Online Retailers Breached By An Unstoppable Credit Card Stealing Malware

Since 2014, countless e-commerce sites have been infected by a credit-card stealing software that was proven to be very difficult to stop. Security experts revealed that the malware seemed to be unstoppable because several hacking groups nowadays are using different variations of the code. The attacks have become consistent and extremely common, which prompted information security professionals to dub it as Magecart.

Magecart is a type of cyberattack wherein hackers add malicious computer code into websites as well as third-party suppliers of digital systems. Their goal is to steal credit card information as customers key in their details at a checkout page. Although stealing credit card information online, otherwise referred to as skimming, is not new, the attacks on smaller companies and on payment pages has become persistent and successful that it lead to the rise of its very own small cottage industry.

In 2018, several large scale online retailers reported that their websites have been infected by Magecart hackers. Among these retailers are Newegg, Sotheby’s, Ticketmaster, and British Airways.

Volexity researcher Matthew Meltzer said digital card skimming has attracted countless hackers due to its simplicity and high probabilities of success.

“Other attacks rely on social engineering, the installation of malware, or the direct compromise of databases containing sensitive information.” Meltzer added. “One of the reasons why digital credit card skimmers have grown in popularity is likely due to the ease of this attack methodology as well as its success rate in comparison to others,” he explained.

The success of Magecart can be partly attributed to the fact that it is almost impossible for a customer to detect, as per Symantec’s security researcher Candid Wueest.

Skimming usually happens when consumers enter their credit card info when buying something online. Wueest explained that online consumers have no way of knowing of the theft. He said, “You will have basically no chance by naked eye.”

Megacart became increasingly popular in 2018 but the malware can be traced by to 2014, according to RiskIQ’s head researcher Yonathan Klijnsma. The skimming activity has increased significantly over the years. He said the web based credit card skimming has become a small black market industry. Researchers at RiskIQ were able to track the code type used by skimmers and discovered that they were being sold in dark web forum sin 2016. That resulted to a rise in groups purchasing and selling the building blocks of code for the successful execution of the Magecart attacks.

Klijnsma reported that they discovered six groups that sold various code skimming kits. Other groups build their own, with about 11 different groups utilizing some sort of code to skim consumers’ credit card information. And even though he cannot provide a rough estimate as to the number of credit card information that were stolen, Klijnsma said he believes that skimmers had accumulated far more credit cards than what were stolen in high profile breaches such as those of Target and Home Depot.

Protect your company, your consumers, and your personal information. Call SpartanTec, Inc. now.

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

Digital Skimmers Are Dangerous For Websites With E-Commerce

If your business website incorporates an e-Commerce platform that allows you to sell directly to your customers, be aware. According to the latest research by the security firm RiskIQ, there are currently more than half a dozen large, well-organized hacking groups targeting businesses just like yours.

These groups are all using the same basic family of malicious code, collectively referred to as Magecart.  Their preferred targets are websites that use the Magento e-commerce platform. Although historically, they haven't been bashful about targeting other e-commerce platforms as well.

The gist of how they do their damage amounts to digital skimming.  This type of attack is conducted by first penetrating your site's security features. This allows the hackers to inject malicious code onto your site that monitors any transactions that take place when your customers make a purchase from you. In the process, they are "skimming" their payment details and sending them off to a server under the control of the hackers, where they can make use of the payment data for their own purposes.
Given the nature of the attack, there's no outward sign that your customers' payment information has been compromised.  They'll only find out later, when transactions they have not authorized begin appearing on their payment card statements.

In tandem with the research conducted by RiskIQ, Malwarebytes security researcher Jerome Segura has uncovered a new twist on the basic Magecart skimming tactic. This new tactic sees attackers injecting e-commerce sites with code that causes it to pop up a malicious iFrame at the time of payment. Then, the user simply hands over their payment data, not suspecting that it's not a normal part of the e-commerce platform.

In whatever way it is accomplished, the researchers following the development and maturation of Magecart attacks all agree on one thing.  Once the data has been collected, it is sent to a server somewhere in Russia.  Beyond that, the trail becomes too tangled to follow.

Conclusion - stay alert and contact SpartanTec, Inc. in Fayetteville to make sure your e-commerce solution is secure.

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

Hackers Using WhatsApp To Install Malware On Phones

If you're among the masses of people using WhatsApp, for either Android or iOS, be advised that the Israeli hacking consortium known as the NSO Group may have installed spyware on the device you use WhatsApp on.

A massive security flaw identified as CVE-2019-3568 has been discovered and weaponized by the NSO Group.

This allows them to install spyware and steal a variety of data from impacted devices.  Worse, the group is installing their Pegasus spyware, which is among the most advanced on the planet. It's very good at hiding itself, deleting incoming calls, and other log information in order to remain hidden.

The good news is that Facebook, which owns WhatsApp, has patched the flaw with an update. As long as you're using the latest version, you're protected.  Unfortunately, not everyone keeps their apps up to date. Prior to the patch being released, all 1.5 billion of the app's users were considered vulnerable.

According to the official company statement:

"The issue affects WhatsApp for Android prior to v2.19.134, WhatsApp Business for Android prior to v2.19.44, WhatsApp for iOS prior to v2.19.51, WhatsApp Business for iOS prior to v2.19.51, WhatsApp for Windows Phone prior to v2.18.348, and WhatsApp for Tizen prior to 2.18.15."

Although millions of users have already updated their software, the sad reality is that for most people, keeping apps up to date generally ranks quite low on their list of priorities. That means there are still untold millions of users who are vulnerable.

If you use the app or if you know anyone who does, the best thing you can do is to update to the latest version right away and have your phone thoroughly scanned to be sure you don't have the Pegasus Spyware already embedded in your system.

Call SpartanTec, Inc. to help your company setup an effective data protection program. 

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

Google Giving More Flexibility To Private Data Removal

Tech giant Google recently unveiled the next step in its plan to put more power in the hands of users when it comes to their own data.  The most recent change involves the introduction of a new auto-delete feature tied to your Google account.

It will allow you to set your Location History, Web data and App Activity data to auto-delete after a set period of time defined by you.

With the way things currently work, users have two options.  They can either disable Location History and Web and App activity entirely. Or they can manually delete portions of their data (or all of it).  Neither option is great, since many apps won't function with those services disabled, and the second is exceedingly cumbersome.

Worse, an AP investigation last year revealed that even if you take the step of disabling your Location History, Google can, will, and does continue to track your location.  In fact, just last month it came to light that Google maintains a gigantic database called 'Sensorvault' that contains the detailed location histories of hundreds of millions of phones around the world. In addition, the company reportedly makes the database available to law enforcement agencies to assist them in solving crimes.

This caught the attention of and drew the ire of privacy advocates around the world. This most recent change comes on the heels of that revelation and to the company's credit, it's a good move.

Under the new system, you have three options to choose from:

• Keep until I delete manually
• Keep for 18 months, then delete automatically
• Keep for 3 months, then delete automatically

At this point, there's no official word from the company on when the new feature will be rolled out. You can be sure that when it is, it will make headlines everywhere.  It's a pity that it took this long to see, but it's a solid step in the right direction.

Call SpartanTec, Inc. to help your company setup an effective data protection program. 

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

Stolen Personal And Medical Information Was Found Online

Jeremiah Fowler, a researcher with Security Discovery recently found an unprotected Elasticsearch databased owned by a company called SkyMed on the internet.  According to his findings the database was configured such that it was open and visible to any browser. This allows anyone who stumbles across it to edit, download, or even delete data without administrative credentials.
The database contained a total of 136,995 patient records with histories going back thirty years in some cases.

It also included a variety of personally identifiable information such as:

• Patient full name
• Email address
• Date of birth
• Address
• Phone numbers
• In some cases, detailed medical information

Mr. Fowler promptly contacted SkyMed to inform them of the discovery. To their credit, the company promptly took the database offline.  They did not, however, make a formal reply to Mr. Fowler. They have not, to this point, reached out to any of the patients whose names and personal information appeared in the database.

Is your company database exposed?

In addition to the unprotected database, Mr. Fowler discovered forensic evidence that indicated the company's network may have been infected with an unknown ransomware strain.  Again, however, the company has maintained total silence and has not contacted anyone, including their customers or impacted patients with details.

This complete lack of response is highly unusual.  On the heels of such an incident, we normally see a formal acknowledgement, an apology, a statement to the effect that the company is working with law enforcement and possibly engaging the services of a third party to assist with the investigation.

In addition to that, companies almost always make some effort to reach out to impacted parties to warn them of the dangers, advise of next steps they can take and offer free credit protection.

None of that has happened thus far, which could prove to be disastrous for SkyMed.  In the absence of those steps, it's difficult to see how the company's customers can trust them going forward.  In any case, be advised that if you are in any way reliant on SkyMed for any part of your care, there's a chance your personally identifiable data was exposed.

How do you make sure your companies data is secure? Contact SpartanTec, Inc. for a FREE dark web analysis of your company.

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

AeroGrow May Have Had Data Breach

Do you do any indoor gardening?  If so, odds are that you own AeroGrow equipment. If that's the case, some of your personal information, including the credit or debit card number you paid for the goods with, may have been compromised.

The company recently notified its customers that they discovered malware lurking on their payment processing page.

For reasons that aren't yet clear, the company did not detect the malicious code for some four months. They estimate that the malware was active between October 29, 2018 and March 4, 2019.
Aerogrow has notified the FBI and enlisted the aid of a third party to assist with the forensic investigation, which is ongoing.  At present, the company is unable to determine how many of its customer records were compromised.

To this point, they have confirmed that among impacted customers, the following information was taken:

• Credit or Debit card number
• Expiration date
• Security Code
• Any personal data the customer may have used to verify processing of the payment in question

Grey Gibbs, the AeroGrow Senior VP of Finance and Accounting issued a formal apology in the aftermath of the incident, saying, "I want to sincerely apologize for this incident and I regret any inconvenience it may have caused you.  I want to assure you that we take this criminal act very seriously and have addressed it thoroughly."

The company's response has been generally good, and they've offered a year of free credit monitoring to all impacted customers. However, that's small consolation to those who now have to deal with the prospect that their identities may have been stolen and may face fraudulent charges on their credit cards in the weeks and months ahead.

If you're an AeroGrow customer, to be safe, report your payment card as compromised and take whatever other steps you deem necessary to protect your identity.

Are you concerned about the data stored on your servers. SpartanTec, Inc. can provide peace of mind with a free dark web scan.

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto

Facebook Admits To Accessing Email Contacts

Facebook can't seem to stay out of its own way.  Recently, the social media giant has made headlines on a regular basis, and seldom for anything good or groundbreaking.  Not long ago, the company found itself in the midst of a controversy when it came to light that they were asking people for their email account passwords, claiming that it needed these in order to verify the identities of the new users. For businesses involved in social media sites like Facebook, it is best to get in touch with an IT consultant before proceeding to prevent such compromising incidents.

As a practice, this is almost unheard of.  In fact, countless numbers of articles have been written underscoring the fact that no legitimate company would ever request such information.  In addition, if anyone ever received an email asking for email logins and passwords, (or passwords of any kind), it was a sure sign of a scam in progress. In the case of a leak, it would be severely damaging to users. Always seek advice from an IT consultant Fayetteville regarding these matters.

In addition to that being a horrible business practice, the fear was that Facebook was improperly using the information and unauthorized to harvest personal information on everyone who complied with their unreasonable request.

As it turns out, those fears were spot on.  The company recently released a statement saying that they "unintentionally" uploaded email contacts from some 1.5 million new users on its servers, without the consent or knowledge of those users.

Part of the company's dubious explanation reads as follows:

"Last month we stopped offering email password verification as an option for people verifying their account when signing up for Facebook for the first time.  We estimate that up to 1.5 million people's email contacts may have been uploaded.  These contacts were not shared with anyone and we're deleting them.  We've fixed the underlying issue and are notifying people whose contacts were imported.  People can also review and manage the contacts they share with Facebook in their settings."

Given the company's recent history of privacy abuses and information security gaffe, this explanation has not been well received. It provides further evidence that Facebook has and continues to utterly fail when it comes to protecting its users' information, even as it generates billions of dollars in revenue from it.

Does your company need a complete technology solution provider? Call SpartanTec, Inc. today.

SpartanTec, Inc.
517 Owen Dr
Fayetteville, NC 28304
(910) 745-7776
http://manageditservicesfayetteville.com

Cities Served:
Fayetteville, Spring Lake, Hope Mills, Dunn, Aberdeen, Southern Pines, Pinehurst, Sanford, Clinto