October 18, 2016 By Douglas Bonderud 2 min read

Buying products or services online always comes with a measure of risk. Does the business properly secure and store credit card data? Does it take steps to protect against cyberfraud?

While most companies recognize the need for PCI DSS-compliant policies and safe data handling, a recent CSO Online article noted another rising risk: malicious JavaScript. Nearly 6,000 online shops have been compromised by this code, which is specifically designed to intercept and steal payment card information.

Is Malicious JavaScript a Long-Term Threat?

This isn’t a new threat. Back in 2015, Dutch researcher Willem de Groot reported these online skimming tactics at more than 3,500 stores. But despite his warning, the situation hasn’t improved. The total number of affected stores has nearly doubled, and of the 3,500 originals, 750 are still putting customer credit card data at risk.

Here’s the problem: This malicious JavaScript not only targets pages with “checkout” in the URL, but also goes after payment plugins like Fire Checkout and PayPal to swipe consumer data. It’s deployed using known vulnerabilities in content management and e-commerce platforms to effectively get behind both HTTP and HTTPS-protected sites and grab information, but many companies don’t recognize the seriousness of the issue.

Some claim that since payments are handled by third parties, it’s not their problem, while others rely on HTTPS to safeguard their interests. But since this JavaScript is installed behind HTTPS at the server level, all information users enter into the checkout page is up for grabs. While 334 stores fixed their issues after the news broke last week, 170 new stores were later hacked.

Laying Down the Law

So how do companies protect their credit card data from malicious JavaScript and other attacks? They can start by recognizing that no e-commerce service is truly safe. Known vulnerabilities open holes for malware to slip through, and attackers are always looking for new ways to compromise lucrative payment portals.

In addition, companies need to consider the use of reliable third-party monitoring and detection tools that can alert them to possible avenues of compromise and help limit their total risk — an essential step given the increasing regulation of personal data storage, transmission and security.

Better consumer data protection will also demand more active involvement from big players in the online space. As noted by Fox Business, for example, search giant Google is rolling out a new policy as of January 2017: Any HTTP site that transmits credit card information or passwords will be considered insecure by the company’s Chrome browser.

Right now, HTTPS sites are displayed as secure and HTTP sites as neutral. Raising the threat profile on HTTP-only checkout processes should improve customer awareness and prompt greater demand for secure checkout options.

Financial data remains a high-value target for cybercriminals. Malicious JavaScript is simply the newest tool used to crack credit card information, and it reinforces the need for more active monitoring and supervision of e-commerce sites by sellers and payment processors alike.

It’s a reminder that there’s no resting on one’s laurels here, since even HTTPS is of no use if cybercriminals infect the servers directly. Companies, third parties and dominant online entities need to collectively tackle these sneaky swipers head on.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today