Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Cloud

5/20/2019
10:00 AM
Connect Directly
Twitter
RSS
E-Mail
100%
0%

7 Signs of the Rising Threat of Magecart Attacks in 2019

Magecart attacks continue to grow in momentum. Here are the stats and stories that show what's behind the mayhem.
Previous
1 of 8
Next

Popping up in various permutations for the better part of four years now, the online payment skimming operations run by Magecart fraudsters continue to intensify in 2019. Targeting vulnerable content management systems used for running payment on e-commerce sites, Magecart once was used to describe the group running these attacks. But as its number widened to as many as 12 major identifiable criminal syndicates, the Magecart moniker is just as likely to refer to the common techniques they use.

Magecart attacks work on the same principles that a POS skimmer would at a physical cash register. The bad guys find a way to quietly insert scripts onto compromised servers running payment systems to steal customer data as it's entered by customers on an e-commerce site, sending that data silently to the attackers without interrupting the payment mechanism.

"With the number of criminal groups operating these skimming campaigns, it's likely one of the biggest threats facing e-commerce right now," said Yonathan Klijnsma, threat researcher for RiskIQ, late last year.

Security experts like Bob Rudis, chief data scientist at Rapid7, believe this has to do with the work done to reduce POS fraud through the use of chip-based credit cards.

"Attackers still want payment card data, since they have their own playbooks full of successful steps they can take to turn digits into dollars,” Rudis recently wrote. "Rather than abandon all this coin, they've refocused their efforts to the server side."

Last year we saw anecdotal evidence of this with high-profile Magecart attacks against the likes of British Airways, Ticketmaster, and NewEgg. The hits keep coming, and the signs are mounting that Magecart is gaining even more momentum this year.

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
White Papers
More White Papers
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/27/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
Register for Dark Reading Newsletters
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8603
PUBLISHED: 2020-05-27
A cross-site scripting vulnerability (XSS) in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow a remote attacker to tamper with the web interface of affected installations. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or ...
CVE-2020-8604
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.
CVE-2020-8605
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. Authentication is required to exploit this vulnerability.
CVE-2020-8606
PUBLISHED: 2020-05-27
A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
CVE-2020-11075
PUBLISHED: 2020-05-27
In Anchore Engine version 0.7.0, a specially crafted container image manifest, fetched from a registry, can be used to trigger a shell escape flaw in the anchore engine analyzer service during an image analysis process. The image analysis operation can only be executed by an authenticated user via a...