Third Party Risk Insights Sept 2020

Learning lessons in enhancing IAM from the Shopify breach

Shopify’s announcement that two employees inappropriately accessed transactional data from 200 of the merchants that use its e-commerce platform demonstrates the importance of taking a “zero trust” approach to security and improving identity and access management capabilities, security experts say. Click to read the full BankInfoSecurity.com article.

E-commerce site using Magento

Around 2000 e-commerce stores running the Magento program were targeted in August, compromising thousands of customer information. All of these stores were running an older version of Adobe’s Magento software, for which Adobe ended the support as of June 30. Magento is an open-source e-commerce platform written in PHP, which was acquired by Adobe in 2018. According to Sansec research, about 95,000 e-commerce sites still rely on the older version.

2020 has by far been the largest-scale of attacks towards e-commerce sites since 2015. For one store alone, tens of thousands of customers had their payment information compromised.

On a hacking forum, the user z3r0day posted the selling of a Magento 1 “remote code execution” exploit procedure for $5000, with a tutorial clip. Supposedly, no current Magento admin account is required. The user added “Magento 1 is end-of-life – no patches will be provided by Adobe to fix this bug,” which expands the exploit surface.

Adobe has urged customers to upgrade to the newer platform, which is Magento 2, also adding no further patches will be issued by Adobe for Magento 1.

Warner Music Group

In accordance with the above attack, Warner Music Group also released a data breach warning. The warning followed a sustained skimming attack on a various number of its e-commerce websites.

The web skimming attack was discovered by the WMS Security Team in the beginning of August. The team in charge believed the breach window was between April 25 and August 5, 2020.

Personal data compromised in the attack includes, names, email addresses, credit card numbers, card expiration dates and CVC and CVV codes. A data breach notice sent by Warner to the affected customers claims “any personal information” customers entered into the affected websites “after placing an item in your shopping cart was potentially acquired by the unauthorized third party.”

It is not clear whether the same exploit that z3r0day offered was leveraged in the attack.