What causes a small business website to be hacked by cybercriminals? To answer this question, SiteLock analyzed 6 million websites and identified alarming trends in attacker behavior and tactics. The SiteLock Website Security Insider Q4 2017 reveals what these trends mean for your business, and provides simple tips to protect your website from complex cyberthreats.
Check out a brief summary of key findings below, or download the complete report to read the research in full.
Category:PHP Eval Request
First Identifiable Data: 02/01/2018
CVD ID: N/A
Trend Name: Value
Vector: Multiple
Complexity:
Brief explanation Lorem ipsum dolor sit amet.
Confidentiality Impact:
Brief explanation
Integrity Impact:
Brief explanation
While reviewing an infected site, the SiteLock Research team found a number of suspiciously named, obfuscated files that appear almost identical to legitimate ionCube-encoded files. We determined the suspicious ionCube files were malicious, and found that hundreds of sites and thousands of files were affected. We will discuss the defining features of the malware, its purpose, and discuss mitigation for infected sites.
What does a pirate attack on a celebrity yacht and a website compromise have in common? Read our infographic to learn the unprecedented parallels between how stealthy pirates stole from a yacht during a high-profile party, and how cybercriminals are increasingly sneaking their way into websites for self-serving purposes, like to steal email addresses and credit card info they can resell on the black market.
Imagine if one in every 15 websites you visited was secretly taken over by cybercriminals trying to steal your credit card information or other personal data. Now imagine if that website was your website, and you had no idea it was harming your visitors. This is the reality for many website owners, and now more than ever, they need to be on alert for cyberattacks in 2018.
In Q3 2017, SiteLock discovered alarming cybercrime trends that will likely affect websites for months to come. The most worrying trend for website owners: cybercriminals are increasingly using malware, or software that is used for malicious purposes, to take advantage of website visitors. In fact, nearly 15 percent of malware attacks targeted website visitors with the goal of exploiting them for sensitive data, website traffic, and other assets or resources. That’s not all: cybercriminals attempted to compromise more websites in Q3 2017 than in the previous quarter, increasing their attempted attacks by 16 percent.
Nancy is a small business owner who runs an ecommerce store selling women’s clothing. She knows there’s a lot of competition out there, so she works hard to make her customers happy. She’s found that one of the best ways to attract new customers and keep them coming back is by creating a feature-rich, user-friendly website that visitors love to use. Nancy’s website provides an easy shopping experience for her customers thanks to the features included with ecommerce plugins like Magento and WooCommerce. It also includes linked social media accounts, videos, pages of merchandise, and more!
One day, Nancy woke up to an inbox full of emails from frustrated customers. Something was wrong with her website!
SiteLock is proud to share the latest installment of our quarterly security report, The SiteLock Website Security Insider Q3 2017!
Featuring exciting new research, the SiteLock Website Security Insider Q3 2017 reveals that cybercriminals continue to become more ambitious. This confirms what we concluded in Q2 2017: that website owners are more likely than ever to experience a cyberattack.
SiteLock is excited to announce the publication of its first quarterly website security report, The SiteLock Website Security Insider Q2 2017!
The SiteLock Website Security Insider Q2 2017 includes analysis and trends based on proprietary data from over 6 million websites. The report delivers exclusive insight into the most common threats website owners faced in Q2 2017, including:
A vulnerability was recently discovered in Apache Struts, a popular framework for web-based Java applications, which allows for remote code execution on affected servers and allows for complete control of the application. The framework is commonly used by large, sophisticated organizations such as Lockheed Martin and Citigroup, meaning the vulnerability could affect up to 65% of Fortune 100 companies, resulting in large scale data breaches and private consumer data theft.
Found by lgtm.com security researcher Man Yue Mo, the vulnerability stems from unsafe deserialization of user supplied data to the REST plugin, which allows API access to the Java application. Researchers contacted the Apache Foundation directly, allowing the plugin developers to patch the issue before widespread exploitation. As of this writing, at least one live exploit has been seen in the wild, and a Metasploit module was released.
Apache Struts joins a growing fraternity of widely used applications to see an API vulnerability this year, including WordPress and Instagram. WordPress shared a similar experience where the exploit was discovered before widespread attacks, but many users failed to update and suffered compromise and data loss. The Struts vulnerability is more complicated to exploit which should result in a less dramatic rise in attacks. Regardless, patches should be applied as soon as possible, as a proactive security stance is more effective.
Apache Struts users are urged to upgrade to version 2.3.34 or 2.5.13 respectively, and additional information is provided by Apache on the official struts webpage at: https://cwiki.apache.org/confluence/display/WW/Version+Notes+2.3.34 and https://struts.apache.org/announce.html#a20170905.
More sophisticated exploits are likely to occur as this vulnerability is examined. The best option for mitigation is to patch Struts as soon as possible to the recommended versions and regularly check for updates. Website owners should also consider adding a web application firewall and malware scanner to mitigate or reduce the severity of compromise.
SiteLock TrueShield customers are already protected against this exploit. Attempted attacks will be caught and blocked by the TrueShield WAF. If your website isn’t protected, call SiteLock at 888.878.2417 to get TrueShield installed today.
Authors: SiteLock Research Analysts, Josh Martin and Michael Veenstra
While investigating suspicious files on a customer’s eCommerce site, the SiteLock Research Team found malicious payment processing code injected into Magento application files that skimmed credit card data and administrative login credentials. The malicious code sent stolen credit card data directly to a publicly accessible carding market where victim’s card details were listed for sale. In this article we analyze the infection, take a deeper look at the carding market, and discuss ways you can keep your site and your credit card data secure.
Fake plugins and extensions are a favorite, and particularly sneaky, way to inject malicious content into popular CMS platforms. Fake plugins disguise their malicious intent by mimicking the form and function of legitimate plugins. We will discuss a not-so-well-known fake Joomla! extension, what it does, and what you can do to protect your site from such attacks.
