Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/26/2020
12:40 AM
50%
50%

Content Delivery Networks Adding Checks for Magecart Attacks

Modern web applications make significant use of third-party code to drive innovation, but the software supply chain has also turned into a major source of threat. CDNs aim to change that.

In 2019, thousands of websites suffered information-stealing attacks caused by the compromise of the third-party scripts used to create their sites. Forbes magazine, consumer products maker OXO, sports outfitter Puma Australia, and learning channel Sesame Street were all targets of these so-called Magecart attacks.

While a variety of cybersecurity firms have proposed defenses to protect sites from malicious third-party content, companies that serve up website content — known as content delivery networks (CDNs) — are a natural control point from which these attacks can be caught.

Indeed, CDNs have started to roll out features to combat attacks that abuse the software supply chain to compromise website visitors through the third-party scripts used by sites to generate content. In March, for example, Cloudflare rolled out an integration with client-side security service Tala that allows the company to scan web pages for malicious content to catch third-party code that may be malicious. Such efforts are necessary because third-party supply chain attacks are difficult to catch, the firm said.

Internet infrastructure firm Akamai, too, has integrated security checks against rogue third-party components in an attempt to blunt such attacks in the future.

Dubbed the Page Integrity Manager, the new feature, announced today, has been integrated in Akamai's CDN infrastructure and will protect in real time against JavaScript code that attempts to skim information, hijack websites, or redirect a visitor, says Patrick Sullivan, chief technology offer for security and strategy at Akamai.

"We monitor the behavior of all the scripts on the site, whether they are first-party or third-party," he says. "You can think about it as monitoring the JavaScript from 'cradle to grave.'"

Third-Party Blind Spot
As people rely more on online shopping to meet their needs, attacks on websites through their third-party code providers — which cybersecurity firms have lumped together under the Magecart monicker — are posing more of a threat. In 2019, more than 4,800 attempts to hijack information from forms using third-party code happened each month, according to security firm RapidSpike

The scope of third-party component use is enormous. 

"Today, up to 70% of the code executing and rendering on your customer's browser comes from these [third-party sources]," Cloudflare stated on its blog. "All of these software integrations provide avenues for potential vulnerabilities."

Modern websites are a collection of code and components, the majority of which are from third-party suppliers such as content management systems and open source projects. Often those third parties also include other components — such as open source libraries — resulting in fourth-party code running on websites as well. 

For an average site, the total size of third-party JavaScript code is three times the size of first-party code created by the site owners, according to the HTTP Archive. In 2020, the average website ran 35 different third-party components and 31 fourth-party components, up from 18 and 10 components, respectively, in 2016, according to site-protection service Reflectiz. 

"Surprisingly and despite their growing role, third-parties on websites still remain a blind spot from cyber-security perspective," the company stated on its blog

Because they often store and serve third-party code, CDNs, such as Akamai, are both a common target of Magecart groups and a common point that can be used to protect customers. A year ago, for example, cybercriminals injected web skimmers into websites using third-party code hosted on Amazon's CloudFront CDN, affecting — among other sites — the official NBA website.

Because they can compromise a third-party service into which the ultimate target has little visibility, Magecart attacks can be very effective, Akamai's Sullivan says.

"And all kinds of fraudsters out there, they are causing suffering because some third-party provider is compromised, and now that is an entrance into the confidential information of that web session," he says, pointing to the compromise of a chatbox provider as an example. "[Fraudsters] can leverage that JavaScript that is running to basically monitor all the credit-card details that get entered, credentials, all that sensitive data, and then exfiltrate that off to an attacker controlled site." 

Akamai's Page Integrity Manager aims to find vulnerable resources in a website's code and block malicious activity by behavioral analysis. When a JavaScript determined to be benign initiates and performs a series of actions, the service will let it run. Conversely, if a JavaScript initiates and tries to read from a sensitive field or open up a netwok connection to a domain that is classified as suspicious, then the service will block the code.

"We think this is a natural extension of our service," Sullivan says. "If we are accelerating a website, it makes sense in a suite of tools to also look for suspicious behavior."

Related Content:

 

 
 
 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
IoT Vulnerability Disclosure Platform Launched
Dark Reading Staff 10/19/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-27155
PUBLISHED: 2020-10-22
An issue was discovered in Octopus Deploy through 2020.4.4. If enabled, the websocket endpoint may allow an untrusted tentacle host to present itself as a trusted one.
CVE-2020-27195
PUBLISHED: 2020-10-22
HashiCorp Nomad and Nomad Enterprise version 0.9.0 up to 0.12.5 client file sandbox feature can be subverted using either the template or artifact stanzas. Fixed in 0.12.6, 0.11.5, and 0.10.6
CVE-2020-7020
PUBLISHED: 2020-10-22
Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documents ...
CVE-2020-26649
PUBLISHED: 2020-10-22
AtomXCMS 2.0 is affected by Incorrect Access Control via admin/dump.php
CVE-2020-26650
PUBLISHED: 2020-10-22
AtomXCMS 2.0 is affected by Arbitrary File Read via admin/dump.php