E-commerce security firm Sansec has found a campaign that has infected 953 online shops, the vast majority running Magento and Adobe Commerce. Attackers place a small JavaScript snippet inside database content blocks, in the cms_block tables, which loads malicious code and evades many security scanners that only check files. Sansec recommends applying Adobe security updates APSB26-73 and APSB25-88 and checking the cms_block and cms_page tables for unknown code.

What it means: Attacks on online shops usually have one goal: to steal card or account details from the checkout page without the customer or the owner noticing. This technique is dangerous because the malicious code is not in the shop’s files but in the database, inside content that looks normal in the admin panel. A file scan or reinstalling the code is therefore not enough to remove it. Many Greek online shops run on Magento, often on older versions that have not been updated for a long time. Owners should confirm with their developer that recent Adobe updates have been applied, check content blocks for scripts they do not recognise and change admin passwords. A content security policy that restricts where code may load from, and handing payment to a hosted page from the payment provider, both reduce the risk considerably. If data theft is confirmed, the Hellenic Data Protection Authority and customers may need to be notified under GDPR, as well as the payment provider.

Read the original on Sansec

Related service: Custom software

Related stories