What are Magecart attacks?
Magecart is a group of malicious online hackers who specialize in stealing credit card information from the shopping carts of customers. By injecting JavaScript code onto an e-commerce platform, hackers can redirect customers to a website that contains malware and steal their personal data. These types of attacks are called skimmers or Magecart attacks.
Recent Magecart Attack Against Magento Ecommerce
Last week Sansec, a company specializing in eCommerce malware and vulnerability detection, detected a mass breach of over 500 stores running the Magento 1 ecommerce platform. (Magento is an Adobe e-commerce platform.) All the stores were victim of a payment skimmer loaded from the naturalfreshmall.com domain.
The critical vulnerability in Magento triggered Adobe to release an emergency security update. A security flaw was detected that allowed unauthenticated remote execution (RCE) where attackers could exploit to take control of an affected system. Sansec describes this exploit as the “worst possible type and is similar in severity as the Magento Shoplift vulnerability from 2015.” Adobe issued a statement indicating attacks against Magento users have been “very limited” but urges customers to quickly download the update.
How can I prevent becoming a victim of a Magecart attack?
The recent attack against the Magento e-commerce platform being hosted by NaturalFreshMall should be a stark reminder to all online patrons they have a duty to protect themselves in addition to what you expect from your online store provider.
My advice to online shoppers is this. Be your own firewall. You don’t have to be a cybersecurity expert to protect yourself. There are a few basic steps everyone should take as a matter of habit to minimize becoming a victim of online piracy.
First and foremost, users need to have a defense-in-depth mentality. Cybersecurity is like an onion comprised of multiple layers. It’s important to define your perimeter and implement security measures to protect yourself.
Here are a few simple things online shoppers can layer onto their own cyber onion:
-
- Start with your bank or credit card issuer. Turn on all alerts you possibly can, to the point where it’s annoying and you have to go back and dial it down.
- Use virtual card numbers if your provider supports them.
- Avoid using a debit card at all costs.
- Turn on multi-factor authentication everywhere possible.
- Freeze your credit (it’s free to do).
- Install plugins to prevent ads and popups.
