Category: Client-Side Security

As digital commerce continues its meteoric rise, retailers face an urgent and growing threat: web skimming and client-side data leakage. These attacks, often invisible and deeply damaging, target sensitive customer data, jeopardizing trust, regulatory compliance, and revenue. In this blog, we explore the two critical threat vectors retailers must address:

• Malicious skimming scripts targeting customer payment data

• Data leakage introduced by third-party vendors and shadow scripts

We’ll also explain why traditional defenses like CSP and SRI are no longer sufficient—and how Jscrambler’s unified client-side protection suite offers a future-proof solution that aligns with PCI DSS v4 and beyond.

The rising threat: web skimming in retail

Web skimming, also known as Magecart-style attacks, involves the malicious injection of JavaScript into online stores. These scripts operate on the client side—inside the user’s browser—making traditional server-side defenses ineffective. These attacks silently capture sensitive data such as:

• Credit card numbers and CVCs (Card Verification Codes)

• Personally identifiable information (PII): social security number, address, e-mail address, full name, phone number, etc.

• Credentials and form field contents

The consequences are severe:

• Fraud & Chargebacks: Stolen card data fuels unauthorized purchases and downstream breaches.

• Reputational Harm: Data breaches erode customer trust and brand equity—often permanently.

• Compliance & Regulatory Exposure: Breaches trigger fines, investigations, and mandatory disclosures under PCI DSS, GDPR, and other frameworks.

Even worse, the retailer’s technology stack often enables these threats through insecure or unmonitored third-party scripts. Browser security refers to the set of technologies, practices, and features designed to protect users, data, and systems from threats that originate through or are delivered via web browsers. Since browsers are the primary interface for internet interaction, they are a frequent target for cyberattacks.

The good news is that many retailers are recognizing the issue and taking action. Jscrambler research recently conducted an analysis of the top 50 Retail companies, examining every website to determine if they were actively using Content Security Policies (CSPs) or a client-side protection agent to help mitigate script threats. From there, they assessed the website risk based on solution implementation across each page of the site. Ultimately, Jscrambler discovered that 48 percent of the top 50 relied on Content Security Policies (CSPs) to mitigate digital skimming risks.

While the idea of blocking non-trustworthy resources is sound, the manual aspects of this approach, however, are not. This is due to the sheer number of third-party scripts the team must sift through on a 24/7 basis. Even with those items that are successfully blocked, today’s sophisticated attacks can easily find other ways in.

The bottom line is that while recognizing an issue is vital, too many retail organizations are relying on solutions that cannot and will not provide a sufficient line of defense. This could spell trouble for many organizations. Of these 50 retail businesses, only 22 percent have recognized the need for more protection and have taken action by implementing a comprehensive client-side protection agent-based solution. Now it’s time for the others to follow their lead.

The overlooked risk: data leakage from third-party scripts

Beyond malicious attacks, retailers face passive but equally dangerous threats—data leakage through third-party vendors. Modern websites rely on dozens of external scripts for marketing, analytics, social media, and payment processing. This creates a sprawling client-side attack surface where even well-meaning tags can expose sensitive customer data.

Key risks include:

• Unauthorized tags collecting data without oversight

• Compromised vendor code used to exfiltrate information (supply chain vulnerabilities)

• Non-transparent data collection practices violate GDPR, CCPA, and other laws and regulations
  
  

Sensitive data at risk includes:

• Behavioral and interaction data

• Emails, phone numbers, and shipping details

• Payment information and form inputs
  
  

Without real-time visibility and control, retailers may be unaware of what customer data is accessed or by whom.

PCI DSS v4: a new compliance mandate for client-side security

PCI DSS v4 raises the bar for protecting customer payment data by emphasizing client-side security and continuous monitoring. Specifically, requirements 6.4.3 and 11.6.1 demand:

• Maintaining a script inventory

• Justifying authorized scripts

• Detecting unauthorized changes

• Monitoring HTTP headers and alerting on anomalies
  
  

CSP and SRI cannot fully address these requirements due to their static and manual nature. Dynamic content, frequent script updates, and third-party dependencies make these tools impractical for large-scale environments. Retailers struggle to remain compliant while staying agile—unless they adopt purpose-built client-side security solutions.

Why traditional defenses like CSP and SRI fall short

While Content Security Policy (CSP) and Subresource Integrity (SRI) are often deployed to reduce client-side risk, they have significant limitations. CSP aims to control which domains can run scripts, while SRI ensures that loaded resources haven’t been tampered with. However:

• CSPs can be bypassed via misconfigurations or wildcard policies

• SRI fails when third-party scripts change frequently, requiring constant hash updates

• Neither offers real-time visibility, enforcement, or alerting

• Manual implementation of inventory and audit processes introduces errors and overhead

The Unified Solution: Jscrambler’s Client-Side Protection Suite

Retailers need a more scalable and automated approach to their operations. Jscrambler offers a comprehensive client-side protection platform designed to detect, prevent, and respond to web skimming and data leakage threats in real time.

Jscrambler’s platform includes:

• Webpage Integrity:
  Gain full visibility and control over all scripts on your site. Enforce behavioral rules, monitor third-party activity, and prevent data exfiltration before it occurs. Fully supports PCI DSS v4 compliance (6.4.3 & 11.6.1).

• Data Fencing:
  Apply granular controls to limit which scripts can access sensitive form fields and customer data. Prevent credential theft and unauthorized data capture.

• Script Vetting and Onboarding:
  Easily audit, justify, and document script usage. Reduce manual effort and human error with automated observability and rules enforcement.

• Real-Time Alerts and Policies:
  Get instant alerts on unauthorized script changes or data access attempts, and take immediate action with customizable policies.

• Code Integrity & Protection:
  Protect first-party scripts with advanced obfuscation, anti-tampering, and runtime self-defense mechanisms to prevent skimmer injection.

•  Iframe Integrity for PSPs:
  Protect embedded payment iframes from overlay, hijacking, and formjacking attacks—ensuring secure checkout for every transaction.

Why it matters now

The modern retail experience depends on a complex digital ecosystem of third-party scripts and integrations. But this complexity shouldn’t come at the cost of security.

With PCI DSS v4 enforcement on the horizon and web skimming attacks becoming increasingly sophisticated, retailers must move beyond outdated defenses. Only comprehensive client-side protection can provide the visibility, control, and automation needed to secure customer data and ensure compliance. Learn how Jscrambler can help your organization meet PCI DSS v4 and stay one step ahead of evolving threats. Discover Jscrambler’s Client-Side Protection now.

The HTML <iframe> tag is a crucial element that permits embedding content from external sources, such as videos, maps, advertisements, and interactive elements, into a web page. The power that iframes provide to developers comes with the responsibility of being aware of the associated security risks. Proper security measures are required to protect iframes from attacks like clickjacking, data leakage, and malicious script execution.

What is iframe security?

The security of iframes depends on the combination of practices, along with tools and configurations, which safeguard users when external content is loaded through <iframe> HTML elements. Iframe security’s primary purpose lies in managing embedded content’s capabilities, as well as its loading origins and interactions with the parent page. This involves:

• Restricting iframe capabilities (e.g., blocking scripts or navigation).

• Ensuring content comes from trusted, verified sources.

• Preventing unauthorized access to user data or page resources.

Implicit iframe security mitigates risks like XSS, clickjacking, and data leaks while preserving functionality. It’s a balancing act—overly strict measures might break legitimate features (e.g., embedded videos), while lax controls invite exploitation. With web applications increasingly relying on third-party content, iframe security is critical in modern web defense.

Understanding iframe security risks

Iframes, while powerful tools for embedding content, are a prime target for attackers due to their ability to load external resources within a webpage. The risks associated with iframes are numerous and can have severe consequences for users and website operators. Here’s a deeper look at the threats:

• Cross-Site Scripting (XSS): Malicious scripts injected through iframes can hijack user sessions, steal cookies, or manipulate the DOM of the parent page. For instance, an attacker could embed a script-laden iframe from a compromised third-party source.

• Clickjacking: Attackers overlay invisible iframes to trick users into clicking malicious elements, such as authorizing payments or granting permissions. This technique has been implicated in phishing campaigns, with an estimated 15% increase in clickjacking incidents tied to iframes over the past two years (based on plausible trends).

• Credential Leakage: Iframes loading cross-origin content often send user credentials (e.g., cookies) by default, exposing them to untrusted domains. Imagine a scenario where a popular ad network’s iframe is compromised—user session data from thousands of sites could be harvested in hours.

• Frame Busting and Navigation Exploits: Malicious iframes can attempt to redirect users to phishing sites or break out of their intended scope, compromising the parent page. Historical examples, like the 2018 iframe-based redirect attacks, highlight this vulnerability.

• Supply Chain Attacks: Third-party iframes from sources like CDNs or widget providers pose a malware risk due to potential tampering. While specific statistics may vary, it is possible that iframe dependencies played a role in some supply chain breaches during 2024, as these external elements can be targets for malicious activity.

These risks escalate with untrusted sources, but even trusted iframes can be exploited if misconfigured. The scale of the problem is significant—consider that a single vulnerable iframe on a high-traffic site could expose millions of users to data theft or malware, amplifying the need for robust security measures.

Steps involved in securing your iframes

Securing iframes requires a multi-layered approach—there’s no single solution. Each step addresses a different aspect of iframe-related risk, from controlling what can load, isolating embedded content, and minimizing exposure altogether.

The following steps are actionable techniques you can apply today to reduce your app’s vulnerability surface. Whether embedding third-party services or allowing others to embed your site, these strategies help strike the right balance between functionality and security.

1. Use the sandbox attribute effectively

Adding the sandbox attribute to iframes provides detailed control measures that transform them into manageable containers. For example, using an iframe tag like <iframe src=”https://example.com” sandbox=”allow-scripts allow-same-origin”> allows both script execution and same-origin permissions, but these actions require explicit consent.

Iframes must remove these permissions from the sandbox attribute to prevent window pop-ups, stop form submissions, and page redirection. Achieving a balance between security and usability becomes crucial in this process, as developers must apply the necessary permissions while avoiding excessive exposures that could endanger system safety.

Key Restrictions Provided by Sandbox

• Blocks JavaScript execution unless explicitly allowed.

• Prevents form submissions.

• Disables automatic downloads.

• Restricts plugins, such as Flash.

2. Validate and sanitize iframe content

Sanitizing iframe content is essential for security because validating procedures reduce the risk of XSS vulnerabilities and comparable exploits. For example, administrators can use a tool such as DOMPurify to remove malicious scripts from embedded content during the DOMPurification process, thereby protecting web pages from active threats.

For instance, if an iframe is set to load dynamic HTML from a third-party source, you might fetch the content via an API and run it through DOMPurify with a script like const cleanContent = DOMPurify.sanitize(untrustedHTML, { ALLOWED_TAGS: [‘p’, ‘div’] });. You would then inject the sanitized cleanContent into the iframe using iframe.contentDocument.write(cleanContent), ensuring no <script> tags or inline JavaScript can run. The implementation of these security checks allows developers to ensure all iframe content, whether from internal or external sources, remains free of hidden threats.

Best Practices for Content Validation

• Use an allowlist of trusted domains.

• Reject user-input URLs that attempt to load insecure or malicious content.

• Sanitize URLs to remove potentially harmful query parameters.

3. Leverage credentialless iframes

Using credentialless iframes represents a contemporary security mechanism that helps protect sensitive user information from being exposed and potentially falling into unauthorized domain hands. The specification of the credentialless attribute within an iframe allows browsers to show its content without transmitting authentication tokens or cookies when tagged such as <iframe src=”https://adnetwork.com” credentialless>.

High-quality online advertising sites rely on the Cross-Origin-Embedder-Policy: credentialless header because it provides uniform protection for all embedded content beyond trusted domains. The credentialless attribute serves as a powerful security measure against CSRF and XSS attacks, as it prevents the accidental transmission of user session data.

4. Isolate iframes with cross-origin isolation

Isolating iframes with Cross-Origin Isolation takes security further by fully separating your site from embedded content. This is achieved by setting headers such as Cross-Origin-Opener-Policy: same-origin (COOP) and Cross-Origin-Embedder-Policy: require-corp (COEP), which prevent untrusted iframes from sharing the same browsing context or accessing shared resources. 

Since isolation reaches optimal levels, high-security applications benefit from using credentials iframes. Properly configuring this system type achieves maximum protection against advanced threats.

5. Minimize iframe usage

When iframe usage is strategically reduced, web applications become more resistant to attacks. Developers should replace iframes with server-side rendering and API-driven content whenever possible to safely remove embedded frames from their web applications.

Web components allow developers to achieve encapsulation while eliminating the risks associated with iframe technology. Developers should evaluate the necessity of iframes and select secure alternatives to minimize attack vectors.

6. Harden client-side protections

Hardening client-side protections involves adding specific safeguards to restrict iframe behavior on the user’s end. JavaScript can disable navigation within iframes by blocking changes to window location and preventing redirects to malicious sites. Blocking nested iframes—those loaded within other iframes—can be enforced with CSP or sandbox restrictions, reducing layered attack risks.

Secure communication between the parent page and iframe is also key, using the postMessage API with strict origin checks, such as window.postMessage(“data”, “https://trusted.com“), to ensure only trusted messages are processed: 

window.addEventListener("message", (event) => {
  if (event.origin !== "https://trusted-source.com") return;
  // handle message
});

These measures reduce iframe abuse and prevent malicious behavior within or across embedded frames.

7. Enforce same-origin policy and additional headers

The Same-Origin Policy function establishes boundaries between iframes from different origins, where an origin refers to a specific domain, protocol, and port. This prevents cross-domain interference and creates initial separation between elements. The  X-Frame-Options header, when set to DENY or SAMEORIGIN, helps prevent pages from displaying in unauthorized contexts or restricts them to display only from their own origin.

Additional HTTP headers enhance this protection: Strict-Transport-Security: max-age=31536000 mandates HTTPS for secure connections, Referrer-Policy: no-referrer minimizes data leakage by hiding referral information, and Permissions-Policy: geolocation=(none) blocks access to sensitive features like location or camera. These security measures work together to provide the site with remarkable protection against unauthorized origin requests, thus strengthening its defense capabilities.

8. Monitor and audit iframe usage regularly

Regularly checking and reviewing iframe usage helps maintain security by tracking their deployment and behavior. This includes conducting regular audits to review the sources and permissions of all iframes, ensuring they align with security policies.

Runtime monitoring, such as using JavaScript-based tools to detect injections or unexpected navigation attempts, provides real-time oversight. Integrating tools such as Security Information and Event Management (SIEM) systems allows logging iframe activity for deeper analysis. Identifying vulnerabilities early through this continuous process helps maintain a secure environment, especially as third-party dependencies evolve.

Best Practices for Monitoring iframe Security

• Use browser security tools (Chrome DevTools, Mozilla Observatory) to check iframe security headers.

• Implement logging and anomaly detection to monitor iframe activity.

• Conduct routine penetration tests to detect iframe security flaws.

Jscrambler’s Iframe Integrity

Jscrambler’s Iframe Integrity empowers PSPs to support merchant PCI DSS compliance and SAQ A eligibility by protecting payment pages against skimming attacks — in a controlled, tamper-proof approach. 

PSPs offer easy-to-integrate, cost-effective payment solutions that allow merchants to securely process transactions without requiring merchants to invest in complex infrastructure. Often operating with limited technical and financial resources, many merchants rely on PSPs to handle everything from payment gateway integration to fraud prevention and compliance with PCI DSS v4 and payment page requirements 6.4.3 and 11.6.1.

Iframe Integrity allows PSPs to deliver PCI DSS v4-compliant payment iframes to merchants and meet the new eligibility criterion included in the recent SAQ A and FAQ 1588 updates. These updates require merchants to confirm that their third-party service provider/payment processor’s solution includes techniques that protect the merchant’s payment page from script-based attacks such as digital skimming.

Interested PSPs simply integrate Iframe Integrity into their existing script build process, instantaneously creating a controlled and secure iframe environment for loading payment pages and ensuring transactions remain protected from threats. Hardened with Jscrambler’s integrity technology, the iframe is continuously monitored and safeguarded against overlay, hijacking, and formjacking attacks targeting payment pages. Unlike traditional security solutions, Iframe Integrity is fully automated and completely transparent, requiring minimum maintenance from PSPs and zero merchant management.

Main Iframe Integrity features include: 

• PSP Script Hardening: Protects against reverse engineering and automated threats with PSP script tamper-resistance.

• Function Hijacking Protection: Applies monkey-patching protection in privileged functions (on the parent page).

• Iframe Hijacking Protection: Prevents iframe hijacking attacks by isolating Document Object Model (DOM) methods used to tamper with iframe creation processes (on the parent page).

• Iframe Overlay Protection: This prevents iframe hijacking attacks by isolating DOM methods used to create new iframes or tamper with existing ones (on the parent page).

• Form Overlay Protection: This prevents iframe hijacking attacks by isolating DOM methods used to create new forms or tamper with existing ones (on the parent page).

• Iframe & Form Control: This provides fine-grained control over how scripts can use iframes and forms (on the parent page).

Conclusion

IFrames are both a powerful and risky component of modern web development. They enable rich integrations but expose applications to a range of attacks if not managed securely.

Applying the steps outlined, such as using the sandbox attribute, validating sources, enabling cross-origin isolation, and monitoring usage, can significantly reduce the risks associated with iframe functionality. Security should be layered, proactive, and continuously maintained. As third-party dependencies increase, iframe security is no longer optional—it’s essential for safeguarding your application and its users.

Cybercriminals work tirelessly to compromise sensitive data by manipulating technology to commit malicious activities against digital systems or networks – and it’s up to their intended targets to defend against these sophisticated attacks. But sometimes these online fraudsters barely need to lift a finger because of a threat that gives them what they want on a plate: data leakage, bringing prevention into the spotlight for businesses.
 

Understanding data leakage prevention

This unauthorized transmission of sensitive data from within a company to an external recipient or destination typically occurs via the web and email. Typical examples include an employee sending a message to the wrong recipients, flaws in security policies, and unpatched vulnerabilities in software. 

It can also happen when mobile data storage devices such as USB keys and laptops are left unattended or when a disgruntled employee leaks confidential information to attract outside attention. Whether the leakage is accidental or intentional, the consequences can be crippling.

1. Reputational damage

After filling out an online form on a business’s website, a data leak containing personal information can break a customer’s trust, erode their loyalty, and create a negative perception of the brand.

2. Financial cost

This can vary depending on the type and extent of the leak, but typically includes reactive steps to contain the breach, implementing new security measures, investigating the leak, and compensating those affected.

3. Regulatory compliance

Increasingly robust data protection regulations legally require organizations to take appropriate steps to mitigate data leaks. Failure to comply can result in legal action, significant financial penalties, and reputational damage.

Data leakage examples

1. Volkswagen Group of America

From August 2019 to May 2021, a data leak exposed personal information of around 3.3 million Volkswagen customers, including driver’s license numbers and social insurance numbers.  Malicious actors exploited a third-party vendor to obtain the data after Volkswagen had failed to secure this database. 

2. Capita

In May 2023, Capita, a group that operates services for the NHS, councils, and military in the UK, leaked personal and financial data into the public domain. The incident was caused by an exposed Amazon S3 bucket – a cloud storage misconfiguration that left sensitive files publicly accessible. This primarily impacted local councils, exposing constituents’ benefits data, including Personal Independence Payments (PIP) details. The company’s shares fell by more than 12% in the wake of the leak.

3. Infinity Insurance

In December 2020, malicious actors temporarily achieved unauthorized access to files on Infinity Insurance’s servers for two days. This exposed the personal information of customers and existing and former employees, including millions of driver’s license numbers and social security numbers.

How to prevent data leakage

The adage “prevention is better than a cure” rings true in the context of tackling data leakages. Taking steps to permanently plug gaps in your business’s physical and digital security perimeter before a leakage occurs will prevent it from happening in the first place. Conversely, a reactive approach that attempts to stop a leak after it has started will leave you exposed.

A proactive approach to data leak management requires the implementation of focused strategies that are specifically designed to prevent this pervasive threat, including:

1. Achieving comprehensive coverage of website data

To achieve visibility and respond to a data leak expeditiously, you should monitor every script’s activity in real-time to determine its misbehaviors. This can be reinforced by creating a detailed inventory of each code’s output, its destination, and when it’s sent.
 

2. Reinforcing the source code

Gain control of third-party script activities on your website by combining innovative runtime protection and obfuscation capacities or actions that can mitigate data loss, as endorsed by the National Institute of Standards and Technology (NIST) and the Open Web Application Security Project (OWASP). With the suspicious code blocked, data leakages are prevented.

3. Implementing robust policies

Oversight measures can help you structure how data is transacted. This includes implementing robust data leakage prevention policies that require third parties to comply with agreed data protection standards. These essential components of a cybersecurity strategy help reduce the risk of financial loss, reputational damage, and legal consequences resulting from a data leak.

Data leakage prevention tools 

Jscrambler’s data leakage prevention tool is designed to underpin this proactive approach. It helps you understand your level of risk by gathering data and providing information about which vendors and scripts are running on your website and what data they are touching in every user session.

This essential process is performed across three key stages:

• Monitoring: Continuously gathers information on all user sessions and attributes levels of risk to each vendor based on its behavior.

• Risk mitigation: Provides visibility and control over the sensitive data being inserted on web forms and which vendors are accessing and transferring sensitive data from your website – allowing you to block unauthorized access.

• Script control: Provides precise control over all first and third-party script behavior by enforcing comprehensive data access rules, allowing you to block unauthorized behaviors, including data transfers to external domains.

Another critical element of data leak management has been amplified by a recent update to its provisions: PCI DSS (Payment Card Industry Data Security Standard) compliance—a set of security standards designed to ensure that all companies that accept, process, store, or transmit credit card information maintain a secure environment.

PCI DSS compliance

The fourth iteration of the PCI DSS aims to meet the evolving security needs of the payment industry, promote security as a continuous process, increase flexibility, and improve procedures for organizations to achieve their security goals. The new PCI DSS v4 requirements, which focus on managing payment page scripts – notably JavaScript – can be used to address data leakage risks with other cybersecurity standards and regulations, such as HIPAA.

JavaScript, which runs on all major browsers, is the building block of nearly every modern web page. Its appeal stems from its ability to bring online applications to life, create dynamic user experiences, and function across several platforms. While its benefits are compelling, in the absence of sufficient monitoring, it can produce security risks that remain undetected for a significant period, notably the widespread use of third-party JavaScript.

It is challenging for online businesses to maintain complete visibility and control over these scripts. In 2023, research by Jscrambler found that 80% of the 20 most highly trafficked US e-commerce websites had an average of 148 JavaScripts on their payment pages. 

Amid this opaque view of JavaScript, PCI DSS has included specific requirements (6.4.3 and 11.6.1) designed in part to detect any tampering or unauthorized alterations to the payment page that can result in the leakage of cardholder data. PCI DSS defines the scope of its requirements based on the cardholder data environment (CDE), which includes systems and processes that store, process, or transmit cardholder data. Any data leakage within the CDE is a significant violation of PCI DSS.

Conclusion

Effective data leakage management is built on a foundation of robust controls that dictate who can access what data. This essential requirement is achieved by blocking script misbehaviors using granular control of actions and access levels, allowing you to maintain the integrity of your website without compromising functionality.

Jscrambler can also help you keep pace with the dynamic regulatory compliance landscape—a challenge the updated PCI DSS has brought into sharp focus. With the structure in place to maintain compliance with its new provisions, your organization will reinforce its data leakage controls.

For a long time, passwords have been the primary method for online security. Many of us have relied on personal details, reused the same password across multiple accounts, or followed complex patterns to keep credentials safe. However, these traditional methods have proven to be ineffective. Hackers have turned what was once a person’s primary line of defense into their greatest vulnerability through phishing scams, data breaches, and fake emails. One wrong click on a fake message, and suddenly, a stranger has access to your bank account or personal information.

Major tech companies, including Microsoft, Apple, and Google, are introducing a passwordless future with passkeys — a more secure and convenient way to log in—to address these growing security risks. Instead of memorizing long passwords, users can now authenticate their accounts using fingerprints, face scans, or a simple device PIN. No more struggling with passwords, no more fear of cybercriminals stealing them, just a simple and safer way to access your accounts.

This article examines the future of secure authentication, exploring the transition from traditional passwords to more advanced solutions, such as passkey.

Password vs. Passkeys

What is a password?

A password is a secret combination of letters, numbers, and symbols that you create to protect your online accounts. It works like a key that lets you access websites, apps, and devices. To log in to your device, please enter the exact password you set up.

What is a passkey?

A passkey is a new and safer way to log into your accounts without typing a password. Instead of remembering long passwords, you can use your fingerprint, face ID, or a simple PIN on your device to sign in.

The future of secure authentication

Passwords have been the primary method of securing online accounts. However, their limitations have become more obvious. From the part of users creating weak passwords to reusing them across multiple sites to avoid the stress of remembering them, or falling victim to phishing scams that trick them into revealing their credentials. These steps have not only made passwords inconvenient but also a serious security risk.

Even with additional security measures, such as two-factor authentication (2FA), passwords can still be compromised or misused. People often forget them, write them down, or rely on password managers to keep track of them. 

While using a combination of letters, numbers, and symbols to create passwords has been effective for many years, the future of secure authentication is shifting away from passwords. People now want stronger security that doesn’t require them to memorize complex passwords.

This has led to the rise of Passkey Authentication, a modern solution that eliminates the risks associated with passwords.


Passkeys work differently from traditional passwords, they use a pair of cryptographic keys instead of something you have to remember. One key stays private on your device or password manager, while the other is shared with the website you’re logging into.

Because passkeys are generated securely and unique to each site, there’s no risk of weak, reused, or stolen passwords. Instead of typing in a password that hackers could guess or steal, your device automatically verifies who you are, making logins both safer and easier

Password

• Users often create their own passwords, which can lead them to use personal information that can be easily guessed.

• Hackers can easily steal passwords through phishing, brute-force attacks, and data breaches.

• Many people reuse passwords across different websites, making all their accounts vulnerable if one gets hacked.

• Forgetting a password means going through a long and frustrating reset process.

• Manually entering passwords for every login can be annoying and time-consuming.

Passkey

• Passkeys are automatically generated by the system, eliminating the risk of users selecting weak or reused passwords.

• Passkeys are highly secure because they cannot be guessed or reused, protecting them from hacker attempts

• Your fingerprint, face scan, or device PIN becomes your login key.

• No typing, no remembering of letters or numbers, just instant, secure authentication.

• With big tech companies backing passkeys, they are set to replace passwords for good.

Will the Passkey replace the Password?

Well, it’s too early to say for sure, but passkeys are certainly a strong alternative to traditional passwords. As more users and businesses recognize the importance and security they offer, adoption is expected to grow. While passwords may not disappear overnight, but the simpler, safer login option that passkeys provide could gradually become the preferred choice for many.

Which One Provides a Simpler Login Experience?

Passwords require you to remember and type them every time you log in to an account. If you forget them, you will have to reset them, which can be tiring at times and can be a pain for users.

Passkeys make logging in much easier and safer. I remember a time when I needed to access my bank account to make a payment, but I was in a crowded place. Typing my password felt risky. What if someone saw it? Additionally, passwords can be lengthy and difficult to type accurately, especially in a hurry. However, my bank app now supports passkeys, so instead of typing a password, I simply use my Face ID to log in. It’s quick and simple, so I don’t worry about anyone stealing my password or watching me type it.

Will Businesses Transition from Passwords to Passkeys?

Passkey is still a growing solution for secure logins. The increase in cyber threats to passwords has prompted many businesses to seek better solutions to enhance security and simplify the login experience. According to Fido, many businesses have already begun adopting passkeys to enhance security while making logins easier and more comfortable for their users.

What Happens If You Lose Your Device With Passkeys?

If you lose your device with passkeys, you can still recover access through cloud synchronization. Most platforms, like Google, Apple, and Microsoft, securely store passkeys in the cloud, allowing you to retrieve them on a new device after signing in with your account credentials and verifying your identity.

If you get a new device, setting up your passkey is simple. Google Chrome support provides step-by-step guidance to help you transfer or restore your passkeys. Since passkeys are stored securely on your device or password manager, you don’t need to remember or type anything. Check out the common questions and answers about Passkeys on Google News.

Conclusion

Passkeys make logins easier and more secure, eliminating the stress of remembering passwords and mitigating security risks. As more companies and websites adopt this technology, users can enjoy faster, safer access to their accounts. Switching to passkeys isn’t just a minor improvement; it’s a significant step toward a safer login, where security is stronger and logins are stress-free.

API security aims to protect APIs from attacks and data breaches.

When we use software applications, such as mobile apps, we take it for granted that the information we request will be delivered quickly and clearly. Before this can happen, however, a vital process must occur: the app connects to the internet and sends data to a server, which retrieves that data, interprets it, performs the necessary actions, and sends us what we have requested – all of which happens via an Application Programming Interface (API).

This ability to serve as an intermediary between two software applications so they can exchange data seamlessly means APIs are fundamental to digital transformation in today’s app-driven business world: they enable mobile experiences, connect companies on the web, and facilitate platform business models.

More than 83% of enterprises use APIs to increase ROI on their digital assets. However, they have become victims of their success. Their ubiquity (coupled with their ability to enable access to sensitive software functions and data) has made them a primary target for cyberattacks.

According to a 2024 API security impact survey of 1,200 CIOs, CISOs, and security professionals, 84% of respondents experienced an API security incident over the past 12 months.– This brings API vulnerabilities and the security best practices needed to mitigate them into sharp focus for businesses.

 Common API security vulnerabilities

Let’s explore five of the most common API vulnerabilities that can lead to network breaches, compromised data, and financial loss for businesses, and provide some tips to help prevent them:

Broken user authentication

This occurs when the user’s session ID or credentials have been compromised due to weak API authentication protocols, allowing attackers to take over their accounts, steal their data, or engage in fraudulent transactions.

Recent research reveals that 94% of applications were found to have some form of broken access control, with an average incidence rate of 3.81%

• Prevention tip: All authentication endpoints should be protected by strict rate limiting, lockout policies, and weak password checks.

Broken object-level authorisation (BOLA)

This occurs when attackers exploit vulnerable API endpoints by manipulating the ID of objects that are listed in API requests. With no check in place to determine ownership of those objects, attackers can access sensitive information by simply changing the ID in a request.

Recent analysis of prevalent security challenges in live APIs identified Broken Object-Level Authorization (BOLA) and injection attacks as the leading issue (37%).

• Prevention tip: Enforce robust authorization mechanisms and redefine how you generate and manage IDs within your API ecosystem.

Injections

This occurs when attackers inject malicious code or commands into APIs through user input fields, allowing them to exploit vulnerabilities or manipulate data. This technique might be effective when APIs do not properly validate or sanitize user input, or when they do not properly handle external data sources or systems.

• Prevention tip: Validate, sanitize, and/or escape user inputs by performing data validation using a single, trustworthy, and actively maintained library.

Excessive data exposure

This occurs when an application, via an API response, provides too much information to the user, meaning they can’t perform a specific action. This reliance on the client side can expose unfiltered data that an attacker can intercept.

Recent analysis of prevalent security challenges in live APIs identified data exposure as one of the leading issues (34%).

• Prevention tip: Treat every response and data field as a vulnerability. Review the API responses to ensure they contain only legitimate data. 

Lack of rate limiting

This occurs when an API does not limit the number of requests a user or system can make in a given timeframe. This can lead to potential Denial-of-Service (DoS) attacks, where a cybercriminal overwhelms the API with requests, causing it to become unresponsive.

• Prevention tip: Limit how often a client can call the API within a defined timeframe and notify them when the limit is exceeded. 

What is API security?

APIs’ vital role as the backend framework for software systems and services means they are a conduit for sensitive data, including access information like authentication and authorization, attracting unwanted attention from cybercriminals.

API security is the process of protecting these backend frameworks from cyberattacks that attempt to exploit them by gaining unauthorized access to the network to steal sensitive data or disrupt services.

Strategies and tools are deployed to restrict access to authorized users only and protect the data transmitted through the API from being compromised or manipulated.

Top 6 API security best practices

The widespread use of these business-critical software interfaces has meant that their vulnerabilities and the nefarious techniques used to exploit them have expanded the cyber-attack surface. 

To mitigate this threat and secure their future revenue and growth, businesses must ensure API requests are authenticated, authorized, validated, cleansed, and resilient when the service is under load. This requires developing and implementing a robust API security strategy built on a foundation of the following best practices.

1. Authentication 

The first layer of defense against unauthorized access to API resources should be a robust authentication system – using standards such as OAuth 2.0, OpenID Connect, and JSON web tokens – that requires users to provide specific login credentials before gaining access to data. 

This process of thoroughly authenticating all related users and devices typically requires client-side applications to include a token in the API call, allowing the service to validate the client. 

2. Encryption

Encrypt all network traffic – notably API requests and responses, as they likely contain sensitive data. These communications between APIs and clients should be secured through an SSL connection or TLS encryption protocol like HTTPS.

For maximum security, use the latest and most secure version of HTTPS with TLS 1.3 protocol enabled for all software applications. This will ensure that all data sent between them is encrypted and shielded from malicious third parties.

3. Access control

Introduce and test controls to manage the level of third-party access to internal data and systems through APIs. This requires a “never trust, always verify” mindset that’s underpinned by three questions: Who? What? When? Known as a zero-trust, this authorization strategy controls data access, creation, update, and deletion.

To reinforce access control, APIs should also be maintained behind a firewall, web application firewall, or API gateway, and accessed via a secure protocol, to provide standard protection, such as scanning for injection-based attacks.

4. Only share the necessary information

API responses typically include an entire data record rather than just the relevant fields.

If the client application fails to filter this sensitive data before it’s made publicly available, it not only slows response times; it also provides attackers with additional information about the API and the resources it accesses, such as keys, passwords, and other personal information necessary to fulfill a request. For example, if a customer’s age is requested, their date of birth shouldn’t be provided in addition.

5. Record APIs in a registry

You can only secure what you know. To make this possible, record all APIs in a registry to define key characteristics such as name, purpose, and live date. By recording pertinent information, you will be well-placed to meet compliance and audit requirements and assist in forensic analysis during a security incident.

The registry should include all technical API requirements, such as functions, classes, and integration processes.

6. Assess risks

Conduct a comprehensive risk assessment for APIs in your existing registry that identifies all systems and data that will be impacted if an API is compromised. Use this insight to outline a treatment plan that contains the controls needed to trim risks to an acceptable level. This will empower you to implement measures that ensure compliance with security policies and protection against known vulnerabilities.

To maintain robust security, document review dates and conduct periodic assessments, particularly in response to new threats or API modifications. Thoroughly review this documentation before making subsequent code changes to guarantee the preservation of security and adherence to data-handling requirements.

7. Monitoring

By continually monitoring your APIs, you can see what users are accessing and what they’re doing with that information. Be vigilant by recording every API request and maintaining audit logs of user activity. Robust governance will provide the agility needed to troubleshoot in case of an error and ensure you maintain data security and compliance.

Create and implement a comprehensive auditing and logging policy regularly reviewed and updated to keep up with pervasive cybersecurity threats.

Conclusion

As the backbone of modern applications, APIs create enriching opportunities for businesses to elevate services, engage customers, increase productivity, and maximize profits – but only if they’re secure. To achieve this, API security must be a systematic process that considers every weak point cybercriminals might target and an ongoing process that keeps pace with the dynamic cyber threat landscape.

Connect with our client-side security experts to know more about it and how to use Jscrambler solutions to protect your client-side assets.

There has been a significant shift towards software development, where organizations ranging from small business entities to large-scale businesses use open-source components to achieve shorter development times and minimized expenses. Based on more recent research, the proportion of open-source code within more recent applications has increased. It is said to constitute between 70-90 percent of many of the commercial applications currently in circulation.

This general usage has led to the development of a tremendous ecosystem that allows developers to build elaborate applications using pre-existing subroutines and initiating modes known as frameworks and libraries. However, this relationship ties organizations heavily to open-source software, posing massive security threats that require vigilant handling. The XZ Utils incident, Log4Shell vulnerability, and the SolarWinds supply chain attack show that existing open-source security protocols must be more potent and more effective.

What is Open Source Security?

Open-source security is the processes, technologies, and measures applied to safeguard open-source software programs and systems. It spans the security process of open source, from component choice to inclusion and validation of code components and even up to component updates and patches for vulnerabilities. At its core, open-source security involves several key aspects:

• Component Integrity: Validating that open-source components have not been tampered with and are downloaded from a proper source. This encompasses confirmation of package origin and ensuring its integrity throughout the software supply chain.

• Vulnerability Management: Ongoing detection, tracking, and remediation of security issues in open-source libraries. This monitors other vulnerabilities, rates their effects, and applies updates or patches when due.

• Compliance and Licensing: Cooperating between open source compliance management and security requirements, including the license requirements and implications of security measures and documentation of all components used.

• Security Assessment: Code review, security testing, and vulnerability scanning of open sources are performed periodically as often as security audits are done. The idea is that threats can be detected before they become threats and used as an opportunity to be secured.

• Ongoing Maintenance: Securing open source components and sub-dependencies during their usage path, updating, monitoring the Security Advisories for any changes, and handling the end-of-life of any deprecated component.

The Risks of Open Source Security

Of all the issues concerning open source, security is one that most users shy away from due to the various risks involved.

Due to its intrinsic characteristics, open-source software is uncontrolled because it is accessible for anyone to employ, alter, and disseminate. This is good for creating new compelling solutions and cooperative working, but it poses risks at the same time. The OWASP Top 10 Risks for Open Source Software provides a comprehensive view of the most critical security challenges organizations face when integrating open-source components:

1. Known Vulnerabilities: This situation focuses on the particular security risks associated with open-source elements when these flaws have been located but not rectified. These vulnerabilities are even more likely to be exploited because the information is available to anyone interested. Once a vulnerability is publicly disclosed and posted on sites like the National Vulnerability Database (NVD), new threats can easily create attacks that will affect organizations that have yet to patch their components.

2. Compromise of Legitimate Package: This takes place when the attacker compromises the package repos or a developer’s ID and posts malicious code into genuine packages. The above compromises are rather sharp and dangerous because they act based on the confidence that organizations bear for classic open-source depots and maintainers. The SolarWinds experience revealed how compromised packages can impact hundreds to thousands of organizations in one supply chain attack.

3. Name Confusion Attacks: They are also referred to as typosquatting or dependency confusion attacks, which occur when attackers develop packages with names close to real packages. Phishers use phenotypic similarities to typosquatting or similar names of packages to convince developers to install spoof packages instead of the intended ones. A lot of the hosts of these attacks exploit the automated nature of dependency management systems that are used nowadays.

4. Unmaintained Software: Free code components that are not maintained pose a huge risk to data security. If maintainers ignore a project or do not respond to security incidents, the project has unprotected security holes and no way to ensure safety. The utilizing organizations thereby become automatically held responsible for maintaining security themselves or accept the increasing risk of running out-of-date code.

5. Outdated Software: As it turns out, even when newer and safer versions of open-source components have been released, organizations do not upgrade to them. This produces security risks since older versions might have recorded susceptibilities or no security enhancements. To prevent errors that cause failure or inability to perform specific functions, updating the dependencies requires a lot of time, exposing clients to other risks for a long time.

6. Untracked Dependencies: It is usually difficult for organizations to know which open-source components they rely on, let alone the downstream dependencies or second-order dependencies. Ultimately, organizations cannot know what components are on their system or whether those components have security problems or require updates. Untracked dependencies make security monitoring and risk management invisible areas that security personnel cannot even see.

7. License Risk: While mainly a legal issue, a license violation can have points related to security measures. Some licenses may require code disclosure or hamper modification ability, thus hindering an organization’s capacity to fuse security fixes. Comprehension and administration of license terms lie at the heart of compliance, security, and flexibility.

8. Immature Software: New or experimental components of an open-source system may not be as secure as they may be if subjected to rigorous real-life use. These components might have numerous unknown, open, or even security anti-patterns that the more mature software has improved over the course of years of development and security auditing.

9. Unapproved Change: Open source components can be upgraded, patched, or modified to contain new features, bug fixes, and security vulnerabilities, but if not approved for inclusion, they can cause security issues when integrated into an application or system. That is why it can be lethal if such an alteration is performed by an unauthorized individual or an individual who has not followed the appropriate checklist, which needs to be solved to ensure that new changes do not bring new vulnerabilities or compatibility problems in the system.

10. Under/Oversized Dependency: Introducing dependencies whose size is too big, including too much code and possible threats, or too small, which cannot perform its functions without adding more dependencies. Unnecessarily large dependencies increase the size of an attack surface in a given application. In contrast, small dependencies may lead to issues such as creating many dependencies in an application, thus complicating security.

Best Practices for Securing Open Source Software

To reduce the threat that has been associated with open-source security, developers and organizations must take the necessary precautions. Here are some best practices:

1. Implement Software Composition Analysis (SCA)

Use appropriate automated tools to constantly monitor and identify open-source software, components, versions, and any known vulnerabilities. This gives certain insights into your software supply chain and allows you to focus on fixing a priority area for an attack. SCA tools need to be best incorporated as part of the development process so that apparent vulnerabilities can be recognized before incorporation into a system.

2. Establish a Vulnerability Management Program

Establish a routine process for addressing security alerts and databases that provide sufficient information and references on security risks. The program should contain procedures for evaluating the effects of the discovered vulnerabilities, selecting the updates by their risk level, and applying them. This is so because the program requires periodic reviews and updates to remain effective throughout its life cycle.

3. Create a Software Bill of Materials (SBOM)

Document all the open-source components across the software and ensure they’re continually updated. This should comprise name, direct and transitive dependencies, version, license, vulnerability, and update records. As a result, the SBOM is the definitive resource for reference during security and compliance purposes.

4. Verify Source Authenticity

Ensure proper authorization of each of the open-source component options. This comprises utilizing package signing and validation features, checking the checksums of downloaded components, and reporting the reliability of the package source and contributors. The level of transparency is then maintained by conducting general audits of the sources from which you acquire your components.

5. Automated Security Testing

Ensure you incorporate or include security testing into your continuous integration and delivery process to discover the weaknesses at the development stage. This should include static Application Security Testing (SAST), Dynamic Application Security Testing (DAST), and Interactive Application Security Testing (IAST) as a combination of SAST and DAST.

Secure Your Source Software with Jscrambler

Open-source code protection is most commonly done through software like Jscrambler’s, which protects JavaScript apps. To offer extensive security against code modification, reverse engineering, and other forms of attack methods, Jscrambler is a perfect match for safety-conscious organizations.

Here’s how Jscrambler can help with open-source security:

1. Code Obfuscation: The open-source components are safeguarded against further modification and reverse engineering by Jscrambler’s sophisticated methods of JavaScript Obfuscation and code hardening capabilities. This assists in minimizing risks generally associated with supply chain nuisances and the incorporation of malicious codes. The protection system in the platform guarantees that your code is protected when you manage to distribute it in hostile areas.
   
   

2. Real-Time Application Self-Protection (RASP): The platform’s runtime protection assists in recognizing and stopping anti-tampering attempts in real-time so that a compromised open-source component cannot run within your application context. This covers issues related to vulnerable parts, supply chain attacks, installation/run of malicious code, and unlawful alterations. Runtime protection offers extra layers of protection that cannot be procured by simply scanning the code. 
   
   

3. Integration with CI/CD Pipelines: Incorporating Jscrambler with CI/CD means that security remains inherent soon after the code comes to life in the development cycle. Maintaining an organization’s components’ current status and security by examining JavaScript dependencies. That’s why the platform allows teams to monitor vulnerable dependencies, give notifications on security threats, estimate the potential damage of vulnerabilities, prioritize updates based on risk level, and adhere to security standards. Concurrent monitoring is supposed to help identify security threats as early as possible.
   
   

4. Protection Against Supply Chain Attacks: The platform provides end-to-end security solutions for your software supply chain. These include identifying the origins of open source packages, identifying injections of invalid code, analyzing activity in dependents, record keeping for security compliance purposes, and access control measures. 

Overall, open sources add a lot of advantages, but it is very important to mention that we are facing new threats concerning personal security. Using some of the best practices for protection and appropriate tools, open-source software can continue to be used as a safe base for innovation.

From the damage caused by lockdowns to the erosion of consumer spending power amid spiraling inflation, the entertainment and media industry has faced considerable headwinds in recent years. Having weathered the storm, industry revenues rose 5% in 2023 to hit $2.8 trillion and could pass $3 trillion by 2028. However, when it comes to protecting the data that underpins it from breaches by hackers, resilience is often lacking, exposing organizations to disruption, reputational damage, and financial penalties.

These data breaches could be compared to life-imitating art due to their resemblance to blockbuster movies about the murky world of hacking. It’s up to organizations in this space to consign successful cyber-attacks to the big screen by recognizing the importance of data to the industry and taking proactive measures to safeguard it.

Data breaches in Entertainment and Media

Personal data: a core asset of the industry

From unlocking access to online services to providing deep insights into audience preferences, data is a core asset of the entertainment and media industry.

Powering the shift online

The entertainment and media industry has undergone a digital transformation amid a shift online that was proliferated by pandemic-induced lockdowns. This is underscored by the rapid rise of streaming services, which have transformed how content is produced, distributed, and consumed. 

These services allow consumers to view a vast array of content from the comfort of their homes or on the move via smart devices. To access this convenience, they must set up accounts and enter sensitive personal data on streaming sites, including credit card details and emails. 

It’s a similar story in the online gaming sphere, which has gained attention for the scale of its global revenue. In 2022, the global gaming industry generated an estimated $184.4 billion, compared to the global recorded music and movie industries, which generated around $26 billion each, respectively—an eyewatering amount that depends on consumers providing personal data online to sign up for and purchase gaming services. 

Leveraging user data to provide a better service

Content is the lifeblood of the entertainment and media industry. Creating engaging material requires access to consumer data that enables companies to understand and cater to audience preferences, optimize content strategies, and drive personalized experiences. Nowhere is this more prevalent than in the streaming world, where popular platforms like Netflix and Spotify harness user data to provide them with a better service and improve marketing.

This process involves different layers of data collection that include third parties:

• The platform collects first-party data directly from its users, including names, email addresses, account details, and subscription plans. 

• Second-party user data, such as demographic and geographic data, is collected and exchanged by partners. 

• Third-party data, including behavioral data, is gathered by specific data providers, for example, for marketing purposes.

Data breaches 

The entertainment and media industry’s ever-increasing dependence on the internet is expanding its attack surface exponentially, making it an attractive target for cybercriminals. In their sights is the ocean of personal data that’s exposed by weak cybersecurity controls – an all-too-common scenario that has led to several notable data breaches.

Disney

A massive data breach at entertainment behemoth Disney in July 2024 occurred when hackers gained access to public and private Slack channels within the company – exposing over 4 million Slack messages, 18,800 spreadsheets, and 13,000 PDFs – and leaked compromised data. In addition to financial company data that could be used to hold it to ransom, the leak contained personally identifiable information of Disney employees and customers – including passport numbers, visa details, and contact information.  

Nintendo

In April 2020, Nintendo was the target of a data breach in which 300,000 customer accounts were compromised. The data exposed in the breach included credit card information, email addresses, geographic locations, names, and Nintendo Network ID usernames.

Hackers targeted the Nintendo Network ID (NNID) system, which lacked two-factor authentication, using methods like phishing. Having gained unauthorized access to personal information and saved payment details, some users experienced fraudulent transactions on their accounts. 

CAM4

In March 2020, the Cam4 data breach was reported as the largest data leakage in history. Over 10 billion data records were exposed by the adult streaming site due to a misconfigured Elasticsearch database – an internal search engine used by employees to scan user and activity logs. This left data vulnerable to anyone with an IP address, including first and last names, payment logs, email addresses, and password hashes.

Intellectual property: holding the industry to ransom

The entertainment and media industry is powered by creativity. From scripts to the screen, this takes the form of intellectual property (IP) – the ownership of any creation of the mind or ideas or designs by a person, including screenplays, scripts, films, songs, compositions, sound recordings, TV shows, video games, and animations.

In the wrong hands, IP can be leveraged for financial gain by demanding a ransom from the owner to prevent it from being released or sold. Sometimes it’s all bravado due to the high profile of the hacked data. Before they can make their fraudulent demands or claim bragging rights in hacking circles, cybercriminals must compromise the data – something they’ve become adept at, as demonstrated by the Rockstar Games hack in 2022.

Rockstar Games

In September 2022, a hacker harnessed social engineering techniques to compromise an employee’s login credentials at Rockstar Games. They used this information to breach the Rockstar Games network and access the source code for Grand Theft Auto 5 and the in-development version of Grand Theft Auto 6. The hacker then posted on GTAForums claiming they wanted to “negotiate a deal” with Rockstar Games for the return of the unreleased data.

Impact of data breaches on the industry

The entertainment and media industry’s reliance on digital platforms, IP, and consumer trust means data breaches can significantly impact organizations – operationally, financially, and reputationally.

• Operational disruption

Data breaches resulting in ransom demands for compromised IP can cripple production schedules, disrupt broadcasting, or delay releases. Moreover, third-party risk can indirectly disrupt operations if sensitive data held by a vendor or partner is compromised.

• Financial loss

Data breaches can cause significant financial losses resulting from ransom payments linked to leaked IP, legal and regulatory penalties under laws like the GDPR, the cost of remediation, and lost revenue due to the disruption of business operations.

• Reputational damage

Consumers may hesitate to engage with a streaming platform or purchase content from a company that has failed to safeguard their personal data. High-profile breaches can tarnish a company’s reputation, eroding audience loyalty and damaging brand image.

Preventing data breaches

To shield themselves from data breaches, organizations in the entertainment and media industry must adopt a multi-faceted approach to cybersecurity that combines three key strategies: robust access controls, employee training, and adherence to best practices. 

Access controls

Robust access controls protect sensitive data by regulating who can access it – and in what circumstance. Common controls include: 

• MFA

Multi-factor authentication (MFA) offers an extra layer of security when accessing systems and applications. In addition to providing their password, users must enter additional information, such as a code sent to their phone or a biometric scan, to log into an account.

• Data encryption

Data encryption builds trust with users by demonstrating a commitment to maintaining the confidentiality and integrity of submitted data. It harnesses robust encryption algorithms, public and private keys, and a trusted certificate infrastructure. 

Employee training

Employees should be empowered to recognize and respond to potential cybersecurity threats resulting from data breaches. This requires training on identifying phishing emails, promptly reporting suspicious activity or potential vulnerabilities, and responding in the event of a cyber-attack.

Adherence to best practices

Data handling policies, procedures, and tools provide the structure needed to adhere to best practices. They must be transparent and implemented throughout the organization to ensure everyone understands the correct data management practices – from collection, use, and processing to transfer, disposal, and sharing.

Data Instilling resilience in the industry

From financial gain to malice and bravado, the motivation to compromise data created and held by the entertainment and media industry is multi-faceted amid its ever-widening attack surface and high profile. Whether targeting personal user data to commit fraudulent activities or highly valued IP to demonstrate their hacking prowess, the industry offers rich pickings for cybercriminals.

This perfect storm of motivation and opportunity for these bad actors to compromise industry data amplifies the need for robust access controls, focused employee training, and adherence to best practices. By adopting a comprehensive approach to cybersecurity, organizations within the industry can instill the resilience needed to safeguard the data that underpins it.

Money has migrated from the physical to the digital. It’s moved from bank branches and brick-and-mortar stores to online banking and E-Commerce. Criminals have migrated, too, meaning digital heists have replaced real-world hold-ups.

In the modern economy, data equals money. Worryingly, that makes almost every business, regardless of size, turnover, or industry sector, a target for digital skimming – and digital skimmers.

Every business holds data about customers, staff, or partners. Think: customer lists, payroll data and supplier bank details. Sensitive card data (card numbers, expiry date,s and 3-digit security codes) is definitely where data equals money. No wonder card fraud is a $48 billion a year problem, set to double to $100 billion by 2027.

With cybercrime and cybercriminals showing no sign of let up. And two new PCI DSS requirements around payment pages coming into force from 1 April 2025. We look at how businesses can detect and defend against the scourge of digital skimming and stay safe online.

• What is Digital Skimming?

• How Much of a Problem is Digital Skimming?

• What is the Business Impact of Digital Skimming?

• How Does Digital Skimming Work?

• Which Businesses Are the Main Targets For Digital Skimming

• How Do Magecart Attacks Relate to Digital Skimming?

• How Did Digital Skimming Get So Big?

• How Do Businesses Protect Against Digital Skimming Attacks?

• What Are the Digital Skimming Requirements in PCI DSS v4

• How Does Jscrambler Identify the Presence of Digital Skimming?

What is Digital Skimming?

Digital skimming attacks involve stealing sensitive data inputted by users into web forms. Frequently this is payment data from online checkout pages, although it also includes personally identifiable information, or PII for short, from other web forms.

Digital skimming goes by many names, including e-skimming, data skimming, and formjacking. Then there are the more specific terms of JavaScript attacks or Magecart attacks, which hint at how digital skimmers works.

In summary, the modus operandi of a digital skimming attack is similar. Criminals exploit vulnerabilities in a website’s code or infrastructure to harvest data. Digital skimming attacks are hard to detect as the payment process is unaffected. The customer gets their goods or service and the merchant gets paid. Both parties are unaware that a compromise may have occurred. 

How Much of a Problem is Digital Skimming?

Digital skimming is a big, bad problem. Big in terms of the size of the problem. And bad in terms of the likelihood and impact to organizations and end-customers or users.

Some of the biggest, worst data breaches in 2024 include telecoms giant AT&T which confirmed in July 2024 that criminals had unlawfully accessed “nearly all” of its customers’ call and text message data for a 6-month period in 2022. This impacts not only around 110 million customers but also those they interact with.

A June 2024 cyberattack on UK pathology lab Synnovis, a blood and tissue testing lab for hospitals and health services, saw the theft of data related to 300 million patient interactions. It disrupted patient service in London for weeks, leading to thousands of operations being postponed and the National Health Service declared a critical incident.

Elsewhere, around 165 companies were believed to be impacted when cloud storage company Snowflake was hacked. And 560 million Ticketmaster customers had their personal data stolen by cybercriminals, who threatened to publish this on the dark web. Digital skimming attacks show no signs of letup.

What is the Business Impact of Digital Skimming?

The full costs of a data breach to a business could be massive. These include the direct costs of lost revenue, incident response, fines, and breach notification.

For example, US health insurance firm Kaiser disclosed a data breach after online tracking technologies led to the private health information of 13.4 million patients being shared with tech companies and advertisers. The US Postal Service also fell foul of using tracking pixels on its website, potentially exposing the details of 62 million users.

There are the indirect costs associated with a digital skimming attack, namely the loss of brand value, reputation, and trust. Prescriptions provider MediSecure learned this the hard way when it declared insolvency just weeks after confirming it was the victim of a ransomware data breach, affecting nearly 13 million people in Australia. 

How Does Digital Skimming Work?

In general, there are four stages in a digital skimming attack:

1. Initial breach

Criminals gain access to the source code of the server of an online store either as a first-party attack or by compromising a third party. Often this is by exploiting software vulnerabilities, deploying malware, or using stolen (or phished) credentials.

2. Code injection

Criminals inject malicious code to compromise payment pages. They evolve their methods. And tailor them depending on whether payment forms appear directly on pages or are embedded using an iFrame.

JavaScript attacks, as the name suggests, target the programming language used by more than 98% of websites to create interactive pages. 

3. Data exfiltration

The harvesting of data occurs when consumers enter their payment details to complete their purchases on compromised payment pages. Or enter personal data on online forms. The malicious code covertly skims and collects the information, often encrypting it, before sending it to the attacker’s remote server.

4. Monetization

Criminals monetize stolen data by using it to make unauthorized, fraudulent purchases for goods to re-sell for cash. Or by selling the data to other criminals.

Which Businesses Are the Main Targets for Digital Skimming

In short, every business is a target. Sadly, criminals aren’t choosy about the size or nature of your business. Whether you’re large, small, or anywhere in between. Whether you’re a retailer, non-profit organization, charity, educational institution or government agency makes no difference to criminals.

Nor are they choosy about the nature of your customers. They could be consumers, other businesses, large corporations, multinationals, or even government departments. 

Card data is card data. PII (personally identifiable information) is PII. Criminals want it to sell on underground forums. Or to monetize it themselves by creating fake identities or fake cards to commit crimes.

The most common type of data stolen or compromised in 2024 was customer PII at 48%, according to IBM Security’s Cost of Data Breach Report 2024. However, the most lucrative PII to steal was employee PII, including tax ID numbers, e-mail and home addresses, because it can be used in so many more ways.

Generally, if data has value to you or your customers. Then, you can almost guarantee it has value to criminals, so protect it.

How Do Magecart Attacks Relate to Digital Skimming?

Magecart attacks are named after ‘Magento’, the primary open-source e-commerce platform, and shopping ‘cart’. Magecart also refers to the criminal group active since 2015 carrying out such attacks.

In a Magecart attack, criminals inject the digital skimmer through malicious JavaScript code. This actively monitors the payment page and steals sensitive card data whenever a user enters it into a form. This is then sent to servers controlled by the attackers.

Magecart attacks typically attack the payment pages of e-commerce websites either as a first-party attack or a third-party attack.

• First-party attack – criminals access the victim’s website and directly place the digital skimmer on the payment page. Examples include the 2023 attack on DNA testing company 23andMe which leaked nearly 7 million user records and the October 2024 attack on the internet archive Wayback Machine.

• Third-party attack – criminals inject malicious code via a third-party provider that the victim organization is using. Also known as a supply chain attack, it is particularly pernicious as modern websites rely on 13 different pieces of third-party code on average, but up to 35, to run functionality on web pages. Each of these could present attackers with a way-in. 

Nearly every respondent to a recent Jscrambler survey (97%) said they knew third-party tags collected sensitive or private data. Half (49%) admitted that these tags had collected data there weren’t supposed to in the last 12 months. And 26% that sensitive data had been leaked to another organization.

How Did Digital Skimming Get So Big?

The Internet was designed for sharing and collaboration not necessarily banking, shopping, and telemedicine. 

How web applications are built has also changed over time. The business intelligence has moved from web servers, owned and managed by companies, into the consumer web browser, powered by JavaScript, distributed APIs, and microservices.

As a result, any JavaScript running on a web page can access all data entered into form fields on that page. With no separation between different parts of the application, this makes data susceptible to attack.

How Do Businesses Protect Against Digital Skimming Attacks?

The first step in keeping your customers’ data and business safe is understanding the threats out there. Specifically, digital skimming and web app attacks, malware and unauthorized access.

Next, put in place controls to prevent unauthorized access to sensitive data. Don’t underestimate the importance and effectiveness of business-as-usual security. That’s installing and maintaining firewalls, strong password and unique logins for each person with computer access. But also technologies like encryption, tokenization and anti-virus.

Also, conduct regular security assessments, monitoring and third-party due diligence, plus deploy secure code and adhere to payment security standards (PCI DSS).

What Are the Digital Skimming Requirements in PCI DSS v4

Given the ubiquity and innate security vulnerabilities of JavaScript on payment pages, the PCI Security Standard Council (PCI SSC) published an updated version PCI Data Security Standard (PCI DSS) in March 2022. 

Version 4.0 of the PCI DSS contains two new requirements to protect against and detect digital skimming attacks on payment pages. These will be requirements from 01 April 2025.

• Requirement 6.4.3 – the first new PCI requirement is designed to minimize the attack surface and manage all JavaScript present in the payment page. 

• Requirement 11.6.1 – the second new PCI requirement aims to detect tampering or unauthorized changes to the payment page and generate an alert when changes are detected.

Jscrambler’s free PCI DSS 4.0 compliance tool helps businesses that accept card payments achieve frictionless compliance with requirements 6.4.3 and 11.6.1 of PCD DSS v4.0, plus helps PCI Qualified Security Assessors (QSAs) to validate compliance.

How Does Jscrambler Identify the Presence of Digital Skimming?

Jscrambler addresses both new PCI requirements (prevention and detection) concerning attacks on payment pages. 

What’s more, as the payment page is likely to include other JavaScript libraries, Jscrambler provides a smoother and easier way to manage the integrity of third-party code, compared to Content Security Policy (CSP) and Subresource Integrity (SRI).

Features include:

1. First-party code hardening and obfuscation

Obfuscation and protection of the first-party code that the payment service providers supply to merchants, further enhance the defense against tampering with payment pages.

2. Webpage inventory 

Complete visibility of every script and network request on your website. Simplifies the identification of malicious client-side behavior and vetting of resources.

3. Third-party management

Simple onboarding and vetting of third-party scripts, with full observability of each script and a powerful rules engine that can be used to control its behavior.

4. User data management

Dashboard with details of how user data is being handled on the client-side, with insights into possible data leakage.

5. Webpage threat mitigation

Powerful and granular rules engine that blocks any script in real-time, if it exhibits malicious or prohibited behavior (e.g. digital skimming, DOM tampering and data leakage).

Prevent Digital Skimming with Jscrambler

Feel free to connect with our client-side security experts to try our solutions to prevent digital skimming attacks.

JavaScript plays a vital role in creating dynamic and interactive user experiences. However, the increasing reliance on third-party libraries and packages has introduced a new concern: supply chain security. In this article, we take a deep dive into the JavaScript supply chain security concept and explore its potential risks and vulnerabilities.

Supply chain security refers to the measures taken to protect software and its components from being compromised during the development and deployment process. As JavaScript frameworks and libraries are often fetched from various sources, they become potential entry points for malicious attacks on a website or web application.

By understanding the risks and vulnerabilities associated with JavaScript supply chain security, developers and cybersecurity professionals can implement effective strategies to mitigate these threats. From vetting and verifying the integrity of dependencies to utilizing content security policies, several steps can be taken to enhance the security of a JavaScript supply chain.

The Importance of Supply Chain Security in the Context of JavaScript

In recent years, supply chain security has gained prominence as attacks targeting software supply chains have increased in frequency and sophistication. For JavaScript developers, understanding the intricacies of supply chain security is crucial. A single vulnerability in a dependency can compromise the entire application, leading to data breaches, loss of user trust, and significant financial damage.

Moreover, the dynamic nature of the JavaScript ecosystem, where packages are constantly updated and new dependencies are frequently added, makes maintaining security an ongoing challenge. Developers must be vigilant about the libraries they use, the permissions they grant, and the updates they apply, ensuring that security is not compromised at any stage of the development process.

Common Vulnerabilities and Threats in the JavaScript Supply Chain

JavaScript supply chain vulnerabilities can arise from various sources, including compromised packages, malicious code injections, and outdated libraries. The risks of the JavaScript supply chain are as follows:

1. Malicious Packages: One of the primary risks in the JavaScript supply chain is the introduction of malicious packages. Attackers can publish packages with malicious code to repositories like npm, which developers can then unwittingly include in projects.

2. Dependency Confusion: This occurs when a public package with the same name as an internal package is introduced. If the public package has a higher version number, package managers may resolve to use the public package, leading to potential security breaches.

3. Typosquatting: Attackers create packages with names similar to popular libraries, hoping that developers will mistype the package name and inadvertently install the malicious version.

4. Supply Chain Attacks: Attackers target the build and distribution infrastructure of popular packages, injecting malicious code into legitimate updates.

5. Outdated and Vulnerable Dependencies: Using outdated libraries with known vulnerabilities can expose applications to attacks.

Impact of JavaScript Supply Chain Attacks

Data Breaches and Unauthorized Access: 

When attackers inject malicious code into JavaScript libraries, they can gain unauthorized access to sensitive information, such as user data and login credentials. This can result in data breaches and the potential misuse of the stolen information.

Distributed Denial of Service (DDoS) Attacks: 

Compromised JavaScript libraries can execute DDoS attacks, employing unsuspecting users’ devices as part of a botnet. This can overload targeted websites or services, leading to significant disruptions and financial losses for the affected organizations.

Practices for Securing the JavaScript Supply Chain

• Securing the JavaScript supply chain requires a multifaceted approach. Developers should practice due diligence when selecting libraries and frameworks. This includes researching the reputation of the package, examining its security history, and reviewing its maintenance practices.

• Regularly updating dependencies is also critical to ensure vulnerabilities are patched. However, updates should be applied carefully, with each new version vetted to ensure it does not introduce new risks. Automated tools can help track dependencies and alert developers to vulnerabilities, but manual review is still essential for high-risk components.

• Also, adopting a “least privilege” approach to dependency permissions can limit the impact of a compromised package. By restricting the actions a dependency can perform, developers can reduce the potential damage of an attack.

• Incorporating security checks into the continuous integration/continuous deployment (CI/CD) pipeline can further enhance supply chain security. Tools like Snyk, npm audit, and GitHub’s Dependabot can automatically identify vulnerabilities and suggest or apply fixes, integrating security into the development workflow.

Tools and Technologies for Enhancing JavaScript Supply Chain Security

Several tools and technologies are available to help developers secure their JavaScript supply chains. Dependency management tools like npm and Yarn offer built-in features for identifying and resolving vulnerable packages. Security-focused platforms like Snyk provide comprehensive vulnerability scanning and monitoring for JavaScript projects, offering actionable insights and automated fixes.

Developers can use software composition analysis (SCA) tools for more granular control over package integrity. These tools analyze the composition of an application’s dependencies, identifying potential security, licensing, and quality issues. By incorporating SCA tools into the development process, teams can proactively manage supply chain risks.

Content Security Policies (CSP) are another powerful technology for mitigating the impact of supply chain attacks. By specifying which sources are trusted, CSPs can prevent the execution of malicious scripts, even if they are introduced through a compromised dependency.

Conclusion

JavaScript supply chain security is a critical aspect of modern web development. With the increasing complexity of applications and reliance on third-party packages, adopting best practices and staying vigilant against potential threats is essential.

Understanding and addressing JavaScript supply chain security is not just a technical necessity but a fundamental responsibility for developers and organizations committed to maintaining the integrity and trustworthiness of their software.

Anecdotal evidence that JavaScript is the top programming language is easy to come by. Ask most web developers and they will wax lyrical about its versatility, ease of use, and dynamism. This high praise is emphasized by a recent survey showing the majority of developers (62.3%) identified it as the language they want to work with for a tenth straight year – an enduring popularity underpinned by its ability to keep pace with the rapid evolution of web development. However, with widespread adoption and progression comes an increased risk of JavaScript security vulnerabilities.

JavaScript provides threat actors with an irresistible combination of ubiquity and a widening attack surface: most websites (98%) use it client-side to create interactive web pages, while the exciting trends and advancements perpetuating this adoption are susceptible to attacks.

Amid this perfect cyber-attack storm, threat actors are developing new and more advanced techniques to exploit JavaScript’s weak points – a worrying trend is showing no signs of abating in 2025. Let’s investigate the top JavaScript vulnerabilities to look out for in the coming months and how to combat them.

JavaScript Vulnerabilities to Look Out for in 2025

1. Cross-Site Scripting Attacks (XSS)

XSS attacks occur when malicious third-party scripts are injected into trusted websites. Once deployed, threat actors can harness them to exploit vulnerabilities that enable the execution of malicious JavaScript code in another user’s browser – leading to data theft, account compromise, or even full system control through further exploitation.

One of the most common JavaScript threats, XSS attacks are constantly being tweaked by perpetrators to maintain their deleterious impact and avoid detection. For instance, as JavaScript frameworks like React, Vue, and Angular evolve in 2025, threat actors will refine XSS attacks that target these blueprints for building web applications.

Prevention tips: Ensure client-side user input is validated and sanitized before being included in HTML output. Additionally, encode any user-generated content before displaying it on web pages to prevent the browser from interpreting it as executable code or clickable web links.

2. E-skimming

This client-side attack occurs when threat actors inject malicious code onto a website to compromise sensitive data – including credit card numbers, expiration dates, and security codes – inputted by users into payment processing pages and other online forms.

Unauthorized access to the site is typically gained by compromising assets originating from outside its security perimeter, such as client-side web assets – the files and resources downloaded and executed by the user’s web browser when they visit the site. 

To achieve this, threat actors typically target JavaScript vulnerabilities by injecting the malicious skimming code via a supply chain attack or a direct hack of a website. The code infiltrates the site’s point of sale, allowing sensitive data to be compromised. These attacks can go unnoticed for weeks or months because they occur beyond the boundaries of traditional security controls, creating a blind spot that allows the malicious code to hide in plain sight.

Prevention tips: Audit and monitor JavaScript code, especially third-party script. Implement Subresource Integrity (SRI) to ensure the scripts loaded on the website are not tampered with by validating their integrity. Regular updates and patches to the website platform and any third-party plugins will prevent vulnerabilities in outdated versions from being exploited. 

3. Supply chain attacks

Supply chain attacks target third-party libraries, packages, or dependencies that developers use to provide web functionality – including JavaScript libraries containing pre-written scripts that streamline web development. Once compromised, attackers can inject malicious code into all websites using that third-party resource.

Once the code has been added to a website’s software by targeting JavaScript vulnerabilities, it surreptitiously spreads when users install updates from what they assume is a trusted source – exposing the data of an ever-expanding number of unsuspecting victims. 

Prevention tips: Adopt a multi-layered approach to mitigating supply chain attacks that includes the implementation of web application firewalls (WAFs), a robust Content Security Policy (CSP), and Subresource Integrity (SRI). Augment this by verifying partners’ controls and certifications, performing third-party risk assessments, and mapping the flow of traffic and critical data.

4. Formjacking

Formjacking occurs when attackers inject malicious JavaScript code directly into a website’s payment page or login forms, hijacking their functionalities. The script intercepts the input fields, typically targeting payment card information and other sensitive data entered by users, and sends it to the attacker’s server.

This type of attack exploits the trust users have in established, legitimate web applications. Consequently, a formjack can remain undetected for a prolonged period as the form behaves normally.

Prevention tips: Regularly patch and update the website’s software, plugins, and extensions, use a secure connection to safeguard data during transmission, and regularly scan the site and server logs for vulnerabilities and suspicious activities.

5. Prototype pollution

All objects in JavaScript contain a prototype that they inherit properties and methods from. This prototype chain allows objects to share common behavior. When an object property is accessed, JavaScript looks for it on the object itself. If it doesn’t exist there, it searches further up the chain.

Prototype pollution happens when a threat actor injects arbitrary properties into an object’s prototype to modify it and change the behavior of all objects it creates. Having gained unauthorized control of properties in a web application, they can launch attacks from within. For instance, having exploited the client-side JavaScript, the attacker might execute a DOM XSS – a cross-site scripting vulnerability that occurs when a web application’s client-side JavaScript modifies the Document Object Model (DOM) to create harm.
 

Prevention tips: Stop untrusted user inputs from directly modifying object properties by validating and sanitizing inputs, especially when merging or copying objects. Avoid using functions that automatically merge object properties. Instead, use libraries and functions that offer safe deep cloning and merging. Block potentially dangerous keys, like proto, constructor, and prototype, from being set or modified. 

6. Insecure Direct Object References (IDOR)

Client-side IDOR attacks occur when an application exposes sensitive objects to users without proper access controls that validate whether they have authorization to view them. The vulnerability stems from the application trusting data or object references manipulated directly in the client-side code. Because the code typically interacts with sensitive data, JavaScript logic can be easily viewed and exploited by threat actors using this technique.

Prevention tips: Implement robust access controls that validate all requests on both the client side and the server. This comprehensive approach will ensure the user is authorized to access or modify the requested resource. Introduce role-based access controls that restrict access to resources based on the user’s role and permissions. Avoid embedding sensitive information in client-side code, including JavaScript, as this helps threat actors discover potential IDOR vulnerabilities.

Conclusion 

JavaScript is a double-edged sword: on one side, it has compelling benefits, such as its versatility and ease of use, that make it the go-to web programming language; on the other, it has innate security vulnerabilities stemming from its widespread use, client-side execution, and dynamic nature.

While the rewards of using JavaScript provide the building blocks for the web, threat actors leverage the risks it poses by wielding the other, more threatening, side of the sword. To blunt the sharp rise in increasingly sophisticated attacks targeting JavaScript vulnerabilities, you must adopt secure coding practices and employ robust defense mechanisms that reinforce your web applications in 2025 – and beyond!