Setting up an ecommerce website is now easier than ever, thanks to the multiple open source solutions available online today. Ecommerce boom has taken the world by storm. But at the same time, it has also become a lucrative target for hackers, spammers and other malicious actors with lots of other ecommerce security threats.
As far as you take into account various ecommerce security issues, smaller stores are the most vulnerable amongst this group, as they do not have the dedicated resources to fend themselves. Let aside the traditional ecommerce security threats which give away the site to the attacker, security threats against ecommerce websites are evolving. In one particular incident, the hackers were able to compromise around 277 ecommerce websites using their advertising partners. Moreover, the black markets of DDOS, phishing, and scamming attacks are now quite organized. According to Satya Nadella, the CEO of Microsoft,
Security issues to ecommerce are a challenge more than ever as there has been a continuing stream of massive data breaches, together with growing attacker sophistication and a more connected world that is expanding the surface for attack.
Enhance the Security of Your Online Store with the Right Tools and Resources
Signs That Your Ecommerce Site Has Been Hacked
Have your sales seen a sudden downward spiral? It could be due to ecommerce security threats. Do your customers complain of poor site performance? This again hints about the possibility of ecommerce security threats on your website. Often, cyber crooks are highly stealthy and manage to evade detection for longer times. However, in some cases, hackers tend to break something (like an unfunctional plugin) while compromising a site which gives the attack away. Some key hints to look out for include:
- High load on the server due to repeated requests from same IPs
- Content scraping bots choking the bandwidth
- Products that you did not enlist on the store appear on the site
- Multiple users availing free shipping or products which were not intended for them
- Breached database of the store available for sale on TOR sites
- Malicious advertisements which ask users to install malware served
- For dynamic websites, new unknown database tables appear. Or some new database users spring up suddenly!
- Admin accounts which you did not create appear on the dashboard
- System logs show a connection to the dashboard or C-Panel from unknown IPs
- A bunch of pages which contain unknown content appears on the site
- Users complain about malicious redirects which are causing a high bounce rate
- A simple packet analysis by tools like Wireshark shows data going out to fishy domains
- Customers complain about stolen Credit Card info despite your site being PCI compliant
- Users complain about paying for an order but you did not receive the payment
- Server logs also show other attacks like brute force attempts
- Your ecommerce store is now blacklisted by Google or banned by your hosting provider.
Site Blacklisted For Malware
Reasons Why Your Ecommerce Site Gets Hacked
Common Vulnerabilities
SQL Injection
Do you know what is the most common issue among all the popular ecommerce platforms like Prestashop, OpenCart, Magento etc? Well, they have all been vulnerable to SQL injection at some point in time. This particular vulnerability is so widespread that many of the plugins and extensions are still vulnerable to it. SQLi attacks are a result of accepting unsanitized input on ecommerce sites. As security threats to ecommerce tend to grow, SQLi attacks are now aimed towards compromising the database. Conducting this type of attack, an attacker can:
- Steal the complete database of the site containing sensitive details like transaction history or credit card information. When large databases are now sold in the black market, the majority of security threats to ecommerce websites are now linked to this type of attack.
- Delete or edit the content of the database to avail free products, etc. This flaw essentially makes the attacker an owner of the database of your ecommerce site.
- In some security threats to ecommerce domains, the attackers can even get reverse shells, which is then used to conduct phishing attacks to steal user credit card credentials or deface the site.
Cross-Site Scripting
XSS in another one of the many ecommerce security issues found on ecommerce sites. It is so common and crucial that internet giants like Google have paid $10,000 for a single XSS discovery. Lack of user input sanitization and filtering causes XSS, and therefore, sites using forms, search bar or even a backend admin account can be also compromised due to XSS. Successfully exploiting this flaw, an attacker can compromise the admin account of your ecommerce store and create havoc. Popular ecommerce solutions like OpenCart, Prestashop etc are now found vulnerable to XSS from time to time.
Zero-Day Flaws
Zero-day flaws are also one of many ecommerce security threats which are not reported to the ecommerce software vendor yet. As these ecommerce security threats are still undisclosed, it is likely that there are no patches available for them. In the past attackers have compromised multiple ecommerce sites using zero-day vulnerabilities. If you follow every secure practice and yet your site is being compromised, it is likely to be a zero-day flaw. The rate of patching zero-day flaws is faster for open source ecommerce solutions. Moreover, the code of open source solutions is then audited by anyone therefore, chances of finding a zero-days are relatively less.
Bad Bots
Bots are another type of security threats to ecommerce where small scripts are then designed to perform a specific task and report to a botmaster. These tiny little scripts pose a grave threat to the ecommerce industry. According to some reports, as much as 21% of the user traffic on ecommerce sites is then comprised of malicious bots. Let us take a look at how bad bots can compromise the regular functions of an ecommerce store:
Bandwidth Choking
Bandwidth is a crucial resource for any ecommerce site, especially during peak sale hours. These tiny little bots, high in numbers, create a spike in the user traffic. This spike can slow down things a bit and is also considered one of the many ecommerce security threats for modern times. Slow performance of the site can ward off potential buyers thus creating a loss in revenue.
Blocking Cart
Checkout cart is one of the key elements for any ecommerce store. Malicious bots target carts by adding multiple products to the cart from multiple IPs. However, the capacity of the cart is then limited. Hence, the buyers see the product as ‘Out of Stock’. The prime aim of these bots is to exhaust the web resources for a particular product. Therefore, malicious bots successfully prevent potential customers from buying a particular product. This situation can be more frustrating with issues for the end users during flash sales, etc. These frustrated users may never return to the site because of these security threats. Bad bots can also mess up with the analytics of the website. Thereby, pointing the site owners in the wrong direction to increase sales and qualifying as one of many ecommerce security threats.
Ecommerce Scalping
This is another type of ecommerce security threat posed by bad bots. Malicious bots target products in bulk from a particular store and later resell them for a higher price. For instance, movie tickets, limited edition merchandise, etc. At times, bad bots may also conduct fraudulent transactions on your site from stolen credit cards. The legitimate owners of the cards may then ask for a refund. This can create a poor merchant reputation and in some scenarios, the merchant is then barred from accepting cards.
Content Scraping
As security threats to ecommerce websites persist, these bad bots can also steal product data from your ecommerce store. This data can be then used to give an edge to the competitors. They can use this data to lower their prices as compared to your product, thereby affecting your sales. Moreover, the bots will also make the site slow while scraping the data.
Malware
A malware is a malicious program and one of the more common security threats to ecommerce websites. This is then designed to infect and spread on the ecommerce sites. Most of them aim to skimming credit card data while others encrypt drives and ask for ransom. Malware infections on ecommerce sites are on a rise. Researchers have recently uncovered a malware which had infected around 7,339 online stores within six months. This malware dubbed as MagentoCore, was specifically designed to target Magento stores.
Moreover, attackers can uncover such ecommerce security threats in bulk using tools like Shodan which are specifically designed to crawl the internet for sites vulnerable to such attacks. Similarly, Magecart malware campaign is compromising a large number of ecommerce sites. Magecart is an umbrella term to define malware campaigns and security issues that occur when they are now run by multiple hackers. Multiple malware signatures are present on the internet, specifically customized to target your particular ecommerce software solution. Moreover, these ecommerce security threats are evolving every day as cybercriminals find new methods to hide their malware from detection.
Distributed Denial Of Service
It is a thumb rule that the longer an ecommerce store stays online, the more potential customers it can attract. However, the competitors, at times, hire cyber crooks to get the site offline. As a result, the end users can no longer access the site and the revenues are then hit hard. These types of ecommerce security threats, where the attackers increase traffic thus blocking out legitimate users are DDOS attacks.
These security threats to ecommerce websites are on the rise during peak hours or days like Black Friday. With some studies showing a whopping increase of around 70% in DDOS attacks compared with other days in November. Also, an increase of around 109% in DDOS attacks was witnessed on Cyber Monday. Therefore, it is the need of the hour for the ecommerce sites to build and manage their defense mechanism to protect themselves from large scale DDOS attacks in the future.
Protecting Ecommerce Sites
Ecommerce sites are at the center of financial transactions on the web. Therefore, such sites should comply with and maintain security standards, and try their best to avoid security threats and issues to ecommerce industry. Some good practices to embrace in order to protect ecommerce sites include:
Use HTTPS
The information about Payment Card Industry (PCI) compliance and ecommerce sites should be strictly confidential. So, to protect it from any kind of online security threats, implement HTTPS on your ecommerce site by getting verified and valid certificate from a competent Certificate Authority. Install that certificate on your site and you’re good to go. You can even get one for free. Moreover, many customers look for the HTTPS icon on the site before conducting financial transactions. So, this step can also help in confidence-building measures with the customers while securing your site.
Payment Card Industry Compliance
PCI is an industry standard for processing and transmitting the financial data of your ecommerce site. Whenever an ecommerce store is PCI compliant, it means that the store follows strict security measures like not storing credit card information on the local server etc. to protect the financial data of the customers. This compliance has four levels and is then obtained by an ecommerce site of any size. Customers feel more comfortable while sharing their financial details with a PCI compliant ecommerce site, therefore, get one today!
Monitor and Block Bad Bot
Bad bots are one of many ecommerce security threats that can be detected via Google Analytics. Any kind of visitor anomalies can hint towards bot traffic hitting your servers. For instance, when the bounce rate is increasing, but the average page duration is decreasing, it could hint towards bot traffic. Bots would view pages quickly and then move to the next site which would increase your bounce rate. However, bots can read quicker than humans therefore, the average page duration is decreasing. Some of the bots are now blocked out by editing the robots.txt file. However, be careful while editing this file, as it would also used by GoogleBot to index your site. In order to eliminate the bot traffic completely, it’s recommended to use a security solution.
Use Content Delivery Networks
Using CDN is a great way to speed up your ecommerce website especially during peak season like Black Friday. The customers will get a fast and responsive site which will help in greater number of online sales. While, at the same time, CDNs can balance the user traffic thereby protecting your store from certain DDOS attacks. Moreover, modern day CDNs even support dynamic content. While providing better site performance, CDN will also secure the infrastructure from traffic overloading.
Security Audit and Patching
It is necessary to have a security audit of the ecommerce site in order to keep the attackers at bay. The security audit can reveal critical vulnerabilities which could have given away the site to the attackers. Keeping in view the sensitive nature of transactions done on ecommerce sites, a security audit is a must.
Moreover, security audits help in obtaining certifications like PCI compliance which increases customer satisfaction and trust. After security audits, it is important to patch the loopholes. An unpatched ecommerce site is highly vulnerable to online security threats. Moreover, the software companies release patches periodically which contain crucial security updates. Ensure installing them to keep your ecommerce site secure from such ecommerce security threats.
Web Application Firewalls
Web security solutions act as a wall between the attackers and your ecommerce store. Therefore, this first line of defense is crucial and can protect critical data. Astra security solution is an all-in-one service which will eliminate your bad bots, block SQLI XSS etc, prevent DDOS, remove malware at prices starting at $9 per month.
Conclusion
With so many ecommerce security threats to look for, it is nigh on impossible to zero into anyone at this point. But the best thing is to be well prepared just in case an ecommerce security issue occur to hinder your work and your online presence.
As a rule of thumb, it is always better to be safe than sorry. Newer developments are now needed in case something happens but all we can do is look for legitimate sources and tools that would keep these threats at bay.
If you think we have missed out on something, please comment below.
See: Step By Step Guide to Improve Magento Security
Author Bio
Jinson Varghese Behanan is a Security Analyst at Astra. Passionate about Cybersecurity from a young age, Jinson completed his Bachelor’s degree in Computer Security from Northumbria University. When he isn’t glued to a computer screen, he spends his time reading InfoSec materials, playing basketball, learning French and traveling.
