Skip to main content

Digital Skimmers Are Dangerous For Websites With E-Commerce

By June 11, 2019May 17th, 2022Cybersecurity

If your business website incorporates an e-Commerce platform that allows you to sell directly to your customers, be aware. According to the latest research by the security firm RiskIQ, there are currently more than half a dozen large, well-organized hacking groups targeting businesses just like yours.

These groups are all using the same basic family of malicious code, collectively referred to as Magecart.  Their preferred targets are websites that use the Magento e-commerce platform. Although historically, they haven’t been bashful about targeting other e-commerce platforms as well.

The gist of how they do their damage amounts to digital skimming.  This type of attack is conducted by first penetrating your site’s security features. This allows the hackers to inject malicious code onto your site that monitors any transactions that take place when your customers make a purchase from you. In the process, they are “skimming” their payment details and sending them off to a server under the control of the hackers, where they can make use of the payment data for their own purposes.

Given the nature of the attack, there’s no outward sign that your customers’ payment information has been compromised.  They’ll only find out later, when transactions they have not authorized begin appearing on their payment card statements.

In tandem with the research conducted by RiskIQ, Malwarebytes security researcher Jerome Segura has uncovered a new twist on the basic Magecart skimming tactic. This new tactic sees attackers injecting e-commerce sites with code that causes it to pop up a malicious iFrame at the time of payment. Then, the user simply hands over their payment data, not suspecting that it’s not a normal part of the e-commerce platform.

In whatever way it is accomplished, the researchers following the development and maturation of Magecart attacks all agree on one thing.  Once the data has been collected, it is sent to a server somewhere in Russia.  Beyond that, the trail becomes too tangled to follow.

Stay alert, and make sure your IT folks are on guard against the threat.  Your customers will thank you for it.

Jason Manteiga

Jason J. Manteiga, Vice President of Olmec Systems, has been part of the company for over the past 20 years. He believes that having a great work environment and supportive team, is the ultimate key to success. Since being in the IT realm for over 25 years, Jason, along with Olmec Systems, has been on the Inc. 5000 “List of America’s Fastest Growing Private Companies” and Channel Futures MSP 501 “Top Managed Service Providers in North America,” along with other awards and nominations. Jason earned his Bachelor Degree in Information Systems from the New Jersey Institute of Technology. He also holds certifications in Microsoft MCSE, VMWare VCP, and Cisco CCNA. In his spare time, Jason is a contributor for The Center for Social & Legal Research (Privacy Exchange) and a member of the Morris County Chamber of Commerce. His hobbies include cycling and kayaking. He currently lives in New Jersey with his wife, two daughters and son.