Content Delivery Networks Adding Checks for Magecart Attacks

In 2019, thousands of websites suffered information-stealing attacks caused by the compromise of the third-party scripts used to create their sites. Forbes magazine, consumer products maker OXO, sports outfitter Puma Australia, and learning channel Sesame Street were all targets of these so-called Magecart attacks.

While a variety of cybersecurity firms have proposed defenses to protect sites from malicious third-party content, companies that serve up website content — known as content delivery networks (CDNs) — are a natural control point from which these attacks can be caught.

Indeed, CDNs have started to roll out features to combat attacks that abuse the software supply chain to compromise website visitors through the third-party scripts used by sites to generate content. In March, for example, Cloudflare rolled out an integration with client-side security service Tala that allows the company to scan web pages for malicious content to catch third-party code that may be malicious. Such efforts are necessary because third-party supply chain attacks are difficult to catch, the firm said.

Internet infrastructure firm Akamai, too, has integrated security checks against rogue third-party components in an attempt to blunt such attacks in the future.

Dubbed the Page Integrity Manager, the new feature, announced today, has been integrated in Akamai's CDN infrastructure and will protect in real time against JavaScript code that attempts to skim information, hijack websites, or redirect a visitor, says Patrick Sullivan, chief technology offer for security and strategy at Akamai.

"We monitor the behavior of all the scripts on the site, whether they are first-party or third-party," he says. "You can think about it as monitoring the JavaScript from 'cradle to grave.'"

Third-Party Blind Spot
As people rely more on online shopping to meet their needs, attacks on websites through their third-party code providers — which cybersecurity firms have lumped together under the Magecart monicker — are posing more of a threat. In 2019, more than 4,800 attempts to hijack information from forms using third-party code happened each month, according to security firm RapidSpike. 

The scope of third-party component use is enormous. 

"Today, up to 70% of the code executing and rendering on your customer's browser comes from these [third-party sources]," Cloudflare stated on its blog. "All of these software integrations provide avenues for potential vulnerabilities."

Modern websites are a collection of code and components, the majority of which are from third-party suppliers such as content management systems and open source projects. Often those third parties also include other components — such as open source libraries — resulting in fourth-party code running on websites as well. 

For an average site, the total size of third-party JavaScript code is three times the size of first-party code created by the site owners, according to the HTTP Archive. In 2020, the average website ran 35 different third-party components and 31 fourth-party components, up from 18 and 10 components, respectively, in 2016, according to site-protection service Reflectiz. 

"Surprisingly and despite their growing role, third-parties on websites still remain a blind spot from cyber-security perspective," the company stated on its blog. 

Because they often store and serve third-party code, CDNs, such as Akamai, are both a common target of Magecart groups and a common point that can be used to protect customers. A year ago, for example, cybercriminals injected web skimmers into websites using third-party code hosted on Amazon's CloudFront CDN, affecting — among other sites — the official NBA website.

Because they can compromise a third-party service into which the ultimate target has little visibility, Magecart attacks can be very effective, Akamai's Sullivan says.

"And all kinds of fraudsters out there, they are causing suffering because some third-party provider is compromised, and now that is an entrance into the confidential information of that web session," he says, pointing to the compromise of a chatbox provider as an example. "[Fraudsters] can leverage that JavaScript that is running to basically monitor all the credit-card details that get entered, credentials, all that sensitive data, and then exfiltrate that off to an attacker controlled site." 

Akamai's Page Integrity Manager aims to find vulnerable resources in a website's code and block malicious activity by behavioral analysis. When a JavaScript determined to be benign initiates and performs a series of actions, the service will let it run. Conversely, if a JavaScript initiates and tries to read from a sensitive field or open up a netwok connection to a domain that is classified as suspicious, then the service will block the code.

"We think this is a natural extension of our service," Sullivan says. "If we are accelerating a website, it makes sense in a suite of tools to also look for suspicious behavior."

Related Content:

Learn from industry experts in a setting that is conducive to interaction and conversation about how to prepare for that "really  bad day" in cybersecurity. Click for more information and to register.