Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/26/2020
12:40 AM
50%
50%

Content Delivery Networks Adding Checks for Magecart Attacks

Modern web applications make significant use of third-party code to drive innovation, but the software supply chain has also turned into a major source of threat. CDNs aim to change that.

In 2019, thousands of websites suffered information-stealing attacks caused by the compromise of the third-party scripts used to create their sites. Forbes magazine, consumer products maker OXO, sports outfitter Puma Australia, and learning channel Sesame Street were all targets of these so-called Magecart attacks.

While a variety of cybersecurity firms have proposed defenses to protect sites from malicious third-party content, companies that serve up website content — known as content delivery networks (CDNs) — are a natural control point from which these attacks can be caught.

Indeed, CDNs have started to roll out features to combat attacks that abuse the software supply chain to compromise website visitors through the third-party scripts used by sites to generate content. In March, for example, Cloudflare rolled out an integration with client-side security service Tala that allows the company to scan web pages for malicious content to catch third-party code that may be malicious. Such efforts are necessary because third-party supply chain attacks are difficult to catch, the firm said.

Internet infrastructure firm Akamai, too, has integrated security checks against rogue third-party components in an attempt to blunt such attacks in the future.

Dubbed the Page Integrity Manager, the new feature, announced today, has been integrated in Akamai's CDN infrastructure and will protect in real time against JavaScript code that attempts to skim information, hijack websites, or redirect a visitor, says Patrick Sullivan, chief technology offer for security and strategy at Akamai.

"We monitor the behavior of all the scripts on the site, whether they are first-party or third-party," he says. "You can think about it as monitoring the JavaScript from 'cradle to grave.'"

Third-Party Blind Spot
As people rely more on online shopping to meet their needs, attacks on websites through their third-party code providers — which cybersecurity firms have lumped together under the Magecart monicker — are posing more of a threat. In 2019, more than 4,800 attempts to hijack information from forms using third-party code happened each month, according to security firm RapidSpike

The scope of third-party component use is enormous. 

"Today, up to 70% of the code executing and rendering on your customer's browser comes from these [third-party sources]," Cloudflare stated on its blog. "All of these software integrations provide avenues for potential vulnerabilities."

Modern websites are a collection of code and components, the majority of which are from third-party suppliers such as content management systems and open source projects. Often those third parties also include other components — such as open source libraries — resulting in fourth-party code running on websites as well. 

For an average site, the total size of third-party JavaScript code is three times the size of first-party code created by the site owners, according to the HTTP Archive. In 2020, the average website ran 35 different third-party components and 31 fourth-party components, up from 18 and 10 components, respectively, in 2016, according to site-protection service Reflectiz. 

"Surprisingly and despite their growing role, third-parties on websites still remain a blind spot from cyber-security perspective," the company stated on its blog

Because they often store and serve third-party code, CDNs, such as Akamai, are both a common target of Magecart groups and a common point that can be used to protect customers. A year ago, for example, cybercriminals injected web skimmers into websites using third-party code hosted on Amazon's CloudFront CDN, affecting — among other sites — the official NBA website.

Because they can compromise a third-party service into which the ultimate target has little visibility, Magecart attacks can be very effective, Akamai's Sullivan says.

"And all kinds of fraudsters out there, they are causing suffering because some third-party provider is compromised, and now that is an entrance into the confidential information of that web session," he says, pointing to the compromise of a chatbox provider as an example. "[Fraudsters] can leverage that JavaScript that is running to basically monitor all the credit-card details that get entered, credentials, all that sensitive data, and then exfiltrate that off to an attacker controlled site." 

Akamai's Page Integrity Manager aims to find vulnerable resources in a website's code and block malicious activity by behavioral analysis. When a JavaScript determined to be benign initiates and performs a series of actions, the service will let it run. Conversely, if a JavaScript initiates and tries to read from a sensitive field or open up a netwok connection to a domain that is classified as suspicious, then the service will block the code.

"We think this is a natural extension of our service," Sullivan says. "If we are accelerating a website, it makes sense in a suite of tools to also look for suspicious behavior."

Related Content:

 

 
 
 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 8/10/2020
Researcher Finds New Office Macro Attacks for MacOS
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/7/2020
Exploiting Google Cloud Platform With Ease
Dark Reading Staff 8/6/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Changing Face of Threat Intelligence
The Changing Face of Threat Intelligence
This special report takes a look at how enterprises are using threat intelligence, as well as emerging best practices for integrating threat intel into security operations and incident response. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8720
PUBLISHED: 2020-08-13
Buffer overflow in a subsystem for some Intel(R) Server Boards, Server Systems and Compute Modules before version 1.59 may allow a privileged user to potentially enable denial of service via local access.
CVE-2020-12300
PUBLISHED: 2020-08-13
Uninitialized pointer in BIOS firmware for Intel(R) Server Board Families S2600CW, S2600KP, S2600TP, and S2600WT may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-12301
PUBLISHED: 2020-08-13
Improper initialization in BIOS firmware for Intel(R) Server Board Families S2600ST, S2600BP and S2600WF may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2020-7307
PUBLISHED: 2020-08-13
Unprotected Storage of Credentials vulnerability in McAfee Data Loss Prevention (DLP) for Mac prior to 11.5.2 allows local users to gain access to the RiskDB username and password via unprotected log files containing plain text credentials.
CVE-2020-8679
PUBLISHED: 2020-08-13
Out-of-bounds write in Kernel Mode Driver for some Intel(R) Graphics Drivers before version 26.20.100.7755 may allow an authenticated user to potentially enable denial of service via local access.