More than 100 Australian e-commerce sites have been found to contain a malicious script that is capable of stealing shoppers’ identity and card details.
How does the malware work?
A Netherlands-based security researcher, Willem de Groot, found that thousands of websites running Magento e-commerce software also run the Magentocore.net skimmer script that captures form input data from shoppers.
The skimmers illegally gain access to the control panel of e-commerce sites, often by automatically trying lots of passwords, and add a piece of JavaScript to the HTML template.
This script records keystrokes from customers and sends them to the Magentocore.net server in Moscow.
iTnews ran a scan using the PublicWWW site source code search engine and found 105 .au sites and 11 .nz sites had been hit by the Magentocore.net malware.
It stated, “The real number of malware laden sites in Australia could be higher as not all use .au domain names.”
4.2% of all Magento stores globally are currently leaking payment and customer data pic.twitter.com/Utw9W3t3Oa
— Willem de Groot (@gwillem) 27 August 2018
Protect your organisation from malware infections
Australian merchants would benefit from:
- Running antivirus software;
- Applying patches as soon as they’re released; and
- Conducting penetration tests to search for vulnerabilities in their systems.
Technology alone isn’t enough. The key to staying secure is to follow information security best practice and identify problems when they arise.
ISO 27001 is the international standard that describes the requirements for an ISMS (information security management system), a best practice approach that incorporates people, processes and technology, and recognises that information security is not about technology alone.
ISO 27001 is based on regular in-depth risk assessments and depending on your organisations risk appetite will put processes in place to help mitigate those risks. The companies above who use Magento e-commerce software didn’t plan for, or mitigate for the risks a skimmer script could pose.
Implementing an ISO 27001-compliant ISMS can help your organisation maintain the confidentiality, integrity and availability of your information assets by implementing controls that address specific risks that you face – whether they are from targeted or automated attacks.
Following a breach, an ISO 27001-compliant ISMS enables organisations to have processes and procedures in place to help minimise the impact of the breach and prove to a relevant authority that the company was following a best practice approach to its information security.
Benefits of implementing an ISO 27001 ISMS
Implementing an ISO 27001-compliant ISMS also helps to:
- Secure information in all its forms;
- Respond to evolving security threats;
- Increases resilience to cyber attacks; and
- Provide a centrally managed framework for keeping information safe.
Our ISO27001 Certified ISMS Foundation Online training course provides a complete introduction to the key elements required to achieve compliance with ISO 27001.
