In a recent article published by security firm Sucuri the analysis of a new attack campaign targeting the popular WooCommerce WordPress plugin. The plugin is a free and open-source WordPress plugin with more than 5 million active installs that make it easy to run e-commerce sites, it is seen as a particularly handy tool for brick and mortar shops to generate online sales and an online presence. In the article, it was noted that WordPress plugins have been the target of similar styled attacks in the past, with Magento and Prestashop been targeted extensively in the past. The security firm refers to these attacks as card swipers that traditionally involve malicious code making modifications to payment details within the plugin settings. Typically these modifications may involve forwarding payments to the attacker’s PayPal email instead of the legitimate website owner. However, the campaign targeting WooCommerce involves injecting dedicated card swiping malware into WordPress is relatively new.
The attack was discovered when a client reported that multiple customers had complained of fraudulent credit card transactions shortly after making a purchase on their website. It struck the researcher as odd due to the fact that the client didn’t use other platforms known for experiencing these kinds of attacks but rather WordPress and WooCommerce.
Further, it was discovered that the malicious code had several layers of concatenated which would make it harder for a webmaster to detect any malicious intent. This is a common tactic employed by both PHP malware and other malware types to prevent detection. The malware itself was included in the site's core files, rather than what is typically seen. Typically, the card skimming malware is loaded from a third-party website under the control of the hacker. This has led many researchers to classify MageCart attacks as a form of supply-chain attack. This further differentiates the WooCommerce campaign from earlier attacks as it would appear the supply chain aspect is missing and replaced by a direct compromise of the website's code. The hacker, or hackers, in this case, went to several lengths to cover their tracks, this was done namely by dumping details into two separate image files. This is not uncommon, however, the speed at which the hacker moved was. By the time researchers began analyzing the website the files created to store the images had been cleared. Making analysis a far more incomplete task than many researchers would like.
WooCommerce will continue to be targeted
For the owners of the compromised website, the obvious question to ask is how did the hacker get in? The answer is generally not as easy to answer. In some case the victim may have fallen victim to a common vulnerability exploited on mass, this further leads to an easy fix of patching the vulnerability to prevent further exploitation. In this instance, there is less certainty to how the hackers compromised the website. It may have been a compromised wp-admin account, SFTP password, hosting password, or some piece of vulnerable software in the environment not yet known to security researchers. As an extra safety measure researchers advise that WordPress site owners disable direct file editing for wp-admin by adding the following line to your wp-config.php file: “define( ‘DISALLOW_FILE_EDIT’, true );”. In concluding researchers noted that,
“The infection detailed above is the first case of this kind that I’ve found this year, but since working on this website, I have seen a handful of other cases, all with varying payloads. Some attackers have targeted WooCommerce, others target Stripe, but the fact remains that WordPress websites with eCommerce features and online transactions will almost certainly continue to be targeted going forward…This case is a perfect example of why both file integrity monitoring and regularly checking the integrity of your core files is crucial to maintaining a healthy, secure website.”
Future attacks targeting the WooCommerce platform, as well as others including Stripe and Magento, can be expected to continue. Such an assumption is not only based on this latest campaign but campaigns that targeted the plugin dating back to August 2018. In that campaign, over 7,000 websites were injected with MagentoCore.net an incredibly aggressive MageCart skimmer. All the infections were eventually tied to a single well-resourced hacking group and the incident served as a benchmark for other campaigns to aspire to. It is widely believed that the group behind the 2018 campaign was also behind the infamous Ticketmaster incident which still ranks as one of the worst data breaches to date.
Mitigating the Threat
It is not only smaller businesses that fall victim to these attacks. In November 2019 US retail giant Macy’s announced they had suffered a data breach. In a public statement, the company said,
“On October 15, 2019, we were alerted to a suspicious connection between macys.com and another website. Our security teams immediately began an investigation. Based on our investigation, we believe that on October 7, 2019, an unauthorized third party added unauthorized computer code to two (2) pages on macys.com.The unauthorized code was highly specific and only allowed the third party to capture information submitted by customers on the following two (2) macys.com pages: (1) the checkout page - if credit card data was entered and “place order” button was hit; and (2) the wallet page - accessed through My Account. Our teams successfully removed the unauthorized code on October 15, 2019…We are aware of a data security incident involving a small number of our customers on Macys.com. We have investigated the matter thoroughly, addressed the cause and have implemented additional security measures as a precaution. All impacted customers have been notified, and we are offering consumer protections to these customers at no cost.”
British Airways also suffered a similar incident where authorities found that the aviation company was liable to be fined a record-breaking 183 million GBP. The fine was as a result of the company not employing security controls deemed adequate to protect the sensitive data of many of its clients. Smaller businesses are equally liable to rack up fines in an era where many countries and economic zones are enforcing legislation to protect data privacy. The European Union’s General Data Protection Regulation (GDPR) is one such piece of legislation empowering regulatory bodies to hand out fines. Website owners are advised to conduct online sales in accordance with these laws, otherwise, a fine will be added to their list of worries.