A recently discovered critical remote code execution vulnerability in eBay's Magento Web e-commerce platform places thousands of South Africans' information at risk.
So says Doros Hadjizenonos, sales manager for Check Point SA, who notes as online shopping continues to overpower in-store shopping, e-commerce sites are increasingly targeted by hackers as they have become a gold mine for credit card information.
Check Point recently revealed its Malware and Vulnerability Research Group uncovered the Magento vulnerability, affecting nearly 200 000 online shops around the world.
Web technology information profiler platform Built With says more than 880 e-commerce Web sites using the .co.za domain name registration use the Magento platform. Check Point believes as this figure does not include .com registrations, the number of at-risk individuals could be a lot higher.
If exploited, the vulnerability gives the attacker the ability to fully compromise any online store based on the Magento platform, including credit card information and other customer financial and personal data.
The vulnerability allows any attacker to bypass all security mechanisms and gain control of the store and its complete database, allowing credit card theft or any other administrative access into the system.
Hadjizenonos is of the view that fraud in the retail sector has been growing quickly and cyber criminals have been hacking the networks of retailers to steal millions of identity and credit card records.
In responding to retail breaches, he notes, companies often focus solely on the most obvious weak spots, which is often not the smartest long-term solution.
"It is crucial for online stores to adopt a multi-layered security solution. Securing central information databases with next-generation firewalls against advanced persistent threats as well as bots, and ensuring compliance modules and threat management and monitoring is in place is important. Retail breaches are not going to go away if security is not taken seriously."
Hadjizenonos notes that to protect themselves, local businesses must ensure that if they operate Magento-based e-commerce businesses, they monitor their logs for patterns matching the technical description.
It is crucial to then also apply the designated patch SUPEE-5344 released by Magento to protect themselves, he urges.
"Consumers need to always be vigilant when it comes to the Internet and especially when they are doing businesses via Web sites which require personal details such as banking details, address etc," says Hadjizenonos.
"Unfortunately, it is very difficult for consumers to know whether their personal data is at risk, as a cyber attack can happen at any stage. Users should be encouraged to have up-to-date anti-virus software and a firewall on their home PCs. Cost is not an issue here - there are free solutions that deliver protection matching leading paid-for products."
Another key preventative measure is for users to regularly install software updates and patches, to keep security as current as possible, he concludes.
Share