{"id":6452,"date":"2019-03-26T17:22:33","date_gmt":"2019-03-27T00:22:33","guid":{"rendered":"https:\/\/www.acalvio.com\/?p=6452"},"modified":"2019-03-26T17:22:33","modified_gmt":"2019-03-27T00:22:33","slug":"formjacking-deception-is-your-cure","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2019\/03\/26\/formjacking-deception-is-your-cure\/","title":{"rendered":"Formjacking: Deception is your cure"},"content":{"rendered":"

I recently saw a news article published by <\/span>Symantec<\/span><\/a> stating that cyber criminals are shifting their attack techniques. According to Symantec, b\u0000\u001cFor the first time since 2013, ransomware infections declined, dropping by 20 percent.b\u0000\u001d Due to the sharp decline in the price of cryptocurrency, attackers are increasingly interested in formjacking attacks, such as MageCart, rather than simply detonating ransomware inside corporate environments and asking for ransom to paid via bitcoin. <\/span>
\nThis is very interesting. As in my previous <\/span>blog post<\/span><\/a>, Kaspersky drew a similar conclusion. I talked about how to leverage deception to effectively detect ransomware. In this post, I will discuss how we could use deception based detection solution to fight formjacking attack. <\/span>
\nFormjacking is a relatively new term in cyber security. In Symantecb\u0000\u0019s definition, b\u0000\u001cFormjacking attacks are simple b\u0000\u0013 essentially virtual ATM skimming b\u0000\u0013 where cyber criminals inject malicious code into retailersb\u0000\u0019 websites to steal shoppersb\u0000\u0019 payment card details.b\u0000\u001c B Symantec claims more than 4,800 unique websites are compromised with formjacking on a monthly basis, and almost one third of the attacks in 2018 happened during the busiest shopping reason, Nov and Dec. This is absolutely shocking! <\/span>
\nThe worst part about formjacking is that <\/span>neither the website administrator nor the online shoppers are aware that credentials are being stolen from the website<\/i><\/b>. Unlike ransomware, which is detectable when encryption starts or the ransom note is shown, formjacking can hide itself inside the web server and secretively collect credit card information for months before anybody notices. Once website code is published, it is generally not checked again until the next update is made. In the meantime, the actual e-commerce transaction goes through as if nothing has happened without any business interruption. From the customerb\u0000\u0019s perspective, they simply continue shopping online and probably realize their credit card information has been stolen until days or weeks later. This type of delayed alerting makes it extremely difficult to track.<\/span>
\nIn my opinion, formjacking is an even more powerful and dangerous attack than ransomware for following reasons. <\/span><\/p>\n