Potent, in-the-wild exploits imperil customers of 100,000 e-commerce sites

Actively exploited bug in Magento could compromise customer data on a massive scale.


by Dan Goodin - Apr 23, 2015 4:27pm PDT  Ars Technica


Enlarge
Scott Hough

Criminals are exploiting an extremely critical vulnerability found on almost 100,000 e-commerce websites in a wave of attacks that puts the personal information for millions of people at risk of theft.

The remote code-execution hole resides in the community and enterprise editions of Magento, the Internet's No. 1 content management system for e-commerce sites. Engineers from eBay, which owns the e-commerce platform, released a patch in February that closes the vulnerability, but as of earlier this week, more than 98,000 online merchants still hadn't installed it, according to researchers withByte, a Netherlands-based company that hosts Magento-using websites. Now, the consequences of that inaction are beginning to be felt, as attackers from Russia and China launch exploits that allow them to gain complete control over vulnerable sites.

"The vulnerability is actually comprised of a chain of several vulnerabilities that ultimately allow an unauthenticated attacker to execute PHP code on the Web server," Netanel Rubin, a malware and vulnerability researcher with security firm Checkpoint, wrote in a recent blog post. "The attacker bypasses all security mechanisms and gains control of the store and its complete database, allowing credit card theft or any other administrative access into the system."
Becoming your e-commerce admin

Attacks observed by Web security firms Incapsula and Sucuri are exploiting the bug to create new administrator accounts inside the Magento databases of vulnerable e-commerce sites. According to Sucuri, the exploits then go dormant, presumably so attackers can later access the databases to steal the personal information of customers.

"The code is leveraging SQL injection (SQLi) and inserting a new admin_user to the database," Sucuri CTO Daniel Cid wrote of one recent attacks in a blog post published Thursday. "If you suspect you have been compromised, look for the usernames vpwq or defaultmanager as it seems to be the ones being used by this specific group so far."

The attacks began on Monday, with fewer than 1,000 attempts against sites that are protected by Incapsula. They plateaued on Wednesday with a little under 1,500 attempts that day and continued into Thursday at about the same rate. On Wednesday, Checkpoint released detailed technical details about the vulnerability. Isreal-based Checkpoint first privately reported the vulnerability to eBay engineers in January. Checkpoint researchers have been encouraging e-commerce sites that use Magento to install the update ever since a patch became available in February.
Enlarge
Incapsula

The attacks are coming from the IP addresses 62.76.177.179 and 185.22.232.218, which are both based in Russia. Cid said web administrators who are concerned their sites are compromised should also check their logs for these addresses. Still, that method isn't fool-proof. According to Incapsula, attacks are also coming from addresses located in China, and it wouldn't be surprising for attacks to become more widespread in the coming days.

The vulnerability gives unauthorized attackers full control of a vulnerable website. That means they could dump the contents of databases to obtain customers' credit card data, e-mail and home addresses, phone numbers, and other personal information. Even when websites properly encrypt a database, attackers could still add hard-to-find scripts that behind the scenes pilfer sensitive customer data during the brief window it's being processed in an unencrypted format. Attackers could also exploit the Magento vulnerability to booby-trap vulnerable websites with malware infects the computers of visitors.

The vulnerability can also be exploited to change the prices a Web merchant charges for specific items. The following video, for example, shows Checkpoint researchers commandeering a laboratory server to obtain for free a luxury watch that normally sells for more than $100,000.
eBay Magento Remote Code Execution (RCE) Vulnerability Demonstration

Web application firewalls from Sucuri, Incapsula, or other leading security firms are blocking most if not all of the exploits underway, but sites that run Magento shouldn't consider such protection a substitute for installing February's patch. The update is available here, under the heading "SUPEE-5344". Installing the patch isn't as straightforward as many administrators would like, so Byte has providedinstallation instructions here. Byte's advisory also provides a search function that's designed to indicate if a specific online merchant is vulnerable. At time of writing, it indicated that Palo Alto Software, Linux Magazine of Germany, Sabaru.com.au, and Fullsail University, were among the 98,000 e-commerce sites vulnerable to the attacks. A variety of Amazon Web Services addresses are also included on the list, but they appeared to be test sites that aren't used in production. Alas, the site is of limited use to end users unless they know specific configuration details of the site they want to test.