Category: Cyber Security

The previously disclosed Ticketmaster attack was not a one-off event, but instead part of the largest payment card theft in history impacting over 800 ecommerce sites around the world. If we consider the true impact of this event it is absolutely astonishing. The Target supply-chain-enabled attack from a few years ago was frightening, and that was only one merchant under attack, on in-store point-of-sale systems, for a mere 9 days. The Magecart website supply chain attack leveraged digital website payment card skimming that victimized over 800 global merchants for over 3 years – multiple orders of magnitude larger and significantly more chilling in scope.

The Magecart hacker group successfully attacked some of the most sophisticated ecommerce players and operated largely undetected since 2015 by taking advantage of a client-side vulnerability that exists in every commercial website today.  In the case of Ticketmaster, Magecart actors were able to compromise a 3rd party chatbot service called Inbenta that had been embedded on the Ticketmaster site. By manipulating the Inbenta JavaScript code on Ticketmaster’s webpages, Magecart could exfiltrate payment information from every single Ticketmaster customer who was served the Inbenta code.

The client-side browser is the primary environment wherein websites display and capture critical customer and payment data. It is the front door for interaction with customers and their data. 3rd party JavaScript executes on the client-side browser and is granted unmanaged and unlimited access to the entire webpage including the ability to exfiltrate data (keylogging, web injection, form field manipulation, phishing, etc.) and deface/alter webpage content. Simply put, by integrating 3rd party JavaScript, website owners are handing out skeleton keys to the front door while they focus extensively on securing the server-side back door. Security pros must think twice about being so cavalier with the skeleton keys to their front door and diligently secure both the server side and the client side of web sessions.

Given that many 3rd party vendors have comparatively weaker security protocols than the corporate websites that run them, it makes them attractive and susceptible attack targets.  3rd party JavaScript has unlimited access to the webpage DOM. This means that every 3rd party JavaScript vendor, and the hackers that seek to exploit them, have the same level of access to all webpage elements as the website owner’s development team.

 

Once that vendor is compromised, their code can be modified or replaced representing a major vulnerability for website owners. Magnifying the potential damage, once a hacker compromises a single 3rd party vendor, they have access to every single website that runs the tool.

3rd party JavaScript is served from external remote servers and executes on the client. This makes current security approaches such as pentesting, periodic code review, and dynamic application security testing entirely incapable of preventing these attacks. Since client-side connections with external servers are completely unmanaged and largely unmonitored, the company has no visibility into what these 3rd parties are doing and no way to prevent hackers from maliciously exploiting this access. Nearly every corporate website is currently unavoidably vulnerable to this attack vector.

Request an Expert Walk-Through of Data Exfiltration from Your Site

Here’s what you can do …

Luckily, there are steps that security teams can take to mitigate or even eliminate the risks of 3rd party vendors. From stringent prevention-level controls that still enable the beneficial usage of 3rd parties all the way to usage limitations that are restrictive and counterproductive, there are practical things that security pros can implement today to protect their companies from the next website supply chain attack.

Prevention is the best option

The best thing security pros can do to prevent an attack like Magecart is to implement technology that controls the access and permissions of every 3rd party running on the page. This insulates websites, their corporate owners, their visitors and private customer data from the inappropriate behaviors of overzealous 3rd parties and the more malicious activities of hackers that seek to exploit them.

Prevention-level approaches for addressing client-side connections not only secure the organization but are required for adequate data control defined by regulatory compliance (e.g. GDPR and California’s newly passed Digital Privacy Law). Without the ability to control private customer data and prevent unauthorized access by 3rd party website vendors or hackers, an organization is in a state of non-compliance.  

Additionally, a major benefit of prevention is that with security and privacy concerns satisfied, the business is free to deploy beneficial 3rd party website tools to achieve the shared goal of the business – revenue generation. By using 3rd parties on otherwise sensitive pages (e.g. payment, registration, login) the business is able to optimize their conversion rates at critical junctions of the customer journey. By using new and innovative tools, the business can be dynamic and differentiate from their peers who are forced to move slower and in a more restricted fashion. The end result is a secure and compliant site that delivers a superior customer experience and produces better analytics.

Monitoring and detection

While prevention is obviously the best method, monitoring provides a less secure and reactive option. Magecart’s multi-year activities are evidence that detection, although helpful, is woefully inadequate. The major inadequacy of detection approaches is that they are incapable of detecting these attacks in real-time. Even with a multitude of global sensors detection schemes may miss highly targeted and hyper-segmented attacks altogether.

Although they may detect an attack, they assuredly will never detect the attack in time for the website owner to avoid some damage. After all, even if the majority of the damage is avoided after detection, any leakage of customer data constitutes a compliance violation that will require full public disclosure. The resulting fines, PR crises and operational fire drills are typically crippling. We have not even begun to discuss that detection approaches have no remediation capability, so the only response is to completely remove the tool and suffer the operational and capital costs associated with losing and/or replacing its functionality. Ultimately, even this removal does not address the root cause leaving the site entirely and continuously exposed to future attacks via another compromised 3rd party tool operating on the site.

Fundamentally, these approaches are not scalable. 3rd party JavaScript changes routinely and sites are frequently changing and rotating the vendors they use. The alert fatigue coupled with the reactive nature of detection and the persistence of the underlying vulnerability renders these approaches severely limited.

Vendor due diligence assessments

Many organizations, and especially those under strict compliance mandates, perform routine, comprehensive vendor security assessments. Although, well intended and highly recommended, such exercises only provide a point-in-time assessment – and even then, only produce a comfortability level rating of a vendor’s security program. Any vendor can be breached at any time.  In practice we see some of the most seemingly mature and trusted 3rd party website tools be breached and exploited to victimize hundreds of websites. Although these assessments provide a semblance of comfortability and satisfy some compliance requirements, they do not provide prevention or even continuous detection. These assessments should be part of a comprehensive security program but are in no way adequate as a stand-alone approach to mitigating or preventing 3rd party risk.

Restricting the usage of 3rd party tools

The last resort would be to exercise a debilitating level of caution. The result is limiting the usage of beneficial 3rd party tools and is entirely counterproductive to the overall goals of the business. Limiting the number of tools used limits the organization’s ability to provide an engaging user experience and extract meaningful analytics. Relying only on “mature” or “trusted” 3rd party vendors and missing out on new and innovative tools makes delivering a compelling, differentiated, and dynamic web presence difficult. Restricting 3rd party tool usage in on sensitive areas of the website cripples conversion rates if customer experience and analytics are not optimized at critical points in the customer journey – like account registration, transactions, and check out.

The Time to Act is Now

It’s likely that the more than 800 compromised sites in this attack are just the tip of the iceberg given the amount of time that this attack was running undetected. Similar attacks on major global airlines, online electronics merchants, online mass merchants and credit rating agencies have recently been reported as exploited by this same attack vector.  3rd party vendors have shifted blame to site owners to incorporate the necessary security measures themselves.  It is therefore critical that site owners proactively employ preventative technology to prevent website supply chain attacks and continue to benefit from the differentiating utility they provide.

Next Steps

Quickly access an assessment of your current risk level.

If the industry wide susceptibility to this attack vector does not have you concerned about your own current vulnerability:

Request a customized expert walk-through of data exfiltration on your site @
www.sourcedefense.com

 

 

 

 

A new study has found that nearly two in five workers admitted to clicking on a link or opening an attachment from a sender they did not recognize.

This security slip-up is significant due to the installation of malware on their devices and the harvesting of sensitive corporate data.

Resulting from the societal BYOD (bring your own devices) trend, the Finn Partners Research study shows that more than half of employees (55 percent) are using their personal devices for work, which directly impacts increased vulnerability to hackers, malware and data breaches. In addition, only 26 percent of employees change their login credentials and/or passwords for personal and work applications at least once a month.

“The fastest and easiest way for bad actors to gain access to sensitive organizational data is for employees to click on nefarious links – we know that around 40 percent of our workforce is engaging in such behavior,” said Jeff Seedman, senior partner at Finn Partners who leads the firm’s U.S. cybersecurity specialty group. “Employees often assume their personal devices are secure, but then neglect to update their software regularly or put any protection policies in place. This is a serious problem, especially if a device loaded with company data gets lost, stolen or hacked.”

Only 25 percent of employees said they receive “cyber hygiene” training on a monthly basis from their IT team. Cyber hygiene refers to the updating of operating systems on devices, checking for security patches, and changing passwords […] Read more »

 

 

As business leaders become increasingly conscious of the impact cybersecurity can have on business outcomes, they should harness increased support and take advantage of six emerging trends (listed below) to improve their enterprise’s resilience and elevate their own standing, according to Gartner, Inc.

1. Senior business executives are finally becoming aware that cybersecurity has a significant impact on the ability to achieve business goals and protect corporate reputation. “Business leaders and senior stakeholders at last appreciate security as much more than just tactical, technical stuff done by overly serious, unsmiling types in the company basement,” says Peter Firstbrook, research vice president at Gartner. “Security organizations must capitalize on this trend by working closer with business leadership and clearly linking security issues with business initiatives that could be affected.”
2. Legal and regulatory mandates on data protection practices are impacting digital business plans and demanding increased emphasis on data liabilities. “It’s no surprise that, as the value of data has increased, the number of breaches has risen too,” says Firstbrook. “In this new reality, full data management programs — not just compliance — are essential, as is fully understanding the potential liabilities involved in handling data.”
3. Security products are rapidly exploiting cloud delivery to provide more agile solutions.“Avoid making outdated investment decisions,” advises Firstbrook. “Seek out providers that propose cloud-first services, that have solid data management and machine learning (ML) competency, and that can protect your data at least as well as you can.”
4. Machine learning is providing value in simple tasks and elevating suspicious events for human analysis. Gartner predicts that by 2025, machine learning will be a normal part of security solutions and w3ill offset ever-increasing skills and staffing shortages. But buyer beware, says Firstbrook: “Look at how ML can address narrow and well-defined problem sets, such as classifying executable files, and be careful not to be suckered by hype. Unless a vendor can explain in clear terms how its ML implementation enables its product to outperform competitors or previous approaches, it’s very difficult to unpack marketing from good ML.”
5. Security buying decisions are increasingly based on geopolitical factors along with traditional buying considerations. Increasing levels of cyber warfare, cyber political interference and government demands for backdoor access to software and services have resulted in new geopolitical risks in software and infrastructure buying decisions, Gartner says. “It’s vital to account for the geopolitical considerations of partners, suppliers and jurisdictions that are vital to your organization,” says Firstbrook. “Include supply chain source questions in RFIs, RFPs and contracts”  […] Read more »

 

 

A new study, Cybersecurity in the City: Ranking America’s Most Insecure Metros, has identified Las Vegas, Memphis and Charlotte as America’s most cyber insecure cities.

America’s Most Insecure Metros

10. Tampa – St. Petersburg
9. Orlando – Daytona Beach
8. West Palm Beach – Ft. Pierce
7. Jacksonville
6. Birmingham
5. Providence
4. Houston
3. Charlotte
2. Memphis
1. Las Vegas

America’s Least Vulnerable Metros

5. St. Louis
4. Seattle – Tacoma
3. Norfolk-Portsmouth-Newport News
2. Greensboro – Winston Salem
1. Richmond

“The Cybersecurity in the City: Ranking America’s Most Insecure Metros report emphasizes just how expansive both the vulnerability and threat landscapes have gotten in the U.S.,” said Guy Moskowitz, founder & CEO, Coronet. “While big companies may have the budgets, personnel and resources to protect their assets reasonably well, mid-market and small businesses are mostly left to fend for themselves. This is both unfortunate and a recipe for disaster” […] Read more »

 

Mayday, mayday” is a standard international distress signal. With the European Union’s General Data Protection Regulation (GDPR) going live on May 25, 2018, the phrase seems particularly apt.

What is the GDPR? Weighing in at over 50,000 words, the GDPR revises a decades-old EU privacy directive that harkens back to 1995, a time when there was more postal mail than email. The GDPR restricts how organizations can collect, use and retain personal data, and provides Europeans with certain rights to halt collection, and to obtain copies, correction and, at times, destruction of their data.

How does it impact U.S. businesses? The EU seeks to apply the GDPR to all companies regardless of location if they collect personal data from individuals in the EU, such as through websites targeting EU consumers with goods or services (whether paid or unpaid), or by monitoring the behavior of people in the EU. The GDPR also applies to vendors (and corporate partners and affiliates) who end up storing, transferring, processing or using EU personal data even though another company initially collected it.

What are the Cybersecurity Requirements? Companies must implement “appropriate technical and organizational measures to ensure a level of security appropriate to the risk.”  Doing so requires an organization to evaluate “the state of the art” of security; the costs of implementation; the nature, scope, context and purposes of processing the personal data; and the risks to individual rights and freedoms. Data protection must be implemented “by design and by default.”

Are there breach notification requirements? Yes. If a data breach is likely to result in “a risk” to an individual’s rights and freedoms, the company must notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it. When the breach is likely to result in a “high risk” to rights and freedoms, notifications also must be made without undue delay to the affected individuals.

Can we get ready in a few weeks? It is unlikely. The EU gave companies two years. Still, achieving compliance may be more straightforward for organizations that do not collect sensitive categories of personal data (race, ethnicity, health, sex life, sexual orientation, criminal history, trade union membership, political/religious/philosophical beliefs, genetics or biometrics) and whose activities are unlikely to result in high risks to individual rights and freedoms (such as through large-scale data processing, new technologies or systematic monitoring, profiling and automated decision-making) […] Read more »