Research conducted by Aite Group has uncovered more than 80 global eCommerce sites were actively being compromised by Magecart groups. Arxan commissioned the security research to examine tactics and techniques used by Magecart to compromise servers.
“Magecart” is an umbrella term given to multiple threat groups that use credit card skimming technology to infect eCommerce platforms. Its goal, to steal personal and financial information — without being detected for months or even years at a time.
In 2018, Magecart groups made headlines as the threat actors responsible for high-profile mega-breaches of global brands. This included companies such as Ticketmaster, Forbes, British Airways, Newegg and more. Virtual credit card skimmers, also known as formjacking, are inserted into a web application, often the shopping cart. They are used to steal credit cards to sell on the black market and for shipping scams to traffic goods purchased with stolen cards.
Lack of protection
According to Aaron Lint, Chief Scientist and VP of Research, Arxan: “Once again we’re disappointed in what the research uncovered. The systemic lack of web-app protection being used by eCommerce websites. Furthermore, the inability of network and endpoint security solutions to completely protect consumers against this pervasive threat.
“The push towards modern user experience creates a lucrative attack surface inside the web content delivered via browser and mobile. Any interface which takes user input becomes a target for exfiltration. Additionally, the widespread use of third-party components has created a supply chain. An attacker can easily compromise thousands of sites with a mere few lines of code.”
As business continue to rely on revenue from eCommerce the potential financial impact of Magecart is dire. The global Ecommerce market is estimated to reach more than $3.5 trillion in 2019. The fallout from digital skimming breaches in 2018 cost organisations hundreds of millions of dollars in government penalties alone. Moreover, an estimated 20 percent of websites hit by Magecart become reinfected within five days of remediating the original problem. It’s a bleak picture for an industry about to embark on the busiest shopping season of the year.
The threat of formjacking
The threat of formjacking is a widespread and growing problem. The lack of in-app protection for web applications allows adversaries to easily debug and read a web app’s JavaScript or HTML5 in plain text. Once the web app code is understood, malicious Javascript is then inserted into the web pages of target servers that delivers the web checkout form. Once weaponised, these credential pages will simultaneously send a consumer’s credit card information to an off-site server under the control of the Magecart group while also allowing the compromised site to process the credit card so the consumer and the organisation is unaware of the theft.
“It’s important to adopt solutions that implement multiple layers of security”, says Alissa Knight, cybersecurity analyst for Aite Group. Knight was also author of the In Plain Sight series of research. “Not just obfuscation, such as detection of code tampering and analysis. Business need to provide active response that shuts a browser down upon detection of formjacking. Along with threat detection and real-time alerting and response.”
To conduct this research, Knight used a source code search engine. The search engine scoured the web for obfuscated JavaScript that she found in repeating patterns of previously published Magecart breaches. Just 2.5 hours of initial research led to the discovery of over 80 compromised eCommerce sites globally. These sites were actively sending credit card numbers to off-site servers under the control of the Magecart groups.
The research:
The most common similarity across the 80 sites was the use of Magento. All were running old versions vulnerable to an unauthenticated upload. Platforms are also vulnerable to any remote code execution vulnerability that has published exploits available for it. In addition:
- 100 percent of the 80 sites discovered had no in-app protection implemented, such as tamper detection and code obfuscation.
- 25 percent of the sites discovered were large, reputable brands in the motorsports industry and luxury apparel.
Arxan Technologies, a protection solutions application provider, is calling on eCommerce retailers to close security holes in their web applications. To combat this threat, the company has suggested steps that retailers and eCommerce organisations can take to protect their customers:
- Update or patch eCommerce platforms to the latest version
- Audit web code to ensure websites, including any third party apps, have not been compromised.
- Implement a security solution that can provide alerts when suspicious activity targets web application code
Enterprise Times: What this means for business?
This is a seriously worrying report for the CIO or CEO of any organisation. The research conducted by Aite Group revealed that 100% of the eCommerce websites examined were not protected. This makes them easy prey for Magecart attacks. Even more startling is the fact that it took only 2.5 hours of research to uncover the 80 compromised sites. The breaches that impacted British Airways, Ticketmaster and Forbes seem like any other cyberattack. A bad actor finds a security hole and exploits it.
The typical eCommerce eco-system requires the widespread use of third party tools and platforms. Attackers are using ‘trojan horses’ to easily compromise sites, with just a few lines of code. As a result, Magecart-style attacks continue to succeed in breaching the websites of global companies without being detected.
These attacks are costing millions of dollars in fraudulent credit card charges and government penalties. Corporate security specialists must sit-up, take notice of this report and take the appropriate actions to prevent these fraudulent attacks.