In 2019, thousands of websites suffered information-stealing attacks caused by the compromise of the third-party scripts used to create their sites. Forbes magazine, consumer products maker OXO, sports outfitter Puma Australia, and learning channel Sesame Street were all targets of these so-called Magecart attacks.
While a variety of cybersecurity firms have proposed defenses to protect sites from malicious third-party content, companies that serve up website content — known as content delivery networks (CDNs) — are a natural control point from which these attacks can be caught.
Indeed, CDNs have started to roll out features to combat attacks that abuse the software supply chain to compromise website visitors through the third-party scripts used by sites to generate content. In March, for example, Cloudflare rolled out an integration with client-side security service Tala that allows the company to scan web pages for malicious content to catch third-party code that may be malicious. Such efforts are necessary because third-party supply chain attacks are difficult to catch, the firm said.
Internet infrastructure firm Akamai, too, has integrated security checks against rogue third-party components in an attempt to blunt such attacks in the future.
Third-Party Blind Spot
As people rely more on online shopping to meet their needs, attacks on websites through their third-party code providers — which cybersecurity firms have lumped together under the Magecart monicker — are posing more of a threat. In 2019, more than 4,800 attempts to hijack information from forms using third-party code happened each month, according to security firm RapidSpike.
The scope of third-party component use is enormous.
"Today, up to 70% of the code executing and rendering on your customer's browser comes from these [third-party sources]," Cloudflare stated on its blog. "All of these software integrations provide avenues for potential vulnerabilities."
Modern websites are a collection of code and components, the majority of which are from third-party suppliers such as content management systems and open source projects. Often those third parties also include other components — such as open source libraries — resulting in fourth-party code running on websites as well.
"Surprisingly and despite their growing role, third-parties on websites still remain a blind spot from cyber-security perspective," the company stated on its blog.
Because they often store and serve third-party code, CDNs, such as Akamai, are both a common target of Magecart groups and a common point that can be used to protect customers. A year ago, for example, cybercriminals injected web skimmers into websites using third-party code hosted on Amazon's CloudFront CDN, affecting — among other sites — the official NBA website.
Because they can compromise a third-party service into which the ultimate target has little visibility, Magecart attacks can be very effective, Akamai's Sullivan says.
"We think this is a natural extension of our service," Sullivan says. "If we are accelerating a website, it makes sense in a suite of tools to also look for suspicious behavior."