Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

5/26/2020
12:40 AM
50%
50%

Content Delivery Networks Adding Checks for Magecart Attacks

Modern web applications make significant use of third-party code to drive innovation, but the software supply chain has also turned into a major source of threat. CDNs aim to change that.

In 2019, thousands of websites suffered information-stealing attacks caused by the compromise of the third-party scripts used to create their sites. Forbes magazine, consumer products maker OXO, sports outfitter Puma Australia, and learning channel Sesame Street were all targets of these so-called Magecart attacks.

While a variety of cybersecurity firms have proposed defenses to protect sites from malicious third-party content, companies that serve up website content — known as content delivery networks (CDNs) — are a natural control point from which these attacks can be caught.

Indeed, CDNs have started to roll out features to combat attacks that abuse the software supply chain to compromise website visitors through the third-party scripts used by sites to generate content. In March, for example, Cloudflare rolled out an integration with client-side security service Tala that allows the company to scan web pages for malicious content to catch third-party code that may be malicious. Such efforts are necessary because third-party supply chain attacks are difficult to catch, the firm said.

Internet infrastructure firm Akamai, too, has integrated security checks against rogue third-party components in an attempt to blunt such attacks in the future.

Dubbed the Page Integrity Manager, the new feature, announced today, has been integrated in Akamai's CDN infrastructure and will protect in real time against JavaScript code that attempts to skim information, hijack websites, or redirect a visitor, says Patrick Sullivan, chief technology offer for security and strategy at Akamai.

"We monitor the behavior of all the scripts on the site, whether they are first-party or third-party," he says. "You can think about it as monitoring the JavaScript from 'cradle to grave.'"

Third-Party Blind Spot
As people rely more on online shopping to meet their needs, attacks on websites through their third-party code providers — which cybersecurity firms have lumped together under the Magecart monicker — are posing more of a threat. In 2019, more than 4,800 attempts to hijack information from forms using third-party code happened each month, according to security firm RapidSpike

The scope of third-party component use is enormous. 

"Today, up to 70% of the code executing and rendering on your customer's browser comes from these [third-party sources]," Cloudflare stated on its blog. "All of these software integrations provide avenues for potential vulnerabilities."

Modern websites are a collection of code and components, the majority of which are from third-party suppliers such as content management systems and open source projects. Often those third parties also include other components — such as open source libraries — resulting in fourth-party code running on websites as well. 

For an average site, the total size of third-party JavaScript code is three times the size of first-party code created by the site owners, according to the HTTP Archive. In 2020, the average website ran 35 different third-party components and 31 fourth-party components, up from 18 and 10 components, respectively, in 2016, according to site-protection service Reflectiz. 

"Surprisingly and despite their growing role, third-parties on websites still remain a blind spot from cyber-security perspective," the company stated on its blog

Because they often store and serve third-party code, CDNs, such as Akamai, are both a common target of Magecart groups and a common point that can be used to protect customers. A year ago, for example, cybercriminals injected web skimmers into websites using third-party code hosted on Amazon's CloudFront CDN, affecting — among other sites — the official NBA website.

Because they can compromise a third-party service into which the ultimate target has little visibility, Magecart attacks can be very effective, Akamai's Sullivan says.

"And all kinds of fraudsters out there, they are causing suffering because some third-party provider is compromised, and now that is an entrance into the confidential information of that web session," he says, pointing to the compromise of a chatbox provider as an example. "[Fraudsters] can leverage that JavaScript that is running to basically monitor all the credit-card details that get entered, credentials, all that sensitive data, and then exfiltrate that off to an attacker controlled site." 

Akamai's Page Integrity Manager aims to find vulnerable resources in a website's code and block malicious activity by behavioral analysis. When a JavaScript determined to be benign initiates and performs a series of actions, the service will let it run. Conversely, if a JavaScript initiates and tries to read from a sensitive field or open up a netwok connection to a domain that is classified as suspicious, then the service will block the code.

"We think this is a natural extension of our service," Sullivan says. "If we are accelerating a website, it makes sense in a suite of tools to also look for suspicious behavior."

Related Content:

 

 
 
 
 
 
 
Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register
Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-36289
PUBLISHED: 2021-05-12
Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. The affected versions are before version 8.5.13, from version 8.6.0 before 8.13.5, and fro...
CVE-2021-32606
PUBLISHED: 2021-05-11
In the Linux kernel 5.11 through 5.12.2, isotp_setsockopt in net/can/isotp.c allows privilege escalation to root by leveraging a use-after-free. (This does not affect earlier versions that lack CAN ISOTP SF_BROADCAST support.)
CVE-2021-3504
PUBLISHED: 2021-05-11
A flaw was found in the hivex library in versions before 1.3.20. It is caused due to a lack of bounds check within the hivex_open function. An attacker could input a specially crafted Windows Registry (hive) file which would cause hivex to read memory beyond its normal bounds or cause the program to...
CVE-2021-20309
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11 and before 6.9.12, where a division by zero in WaveImage() of MagickCore/visual-effects.c may trigger undefined behavior via a crafted image file submitted to an application using ImageMagick. The highest threat from this vulnerability is to ...
CVE-2021-20310
PUBLISHED: 2021-05-11
A flaw was found in ImageMagick in versions before 7.0.11, where a division by zero ConvertXYZToJzazbz() of MagickCore/colorspace.c may trigger undefined behavior via a crafted image file that is submitted by an attacker and processed by an application using ImageMagick. The highest threat from this...