Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

1/9/2019
10:30 AM
50%
50%

Magecart Mayhem Continues in OXO Breach

The home goods company confirmed users' data may have been compromised during multiple time frames over a two-year period.

OXO International, a US-based manufacturer of kitchen utensils and home goods, reported a data breach spanning two years that experts say appears to be a Magecart attack.

The company is notifying customers of a data security incident "involving sophisticated criminal activity" that may have compromised their personal data. It believes unauthorized code may have granted adversaries access to names, billing and shipping addresses, and credit card info.

In December 2018, OXO worked with forensic investigators to confirm the security of personal data entered on its website may have been exposed. It claims the windows of compromise include June 9, 2017, through November 28, 2017; June 8-9, 2018; and July 20, 2018, through October 16, 2018. Upon discovering the intruders' code, OXO worked with security consultants to investigate the incident and determine the next steps to prevent similar types of attacks in the future, officials report in a letter.

Additional evidence and further analysis identified past website vulnerabilities. OXO investigated the malicious code, removed it, conducted system scans, and reissued access credentials. It is also providing identity monitoring to customers for one year via Kroll. Qualifying members are being sent an ID by OXO they can use to access the free service.

A closer look at the breach by BleepingComputer shows this is likely a Magecart attack. Magecart, an umbrella term for at least seven cybercriminal groups, has been gaining notoriety for stealing financial data by installing digital credit card skimmers onto e-commerce sites. Attackers implement code into a target site's checkout page to lift data that customers enter. As the report explains, at least one of the OXO breaches was a Magecart attack to steal information.

Magecart's victims have expanded from consumers to globally known brands, including Ticketmaster, British Airways, and Newegg.

Read more details here.

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Microsoft Patches Wormable RCE Vulns in Remote Desktop Services
Kelly Sheridan, Staff Editor, Dark Reading,  8/13/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15224
PUBLISHED: 2019-08-19
The rest-client gem 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party.
CVE-2019-15225
PUBLISHED: 2019-08-19
In Envoy through 1.11.1, users may configure a route to match incoming path headers via the libstdc++ regular expression implementation. A remote attacker may send a request with a very long URI to result in a denial of service (memory consumption). This is a related issue to CVE-2019-14993.
CVE-2019-15223
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a NULL pointer dereference caused by a malicious USB device in the sound/usb/line6/driver.c driver.
CVE-2019-15211
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.2.6. There is a use-after-free caused by a malicious USB device in the drivers/media/v4l2-core/v4l2-dev.c driver because drivers/media/radio/radio-raremono.c does not properly allocate memory.
CVE-2019-15212
PUBLISHED: 2019-08-19
An issue was discovered in the Linux kernel before 5.1.8. There is a double-free caused by a malicious USB device in the drivers/usb/misc/rio500.c driver.