Magecart - A Growing Threat to E-Commerce Sites

Explore the growing threat of Magecart to e-commerce sites in this informative conference talk by Simon Kenin and Ziv Mador from OWASP Global AppSec Tel Aviv. Delve into the techniques used by cybercriminals, including 0-day exploits and known de-serialization bugs in the Magento platform and its extensions. Learn about high-profile attacks on major websites like British Airways, TicketMaster, and NewEgg, as well as thousands of online shops. Understand how attackers compromise third-party servers hosting JavaScript code, leading to malicious code execution on client computers and data skimming. Discover the nature of vulnerabilities enabling these attacks and gain insights into possible defense and detection measures. The talk covers topics such as Magecart's evolution, typical attack scenarios, vulnerabilities, compromises, and the dark web marketplace. Gain valuable knowledge on how to protect your e-commerce site, including the use of web application firewalls and ensuring trustworthy resources.

Introduction
Who is Magecart
What is Magecart
Magecart Blog
Vulnerabilities
Compromises
Typical attack scenario
Spearman script
Ukraine
Marketplace
Magnet
The dark web
Attacking web services
Payment industry evolution
Magecart evolution
Metal of compromise
Missing security patches
Magecart vulnerabilities
Injecting code
How to defend yourself
Web application firewall
Trustworthy resources