Hackers have used brute-force attacks to gain access to hundreds of e-commerce sites and install malware that scrapes credit card details and installs cryptocurrency mining software. Researchers at threat intelligence company Flashpoint revealed in a blog post that they were aware of the compromise of at least 1000 sites, mainly in the Education and Healthcare industries. Attacks were largely centered on the U.S. and Europe.
The attackers targeted the popular open-source Magento platform used to run the sites, infiltrating admin panels which were poorly set up using common/known default credentials. While the fault lies with careless admins who failed to set up secure credentials on their newly installed platforms, Flashpoint also noted that the attackers “have demonstrated continued interest in other popular ecommerce-processing content management systems such as Powerfront CMS and OpenCart.”
Says Flashpoint’s analysts:
“Once the attacker has control of the site’s Magento content management system (CMS) admin panel, they have unfettered access to the site and the ability to add any script they choose. In this case, the attackers were injecting malicious code in the Magento core file, allowing them access to pages where payment data is processed. POST requests to the server containing sensitive data are then intercepted and redirected to the attacker.”
Flashpoint noted that the attackers updated their malicious files “daily” in order to avoid signature-based and behavior-based detection.
This is by no means the first case of this type of attack - back in 2016, the Mirai attacks also relied on admins not bothering to change default credentials for all their ‘connected things,’ resulting in the creation of a massively destructive botnet made up of unsecured connected devices such as routers and security cameras. The botnet took down numerous high-value targets such as Twitter, Spotify and GitHub.
In cases like these, attackers build simple automated scripts which they pre-load with all known credentials for the platform, in order to brute-force their way into the admin panels of target sites. It’s a scattershot approach, but the fact that it worked in 1000 known cases to date points to the fact that there may be more infected websites out there. (Flashpoint is currently working with law enforcement to inform the owners of infected sites).
Users can protect themselves and their sites/users from this kind of chain-reaction compromise by ensuring that they immediately update the default credentials after installing and setting up new CMS platforms. Here are some other tips we’d recommend to protect your Internet-connected devices against these types of brute-force attacks: