Executive Guardian
Your organization’s leadership is 12 times more likely to be the target of a security incident and nine times more likely to be the target of a data breach than they were last year. Find out how they can be protected.
Read the Datasheet
Gift Cardsharks: The Massive Threat Campaigns Circling Beneath the Surface
Learn about the attack group primarily targeting gift card retailers and the monetization techniques they use.
Get the Report
Threat Hunting Workshop Series
Join one of our security threat hunting workshops to get hands-on experience investigating and remediating threats.
Attend an Upcoming Workshop
Inside Magecart: New RiskIQ & Flashpoint Research Report
Learn about the groups and criminal underworld behind the front-page breaches.
Threat Hunting Guide: 3 Must-Haves for the Effective Modern Threat Hunter
The threat hunting landscape is constantly evolving. Learn the techniques, tactics, and tools needed to become a highly-effective threat hunter.
Resources
July 31, 2019
SAN FRANCISCO – July 31, 2019 – RiskIQ, the global leader in digital attack surface management, today announced the launch of RiskIQ JavaScript Threats Module to ensure customer trust in e-commerce by protecting organizations’ high-traffic payment pages from JavaScript attacks. The module is part of a comprehensive platform for reducing cyber threats to organizations’ internet attack surfaces. JavaScript Threats is the only enterprise-scale product trusted by the largest financial and e-commerce companies and powered by the cyber threat intelligence of industry-leading experts on Magecart JavaScript attacks.
JavaScript Threats leverages RiskIQ’s proprietary global discovery infrastructure to build complete, dynamic inventories of organizations’ websites, including critical e-commerce assets with their own and third-party JavaScript. It then monitors the web assets and JS resources, creating alerts for malicious and suspicious changes so organizations can quickly detect JavaScript attacks.
Magecart cybercriminals inject malicious JavaScript code into web pages once every five minutes, according to RiskIQ cyber threat research group’s detection data. These attacks can be direct compromises or supply-chain compromises. Supply chain attacks target third-party JavaScript resources, such as analytics trackers, website optimization tools, and chat plugins, and give cyber threat actors massive reach by multiplying their cyber attack across potentially thousands of websites. Businesses incur reputational and financial damages such as loss of customer trust and market share, lawsuits, and punitive regulatory fines.
The damages caused by JavaScript attacks came into sharp focus earlier this month when the UK Information Commissioner’s Office proposed a £183 million ($224 million) fine on British Airways. The JavaScript attack on its website resulted in the theft of credit card data for almost 500,000 customers. This proposed fine represents 1.5% of British Airways 2017 revenues and could have been as high as 4% of revenues, or £489 million ($598 million). The breach, analyzed by RiskIQ cyber threat research group in September 2018, was carried out by one of the most sophisticated Magecart cybercriminal groups.
“Many organizations have almost no visibility into their web assets, third-party web resources, and the way their customers and employees interact with them,” said Elias Manousos, RiskIQ CEO and co-founder. “Because of this, JavaScript attacks have become the go-to method for threat actors to target digital businesses, their customers, and their employees in a stealthy manner.”
The 2019 Verizon Data Breach Investigations Report: Executive Summary substantiates the prevalence of JavaScript attacks. The report highlights that malicious code designed to capture data entered into web forms is the primary cyber attack pattern for breaches in the Retail, Professional Services, Finance, and Manufacturing industries. The Verizon report also states: “Payment card web application compromises are well on their way to exceeding physical terminal compromises in payment card-related breaches. Data from one of our contributors, the National Cyber-Forensics and Training Alliance (NCFTA), substantiates this shift appears to have already occurred, and our larger data set is also trending that way.”
Magecart JavaScript attacks are likely to increase, as they have been highly successful. RiskIQ cyber threat research group has pointed out previously that Magecart is an active cyber threat that operates at a scale and breadth that rivals, or may even surpass, the compromises of retail giants such as Home Depot and Target. The Magecart actors have been active since 2015 and have never retreated from their chosen criminal activity. Instead, they have continually refined their tactics and targets to maximize the return on their efforts. Cybercriminal syndicates have created entire economies around JavaScript attacks with vibrant, lucrative markets emerging for stolen data, web skimmers, and compromised websites.
“Actors like Magecart are responsible for some of the most high-profile breaches in recent history, and thousands of businesses have been targeted with stealthy attacks on their e-commerce web assets,” Manousos said. “With JavaScript attacks poised to carve out a significant portion of the cyber threat landscape for years to come, businesses will be forced to evaluate their cyber security strategy and investments to address them.”
Read the RiskIQ JavaScript Threats Module data sheet here. Visit RiskIQ at Black Hat USA, booth #1210, Mandalay Bay Business Hall, Las Vegas, August 7-8, to find out how to protect your organization’s web attack surface from JavaScript threats. Contact RiskIQ about JavaScript Threats for your company here or at sales@riskiq.com.
About RiskIQ RiskIQ is the global leader in attack surface management, providing the most comprehensive discovery, intelligence, and mitigation of threats associated with an organization’s digital presence. With more than 75 percent of attacks originating outside the firewall, RiskIQ allows enterprises to gain unified insight and control over web, social, and mobile exposures. Trusted by thousands of security analysts, security teams, and CISOs, RiskIQ’s platform combines advanced internet data reconnaissance and analytics to expedite investigations, understand digital attack surfaces, assess risk, and take action. Its software protects businesses, brands, and customers. Based in San Francisco, the company is backed by Summit Partners, Battery Ventures, Georgian Partners, and MassMutual Ventures.
Visit https://www.riskiq.com or follow us on Twitter. Try RiskIQ Community Edition for free by visiting https://www.riskiq.com/community/
© 2019 RiskIQ, Inc. All rights reserved. RiskIQ is a registered trademark of RiskIQ, Inc. in the United States and other countries. All other trademarks contained herein are the property of their respective owners.
Contact
Holly Hitchcock Front Lines Media 805-801-9798 Holly@FrontLines.io
