To prevent Magecart attacks means stopping cyberattacks that steal credit card data by skimming online payment forms.
After gaining mainstream media attention over the last year or so, their most recent high-profile attack targeted photography retailer Focus Camera.
Focus Camera: Magecart Attack Examples
Their website got hacked by Magecart attackers who injected malicious code that stole customer payment card details. The script loaded at checkout captured billing information and sent it to the attacker’s server.
Focus Camera just added their name to the growing list of well-known organizations that have fallen victim to similar attacks (British Airways, Newegg, Macy’s) during the last year, with hundreds of thousands of customers typically having their card details stolen.
The Magecart credit card skimming approach often involves inserting malicious skimmer code into a target’s third-party providers (also known as web-based supply chain attacks).
Attacks on British Airways, Equifax, Forbes, and thousands of others were achieved by injecting malicious code into company websites through third parties and running it in users’ browsers. In this way, a company’s website or web app has become the perfect stage for stealing customer data.
And let us not forget the huge financial downside for those companies.
After the attack on British Airways, for example, the Information Commissioner’s Office (responsible for upholding the UK’s information rights in the public interest) announced it would fine British Airways (BA) £183.39 million for GDPR breaches. While BA offered to reimburse customers who suffered financial loss as a result of the breach, it never admitted liability.
Reputational damage from such a high-profile attack is difficult to calculate, and there are signs of ambulance-chasing outfits seeking to reimburse affected individuals, a kind of PPI-style payout scenario. The stakes are very high.
- What can organizations do in the face of such large-scale attacks with such far-reaching consequences?
- How to prevent Magecart attacks?
Uncover your security blind spots
If you serve customers through any e-commerce platform or website, are you sure the content your customers receive is what you expect them to receive?
Is the website your potential customers are interacting with a bona fide site, or has it already been tampered with by hackers? Typically, neither business owners nor security teams can answer this question with certainty.
Decades of focus on server-side security have left almost everything that happens on the client side (i.e., the browser and the environment where Magecart attacks operate) largely unnoticed.
Enough postmortem analyses of Magecart attacks have been done, and we now understand there’s no guaranteed way to prevent these attacks altogether.
We can, however, shift our attention to what is happening on the client-side. If organizations still can’t clearly answer the question “What code are my users receiving when they visit my checkout page?”, then they have a massive client-side security gap where Magecart thrives.
Understand and fill the client-side security gap
Not all Magecart groups use the same strategies to breach e-commerce websites.
Some opt for a first-party breach, either by directly compromising the first-party server or indirectly by infecting code that is later pulled into the build process, but most pursue third-party attacks, which are considered the weakest link.
This weak link often refers to scripts companies run on their websites, such as live chat, widgets, analytics, or other utilities, and companies that use them have zero control over their security. Because the attack originates from a trusted, legitimate third-party supplier, this malicious code easily bypasses firewalls.
The enterprise should vet third-party code and its suppliers’ security (or lack thereof). However, this often takes a back seat to product development. The job ultimately falls to the client-side security systems in place; often, none seem able to prevent Magecart.
Magecart attacks are becoming more sophisticated.
Recent versions of Magecart use bot-detection techniques to evade some security solutions, making it even harder to stop the skimmer in its tracks. It makes sense that how we address these attacks will evolve similarly.
Protect against future attacks
What can be done to mitigate such Magecart-style attacks?
With an evolving security mindset, instead of looking for a solution that prevents unpreventable malicious code injections, the enterprise should focus on detecting these injections and quickly blocking Magecart attacks.
Third-party management
Third-party management and validation are a good start, but not enough.
Vetted scripts can change behavior, so only trust them if they don’t change. A live chat script has no business touching the payment form. A script that never sends information out should never be able to send data to an unvetted domain.
Beyond vetting the code, restricting these behaviors is a key part of a defense-in-depth strategy.
Defense strategy
And this is where organizations are failing.
Some Magecart attacks have remained undetected for longer than six months, and, as we learned from the British Airways breach, it only took (allegedly) 15 days to steal the credit card details of over 380,000 customers.
This makes it clear that organizations don’t really know when a malicious skimmer is running on their websites. So this is the issue that should be addressed most urgently: when a Magecart skimmer finds its way into a company’s website, the company must be able to detect it instantly, block the code, and keep its users safe.
To do this, organizations should implement a web page monitoring solution to gain real-time visibility into malicious code and pave the way for automated Magecart mitigation.
The ongoing wave of Magecart attacks shows how unprepared e-commerce businesses are from a security standpoint.
Timing is key.
If e-commerce businesses can detect Magecart in seconds, we are looking at a decade where Magecart’s headline-making days are numbered.
This article was originally published on The Next Web.
Learn more about Web Supply Chain Attacks like Magecart with our free white paper.
