Shopping online is generally safe, but under the surface, there’s a war going on to keep payment card data secure as cybercriminals use malicious script injections to steal sensitive information from customers visiting and buying in your online store.
Millions of people shop online every day using payment cards. The COVID-19 pandemic accelerated E-commerce growth, particularly in companies and areas where an online transactional presence was not a priority.
Online Credit Card Theft: The Evolution in Where Criminals Attack
When criminals first realized they could steal cardholder data to make fraudulent transactions, they focused on stealing data from internet-connected point-of-sale (POS) systems.
The industry responded by creating the Payment Card Industry (PCI) Data Security Standard (DSS), which outlined the security measures needed to protect payment card data from criminals.
As merchants implemented measures to protect their POS systems from internet attacks, criminals shifted to attacking locations where cardholder data was stored or consolidated. Over time, companies removed legacy data stores and adopted the technical controls specified in PCI DSS to protect the locations where they stored, processed, or transmitted payment card data, making life harder for criminals.
The war between criminals and the payment industry has continued ever since. As security architecture and industry standards evolved, criminals found new ways to attack. In e-commerce, criminals have moved from attacking a merchant’s own e-commerce infrastructure to skimming payment card data from the consumer’s browser.
This is because they either found the merchant well protected (the general standard of cybersecurity has changed massively in the past ten years) or because the e-commerce merchant, like brick-and-mortar retailers before them, had decided that there’s no value in touching payment card data, and so a cardholder’s details are sent straight from the customer’s own browser to the payment processor, bypassing the merchant’s own systems.
This leaves the only remaining attack surface as the consumer’s browser. The criminals aim to capture cardholder data as it is entered into the merchant’s checkout page.
Users’ Data is at Risk when Browsers Store Sensitive Information Inadequately
Such attacks are invisible to both the cardholder and the merchant; the transaction happens as expected: the merchant gets the funds, the customer receives the goods or services they ordered, and the criminals get the customer’s payment card data.
When these attacks first happened, they made the news. You may remember Newegg, Macy’s, Ticketmaster, and British Airways, or you may have been notified that your cardholder data was stolen.
Just because these attacks are no longer newsworthy doesn’t mean they aren’t happening; these so-called e-commerce skimming attacks make up the majority of attacks on payment card data.
The criminals’ methodology
Most webpages today mix words, images, video, layout information, and, crucially, a scripting language called JavaScript.
JavaScript is what has enabled the web to evolve from its initial incarnation as an information-centric, display-only medium to the interactive experience we enjoy today.
While JavaScript lets websites function like interactive applications, it also lets that interactivity be malicious. So to skim data from the consumer’s web browser, a criminal only needs to get the consumer’s browser to load and execute their own malicious JavaScript.
Once the criminal’s JavaScript runs on a webpage, it can access everything the consumer enters, read payment card data from form fields, and silently send it to a criminal server anywhere on the internet.
You may then be wondering how the criminal does this by loading their JavaScript into the consumer’s browser alongside all the legitimate content and components that make up the merchant’s website.
All the criminal needs to do is tamper with any legitimate JavaScript the browser will load and add their malicious payload. They can do this in two ways:
- By attacking the merchant’s infrastructure.
- By compromising any one of the third parties that the merchant relies on to provide JavaScript to the consumer browser.
Jscrambler found that a merchant’s website contains 148 scripts, and 58% of them are supplied by third-party companies. This reflects how modern websites are built, and while that’s great for functionality, it creates many attack surfaces for criminals.
A criminal just needs to compromise one of these locations and add a malicious payload to the JavaScript, which the browser loads for the target merchant’s customer. To prevent these attacks, use tools such as Webpage Integrity by Jscrambler.
The Power of Standards to Prevent Payment Card Data Theft
Although some merchants have figured out how best to defend against these attacks, many others remain unaware.
Fortunately, the payment card industry has a well-respected security standard that serves as a contractual baseline for anyone who wants to accept payment cards: the Payment Card Industry (PCI) Data Security Standard (DSS). First released in 2006, the standard is revised every few years to account for changes in technology and how criminals attack.
The newest iteration, version 4, was released in March 2022 and will become applicable in 2024. In this new version, the PCI SSC has added two requirements to help stop the rise in skimming attacks and give merchants the tools they need to win the battle against criminals.
Each time the industry adopts a new version of the standard and its requirements, the class of criminal attacks is significantly reduced. We hope this trajectory continues!
The first new requirement aims to reduce the number of places that a criminal could attack to add their malicious scripts. It does this by requiring merchants to authorize and limit the number of individual scripts loaded on payment pages, with this information recorded in an inventory.
The second requirement is detective rather than preventative and aims to alert merchants when new or changed scripts appear on the page where consumers enter cardholder data, allowing merchants to validate the integrity of the new or changed script.
As merchants worldwide transition to the new version of PCI DSS and implement these two new requirements, the advantage in the battle against criminals will shift in their favor.
Jscrambler’s free tool helps Merchants achieve compliance with PCI DSS v4.0 requirements 6.4.3 and 11.6.1, and QSAs can validate compliance.
