Hackers targeted at least 2,806 online storefronts running Magento 1.x, an ecommerce platform, which continued to run until last June.

Called Cardbleed, the perpetrators leverages a feature called “Magento Connect” to download and install the malware, “mysql.php” that gets automatically removed after the skimmer code is added to “prototype.js.”

These are JavaScript codes that was inserted to the ecommerce website, mostly on payment pages to capture customers payment information and send the details to a remote server controlled by the attacker and later to be sold by the attackers on Carding Forums.

Carding forums are mostly located on the dark web where cyber criminals sell Payment Information obtained by ATM Skimming, phishing, hacking into payment providers and recently from this kind of attacks.

Magento 1 Exploit For Sale

The Exploit is for sale at 5000 US Dollars on a Hacking Forum which includes the Instruction Video and Exploit Method. The Attacker also said that All Magento 1.x are Vulnerable to the Exploit.

Remote code execution is the ability an attacker has to access someone else’s computing device and make changes, no matter where the device is geographically located.

sqj9BS8nY2Iqnh85g1LXFrpNJIhacBHENZJyE3uda9H x5nEw BT bmXQXddy ikn6FuIQANWwvQBraTRA KkAbx0Zp 8a7CTxljlyn4ZY4 7Bw1ovK9TSpqffLySZ2ruT2Hyejw vQFC 6L6Q - Malware Infects Over 2800 Shops Running Outdated Magento 1

Credits to Sansec

In late October Mage One released a patch to Mitigate the Exploited Vulnerability.

Leave a Reply

Your email address will not be published. Required fields are marked *