Magecart Coming out of the Shadows - How Businesses can Take Action to Protect Customers
Data breaches continue to dominate headlines and there’s no sign of attacks slowing down any time soon. We’re now seeing cyber-criminal groups emerge such as Magecart, who have targeted ecommerce businesses for customer credit card details. Ticketmaster has already fallen to Magecart but other businesses could suffer the same fate.
Yonathan Klijnsma, a threat researcher who has tracked Magecart for more than a year, notably described the group as “the thriving criminal underworld that has operated in the shadows for years”, many e-commerce companies simply didn’t recognise Magecart – until now. RiskIQ’s Black Friday E-commerce Blacklist report found Magecart is thriving, identifying it to be the cause of at least 319,000 cyber incidents in 2018.
Considering Magecart is becoming more prolific, as shown by the alarming rate at which digital credit card skimmers are found to be compromising e-commerce sites, what do businesses need to be aware of about Magecart? Why are these attacks becoming more common and what actions can be taken to reduce the risks?
Magecart emerging from the shadows
Magecart groups are cyber-criminal gangs targeting the e-commerce space by identifying and using known server vulnerabilities and injecting card payment skimming code. The code collects sensitive data such as names, credit card numbers, and security codes on an attacker-controlled server, often for months before being discovered.
This data is sold to criminal gangs on the dark web for a lucrative profit.
Traditionally, hacking groups have used generic code to test for weaknesses in organisations until succeeding. Magecart heavily differentiates itself. The group dangerously adapts by opting for ‘personalised malware’ which is malware designed with a specific victim in mind and modified to attack the intended victim’s particular infrastructure.
Magecart’s versatility means its attacks can also use third-party tools as a way into a company’s system, as seen with the Ticketmaster breach.
However, in the case of the Newegg breach, the website server was directly comprised – Magecart integrated with its payment system, becoming part of the company’s infrastructure. This way, Magecart can find success, as firstly, it’s harder for the business to spot data theft and secondly, by having script sitting on a website, card CVV numbers can be easily captured.
The stakes could not be higher for e-commerce businesses. Recently, Gemalto found that 70% of consumers would stop doing business with a company if it experienced a data breach.
Worryingly, recent Ensighten research also found that nearly half (46%) of enterprises believe they’re on the brink of a website breach.
The current landscape
Prevention leads to protection
There are already existing data protection acts in place to safeguard PII data and the onus has been placed on strengthening protection globally. With last year’s introduction of GDPR and the upcoming introduction of the California Customer Privacy Act (CCPA), and already established regulations such as Payment Card Industry Data Security Standard (PCI DSS), damage limitation and incident response are essential.
Only with a firm understanding of Magecart can we look at prevention to help protect businesses against the attacks associated with it. Businesses must turn their eyes inward to their organisations and security strategy.
The key to a robust marketing security strategy, however, is having the right solutions in place to protect data across apps and websites. In the event of a third-party script being compromised businesses that employ website data leak technology can prevent leaks before they take place.
If 2018 was Magecart’s coming out party, 2019 is the year the e-commerce industry strikes a blow to the group’s activities. These relatively simple cyber threat measures could be the difference between a thriving business, and one facing debilitating GDPR and PCI DSS sanctions.