Connect with us


E-commerce requires beefed up cyber security to function well

E-commerce requires beefed up cyber security to function well

E-commerce requires beefed up cyber security to function well. In an increasingly interconnected world, online shopping and electronic transactions have now transcended its innovation status to become part of our daily lives. Its ease of use and convenience, can also mean significant security risks since sensitive information and personal data are routinely shared among business owners and shoppers.

Some these security risks include the following:

FINANCIAL DATA THEFT/FRAUD: Many attackers target personal information such as names, addresses and credit card numbers. This allows them to make purchases online using someone else’s payment information. One method being used is called pharming or using fraudulent websites to manipulate people into giving out their credentials.

Another more effective and insidious method is deliberately targeting specific users and manipulating them into giving their personal information (also known as spear phishing). Other exploits used to steal financial information include, but are not limited to: SQL Injection, Cross-Site Scripting, Path Traversal, Session Hijacking, and Drive-by Downloading

DISTRIBUTED DENIAL OF SERVICE (DDoS) ATTACKS: A Denial of Service attack’s aim is to take down e-commerce sites by flooding them with requests. This kind of attack overloads the e-commerce site to the point where it can’t handle anymore requests, making the service slow down or even go offline.

Slow service for an e-commerce site means loss of potential revenue and massive impact to brand reputation.

MAN IN THE MIDDLE ATTACK: Man in the Middle attacks do exactly what they say — the attacker eavesdropping or intercepting the user’s (in this case, the online shopper’s) connection with the website. Even with Secure Sockets Layer (SSL)/Transport Layer Security (TLS) in place, there are still ways attackers can trick the browser to gain access to the plain text data.


If such an attacker manages to compromise an e-commerce site, the following can happen:

LOSS OF REVENUE: The first, most obvious effect of a security breach is loss of income. Small businesses shell out an average of $38,000 to recover from a single data breach in direct expenses alone.

On top of that, a company that experiences a security breach can also be held accountable for not following

data protection policies, leading to hefty fines that can lead to a business’s insolvency.

DAMAGE TO BRAND REPUTATION: Apart from the direct loss of sales due to site unavailability (due to a DDoS attack, for example), losses of sales can also be due to customers walking (or in this case, browsing) away from the shop in favour of other shops without such security breaches. Losing customers’ and stakeholders’ trust is the most harmful impact of a security breach.

People will not do business with a breached company, plain and simple.

Even if the company is eventually able to recover the financial losses, the impact on the company’s reputation would be a scar that would take a significant amount of time to fade. That is, if it even fades at all.

INTELLECTUAL PROPERTY THEFT/DAMAGE: Another impact of a security breach is theft and damage to intellectual property like trade secrets, blueprints, and anything else that gives a company their competitive advantage. This can mean missing out on expanding the business since the company can no longer fully implement new and innovative ideas brewing in the pipeline.


The good news is there are ways e-commerce shop owners can protect their websites, their customers, and their data:

  1. Research on the e-commerce platform and payment gateway the e-commerce business runs on to ensure it complies with information security standards. Make sure the platform is compliant with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is an information security standard defined to control how credit and debit card information is handled. To determine if the e-commerce platform is compliant, refer to Visa and Mastercard’s compliant service provider lists.
  2. If you plan to implement your own platform using open-source platforms like Magento, then the responsibility is on the shop owner to implement security measures. Ensure that your shop is PCI-compliant and other basic security measures are in place.
  3. Make sure the entire site (not just the payment area) uses HTTPS and do keep the SSL certificate updated. The certificate creates a secure connection between the user and the server. Otherwise, the data is easily accessible and readable by anyone. Contact your hosting provider if the shop is not hosted via HTTPS.
  4. Only store customer data that is needed and make regular backups of them.
  5. Conduct a vulnerability scan on the online shop. Even with security measures in place, it is possible that the site is still vulnerable from threats that are not obvious to the end user. This is where a web scannercomes in. Web scanner scans web applications for known vulnerabilities by spidering through links and ignoring pages linked outside the target domain.


Hackers and cybercriminals only get smarter and more sophisticated with each passing year. Therefore, the onus is on business owners to make security a priority.

While a cybersecurity endeavour takes a lot of time and resources, the upfront cost is still lower than the potential losses and is a worthwhile investment for all e-commerce setups.


Background on writer: Samantha Cruz is a Cyber Operations Researcher at Horangi. She specializes in cyber research and security tool development. Before joining Horangi, she has worked for Trend Micro as a security analyst and engineer.

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.


The APT attacks hitting East Asia

The APT attacks hitting East Asia

The APT attacks hitting East Asia

East Asia have been targeted by a stream of cyber-attacks carried about by an advanced persistant threat (APT) group. The group goes by several names such as Tick, Brzone Butler and Redbaldknight.

The APT group’s main targets are South Korea and Japan. This current wave of Datper malware attacks is written in Delphi and is capable of executing shell commands to gain information from the infected machine, such as hostnames and drive information.

Security researchers from Cisco Talos have stated It is not yet known how the attacks are being conducted since command and control (C2) servers in question are not active. However, they say it’s possible the malware is being delivered using web-based attacks such as drive-by downloads, or by watering hole attack. Watering hole attacks is a security exploit in which the attacker seeks to compromise a specific group of end users by infecting websites that members of the group are known to visit.


The APT attacks hitting East Asia

Could this signal the re-emergence of Comment Crew

A fresh wave of APT cyber-attacks has hit South Korea, but also US and Canada, causing some to believe this could spell the re-emergence of Chinese government backed hacking group Comment Crew. Security company McAfee claimed they have discovered a new hacking campaign that focuses on cyberespionage and data reconnaissance.

Comment Crew or otherwise known as Shanghai Group or APT1 is thought to be responsible for the majority of China’s cyber-attacks since 2006. In 2013 they were linked to the successful hacks of over 100 US companies, but vanished soon after the exposure, along with hundreds of terabytes of data. The Chinese government maintains that they do not sponsor hacking and claim to be a victim to hacking campaigns themselves.

McAfee has found malware that reuses some of the code that was uses in a campaign called Seasalt that was introduced by APT1 around 2010. The reason this is interesting is because this code was never released publicly, lending authority to McAffee’s claims.

A recent campaign, named Operation Oceansalt has been linked to Comment crew. Operation Onceansalt started in May this year and was seen to be targeting Korean speaker with a data reconnaissance implant. Four more waves have since been detected, aimed against companies in South Korea, the United States and Canada.

The Oceansalt implant gives attackers full control of any system or network it is connected to, however, is mainly used for espionage activity. McAffee acknowledged that the implant allows for information to be sent to a control server and commands can also be executed on infected machines, however the full extent of its purpose is not known.

The waves of attacks

The first wave of attacks happened when a South Korean website was compromised, allowing for a spear-phishing campaign to take place. This was done through Microsoft excel email attachments.

For the first two waves of the attack the targets were South Korean public infrastructure officials. The third round of malware documents was distributed from another compromised South Korean website, and the content related to the financials of the Inter-Korean Cooperation Fund.

In the fourth wave involved the targeting of investment, healthcare, banking and agriculture industries in the US and Canada. There are few details around the extent or damage of this wave.

The fifth wave primarily targeted South Korea and the United States using Oceansalt implant.

Although the full motive of the attack is unclear, there is speculation that it could be financial, or a small part of a much larger attack.

Continue Reading


Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store

Ad Clicker Disguised as a Google Photos App has been Hosted on Microsoft Store.


A malicious app called “Album by Google Photos” was found to be hosted on the Microsoft store. The app was pretending to be part of Google Photos, but was in fact an ad clicker that generates hidden adverts within the Windows 10 Operating System.


The ad clicker app seemed credible to users because of its name, and also the fact it claimed to be created by Google LLC, Google’s actual Microsoft store account is Google Inc, but it looks unsuspecting to users. Microsoft came under some criticism for not realising the app was actually malicious software since the user reviews did highlight that the app was fake, with plenty of 1* reviews. One review states “ My paid Anti-malware solution detected several attempts to download malware by this app. Watch out”. The App was first released on the Microsoft store in May.


What did the application do?


The “Album by Google Photos” app is a Progressive Web Application (PWA), which acts as the front end for Google Photos and includes a legitimate login screen. Hidden in the app bundle is also an ad clicker which runs in the background and generates income for the app developers.


The app connects to ad URLS, and the ads were very similar to what users would see from typical adware, including tech support scams, random chrome extensions, fake flash and java installs and general low-quality sites.


Microsoft haven’t commented how this app managed to pass the Microsoft review process before ending up on the store.  This is somewhat concerning since it could mean other malicious apps of a similar nature have flown under the radar and are still infecting user’s computers. We are waiting for Microsoft to comment on the issue.

Continue Reading


How to guide: Check if your Facebook Account has been hacked?


How to guide: Check if your Facebook Account has been hacked?

At the end of September, it was revealed that a Facebook security flaw allowed the access tokens of over 50 Million accounts to be stolen. Access tokens allow users to stay signed in on devices, rather than signing in every time they interact with a Facebook app. On Friday 12 October, after weeks of investigation, Facebook reported that the actual number of accounts affected was 30 million, not 50.


The investigation into how this was made possible, and the extent of the data stolen is still ongoing, but Facebook have said there is no need for users to log out or change their password. Facebook forced 90 million users to log out when the breach was discovered.


Users can use this page to check if they were one of the accounts affected in the incident, as well as read any recent findings from the investigation. When you visit page, if you are not one of the affected users it will tell you this in a statement towards the bottom of the page, and there is no further action required from you other than remaining security conscious when it comes to passwords and such. You will also see a message saying your account hasn’t been compromised if you are one of the one million users to who their tokens stolen but information remained safe.


If you fall into the other 29 million users camp, then you will see one of two messages, depending on the level of your information that was stolen. Fifteen million users had their name, email addresses and phone numbers compromised by hackers. While this is serious enough itself, the other 14 million have a more serious data breach problem.


The other 14 million have had the above information stolen, as well as their username, date of birth, devices you use, gender, language settings and possibly more data such as religious and political views. It’s also possible that they accessed your 10 most recent locations and 15 most recent searches, giving a detailed window into your online presence.


There is currently no evidence that hackers used the vulnerability to attack third-party apps and services to gather more information, which was technically possible.  Facebook also continues to report that no passwords of credit card information has been compromised. We are yet to see the full fallout from the breach, but there is also evidence that Facebook logins are being sold on the dark web.


While that data is now out there in the hands of attackers, Facebook has used their support page to offer some advice on avoiding phishing schemes. This is a good move from Facebook, but it doesn’t make up for the grievous level of the data breach and the users it has left vulnerable to tailored phishing attacks now their data is out there.

Photo by Glen Carrie on Unsplash

Continue Reading