Research Reveals eCommerce Retailers Experiencing Active Security Leaks Heading into Holiday Shopping Season

SAN FRANCISCO, Aug. 28, 2019 /PRNewswire/ -- Arxan Technologies, the trusted provider of application protection solutions, is calling on eCommerce retailers to close security holes in their web applications after research conducted by Aite Group uncovered more than 80 global eCommerce sites were actively being compromised by Magecart groups. Arxan commissioned the research report In Plain Sight II: On the Trail of Magecart, to examine tactics and techniques used by Magecart to compromise servers.

In 2018, Magecart groups made headlines as the threat actors responsible for high-profile mega-breaches of global brands including Ticketmaster, Forbes, British Airways, Newegg and more. "Magecart" is an umbrella term given to multiple threat groups that use credit card skimming technology to infect eCommerce platforms and websites with the goal of stealing personal and financial information — without being detected for months or even years at a time. Virtual credit card skimmers, also known as formjacking, are inserted into a web application, often the shopping cart, and are used to steal credit cards to sell on the black market and for shipping scams to traffic goods purchased with stolen cards.

"Once again we're disappointed in what the research uncovered: the systemic lack of web-app protection being used by eCommerce websites and the inability of network and endpoint security solutions to completely protect consumers against this pervasive threat," says Aaron Lint, Chief Scientist and VP of Research, Arxan. "The push toward a modern user experience creates a lucrative attack surface inside the web content delivered via browser and mobile. Any interface which takes user input becomes a target for exfiltration. Additionally, the widespread use of third-party components has created a supply chain where an attacker can easily compromise thousands of sites with a mere few lines of code."

As organizations continue to rely on revenue from eCommerce – estimates project the global market to hit more than $3.5 trillion in 2019¹ – the potential financial impact of Magecart is dire. The fallout from digital skimming breaches in 2018 cost organizations hundreds of millions of dollars in government penalties alone. Making matters worse, an estimated 20 percent of websites hit by Magecart become reinfected within five days of remediating the original problem². It's a bleak picture for an industry about to embark on the busiest shopping season of the year.

"The threat of formjacking is a widespread and growing problem. Because so many web applications are lacking in-app protection, adversaries are able to easily debug and read a web app's JavaScript or HTML5 in plain text. Once the web app code is understood, malicious Javascript is then inserted into the web pages of target servers that delivers the web checkout form. Once weaponized, these credential pages will simultaneously send a consumer's credit card information to an off-site server under the control of the Magecart group while also allowing the compromised site to process the credit card so the consumer and the organization is unaware of the theft," says Alissa Knight, cybersecurity analyst for Aite Group and author of the In Plain Sight series of research. "It's important to adopt solutions that implement multiple layers of security, not just obfuscation, such as detection of code tampering and analysis, active response that shuts a browser down upon detection of formjacking, along with threat detection and real-time alerting and response." 

To conduct this research, Ms. Knight used a source code search engine that scoured the web for obfuscated JavaScript that she found in repeating patterns of previously published Magecart breaches. Just 2.5 hours of initial research led to the discovery of over 80 compromised eCommerce sites globally that were actively sending credit card numbers to off-site servers under the control of the Magecart groups. The research showed that:

• The most common similarity across the 80 sites was the use of Magento, all of which are running old versions that are vulnerable to an unauthenticated upload and remote code execution vulnerability that has published exploits available for it;
• 100 percent of the 80 sites discovered had no in-app protection implemented, such as tamper detection and code obfuscation; and,
• 25 percent of the sites discovered were large, reputable brands in the motorsports industry and luxury apparel.

To combat this growing threat, here are some steps that retailers and eCommerce organizations can take to protect their customers:

1. Update or patch eCommerce platforms to the latest version
2. Audit web code to ensure websites, including any third party apps, have not been compromised
3. Implement a security solution that can provide alerts when suspicious activity targets web application code

To download the full research report, please visit: https://www.arxan.com/resources/download/plain-sight-trail-magecart   

The report outlines: who the Magecart groups are, the tactics and techniques these groups use to compromise sites, how stolen credit cards are sold on the dark web, and how in-app protection that employs both code obfuscation and tamper detection can be used to defend against this type of threat.

EDITOR'S NOTE: Eighty compromised servers were analyzed as part of this research for companies in the United States, Canada, Europe, Latin America and Asia. Due to the discovery of actively compromised sites and servers, all affected organizations have been officially notified in cooperation with the FBI's cyber division prior to the publishing of this report. 

About Arxan Technologies 
Arxan, a global trusted leader providing the industry's most comprehensive application protection solutions, works with organizations looking to protect applications and to securely deploy and manage business-critical apps to the extended enterprise. Arxan currently protects more than one billion application instances across many industries including financial services, mobile payments, medical devices, automotive, gaming, and entertainment. Unlike legacy security solutions that rely on perimeter-based barriers to keep bad actors out or that require device management controls, Arxan products protect at the application-level from the inside out. This approach protects the source and binary code to expand the corporate perimeter of trust to the new endpoint – the application. Arxan provides a broad range of patented security capabilities such as a dynamic app policy engine, code hardening, obfuscation, white-box cryptography and encryption, threat analytics and rapid app protection deployment designed for DevOps processes. Founded in 2001, Arxan is headquartered in North America with global offices in EMEA and APAC. For more information, please visit our website or follow us on Twitter. 

About Aite Group 
Aite Group is a global research and advisory firm delivering comprehensive, actionable advice on business, technology, and regulatory issues and their impact on the financial services industry. With expertise in banking, payments, insurance, wealth management, and the capital markets, we guide financial institutions, technology providers, and consulting firms worldwide. We partner with our clients, revealing their blind spots and delivering insights to make their businesses smarter and stronger. Visit us on the web and connect with us on Twitter and LinkedIn. 

¹ https://www.emarketer.com/content/global-ecommerce-2019
² https://www.zdnet.com/article/one-in-five-magecart-infected-stores-get-reinfected-within-days/

SOURCE Arxan

Related Links

https://www.arxan.com/