly highlights the importance of protecting e-commerce businesses against phishing attacks.
In some cases, websites are at risk of being used to host phishing landing pages designed to collect sensitive data. In other cases, however, cybercriminals can be identified by sending emails or messages that appear to come from reputable, popular websites, in order to trick victims into revealing their account login details. From there, criminals can access customer accounts, alter personal details or carry out fraudulent transactions. They may even sell the stolen data on the dark web.
Account takeovers can also seriously damage the reputation and brand of online shops. Like Magecart malware, phishing attacks can lead to chargebacks, fraud and PCI compliance issues. They can even result in the inability to accept credit card payments.
Fake browser updates
Malware known as FakeUpdates or SocGholish redirects website visitors to pages designed to trick victims into downloading and installing fake browser updates, as shown below.
And whilst it may seem unusual for attackers to target an online shop with fake browser updates when there is an opportunity to steal credit card details, the results of such an infection can be highly lucrative for hackers.
Even a single piece of injected JavaScript code can lead to the download and installation of malicious software, including remote-access Trojans and information-stealing malware, which harvest credentials from crypto wallets, social media and online bank accounts.
Attacks on the supply chain
Attacks on the supply chain are known to target particularly reliable suppliers offering software or services. These attacks inject malicious code to infect every user of the service or application.
Owners of Magento shops using the popular FishPig extension recently fell victim to a supply chain attack that compromised their software repositories. The hackers exploited this attack to infect the targeted systems with the Rekoobe Linux remote access Trojan.
The attack is estimated to have taken place on or before 19 August this year. Any online shop that installed the FishPig plugins between August and 13 September may have been affected.
However, supply chain attacks such as this are not limited to the Magento CMS. Earlier this year, following a large-scale supply chain attack, 93 WordPress plugins and themes were found to contain a malicious backdoor, which gave cybercriminals full access to the websites.
Of the four techniques used to inject malicious code, three are carried out via supply chains. And since most modern websites use third-party APIs, open-source or proprietary code, or maintain other third-party dependencies, they too can be affected by such supply-chain attacks.
Software vulnerabilities
Attackers are always on the lookout for vulnerable websites that use outdated plugins, themes or other software. As our annual hacking report reveals, software vulnerabilities are one of the leading causes of infections. Hackers use automated scripts to search the internet for unpatched websites and then launch targeted attacks against their victims.
Let’s take a look at some of the vulnerabilities that online shops are most likely to face during this year’s festive season.
WordPress and WooCommerce
More than 25 per cent of online shops use WooCommerce, meaning this user-friendly solution has a significantly larger market share than other popular e-commerce platforms, such as Magento (8 per cent) or Shopify (19 per cent).
Online shop owners can find a wealth of WooCommerce plugins to enhance the shopping experience. However, every single plugin installed on the system increases the potential attack surface if it is not patched.
Some common types of vulnerabilities affecting WordPress plugins are as follows:
- Cross-site scripting (XSS)
- PHP object injection
- Delete file
- Cross-site request forgery
- Exposure of sensitive data
Developers regularly release updates to fix known vulnerabilities in plugins. However, if system administrators or web developers do not apply these promptly, the result can be an infection. This is precisely why patching software with the latest updates is critical for minimising risks.
Magento
On 11 October, Adobe released a security update for the Magento 2 e-commerce platform.
The latest update fixed a total of two vulnerabilities, including a critical cross-site scripting vulnerability (CVE-2022-35698). Exploitation of this XSS vulnerability does not require user interaction. Exploitation could result in arbitrary code execution, with a CVSS base score of 10.0.
It's Magento patch time. Critical vulnerability (CVSS 10) I reported patched in the last version - please patch your version as soon as possible! The vulnerability isn't that hard to exploit!https://t.co/nzK2dH3rpp
— Blaklis (@Blaklis_) October 12, 2022
This critical XXS vulnerability affects the following versions of Magento Open Source and Adobe Commerce:
- 2.4.4
- 2.4.5
- 2.4.4-p1
- 2.4.3-p2
- 2.4.3-p3
The latest update also fixed a medium-severity vulnerability caused by an incorrect access control issue (CVE-2022-35689). If exploited, attacks could take advantage of this vulnerability and affect the availability of a function.
Administrators of Magento e-commerce websites must update their software immediately. Updating the software to the latest version is the most effective way to minimise the risk of such security threats.
Fake DDoS checker sites
WAF and CDN services regularly offer DDoS protection features that perform browser checks to determine whether traffic originates from a legitimate visitor to a website or from a DDoS attack.
Since August, however, there has been a surge in the number of JavaScript injections targeting WordPress websites, which serve fake CloudFlare DDoS requests designed to trick victims into downloading remote access Trojans.
How to protect your e-commerce website
More customers than ever before are shopping online from the comfort of their own homes. Protecting users against e-commerce malware is essential for maintaining the trustworthiness of your online shop and ensuring PCI compliance.
Here are six steps you can take to protect your e-commerce website from security threats during the festive shopping season:
- Make sure to update your website’s software, plugins, themes and other components regularly.
- Use strong passwords for all your FTP, database and login credentials.
- Monitor and analyse your website and server logs for signs of compromise.
- Use a web application firewall (WAF) to virtually patch known vulnerabilities and block brute-force attacks.
- Avoid downloading or installing software from unofficial sources.
- Use multi-factor authentication or restrict access to the admin pages to add further layers of security.