Thousands of online shops compromised for credit card theft

Attackers injected malicious JavaScript code into e-commerce websites to steal payment card data

Almost 6,000 online shops have been compromised by hackers who added specially crafted code that intercepts and steals payment card details.

These online skimming attacks were first discovered by Dutch researcher Willem de Groot a year ago. At that time, he found 3,501 stores containing the malicious JavaScript code. However, instead of getting better, the situation is increasingly worse.

By March the number of infected shops grew by almost 30 percent to 4,476, and by September, it reached 5,925. More than 750 online stores who were unwillingly skimming payment card details for attackers in 2015 are still doing so today, showing that this type of activity can go undetected for months, the researcher said in a blog post.

De Groot's data suggests there are multiple groups engaged in online skimming. While in 2015, there were variants of the same malware code, today there are three distinct malware families with a total of nine variants.

"The first malware just intercepted pages that had checkout in the URL," the researcher said. "Newer versions also check for popular payment plugins such as Firecheckout, Onestepcheckout, and Paypal."

The malicious code is obfuscated and is deployed using known vulnerabilities in content management solutions or e-commerce software that website owners have failed to patch.

What's worse is that some shop owners don't seem to grasp the seriousness of these issues or understand their impact. De Groot gives some examples of the worst answers he has received from companies when he attempted to inform them about the compromises.

"We don’t care, our payments are handled by a 3rd party payment provider," one unnamed shop owner said.

"Our shop is safe because we use HTTPS," said another.

HTTPS protects against man-in-the-middle attacks, where the attacker is in a position on the network to intercept traffic between a user and a server. However, in this case, the malicious code runs on the server itself and is served over HTTPS, so it can see whatever information users enter into websites.

As for using a third-party payment processor, "if someone can inject Javascript into your site, your database is most likely also hacked," de Groot said.

The good news is that some shop owners are taking action, with 334 stores fixed in a 48-hour period. On the other hand, during the same time period, 170 new stores were hacked.

De Groot has published the list of compromised websites on Github.

Join the CSO newsletter!

Error: Please check your email address.

Tags hackers

More about

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place