Security researchers Riskiq have identified 17,000 domains that they say Magecart has compromised this way, including 2,000 of "the world's biggest sites." It's not clear how many of those actually have credit-card processing scripts that would allow Magecart to steal card details from their customers.
Amazon S3 buckets are secure by default. Companies run into trouble when they actively change those permissions, either somewhere in the development process or when they hand off cloud work to a third-party contractor. Those Amazon S3 bucket misconfigurations have caused plenty of problems before. The fallout, though, was usually limited to the exposure of personally identifiable information, huge databases of usernames and passwords and birthdays and Social Security numbers that wind up for sale, or for free, on the dark web and elsewhere. That’s because those goofs typically give read permission to interlopers, but not the ability to write code. The Magecart hackers figured out a way to scan for misconfigurations that do both—and now they know 17,000 vulnerable domains.
“This is a whole new level of misconfiguring,” says Klijnsma. “These buckets are pretty much owned by anybody who talks to it, which is on a different scale, a different type of data leakage. Pretty much anybody can do anything in those S3 buckets, and the reach of those is quite big.”
Hack Brief: A Card-Skimming Hacker Group Hit 17K Domains—and Counting [Brian Barrett/Wired]
(Image: Mary Rose Trust, CC-BY-SA, modified)
Last week at Defcon, a security researcher named Smea presented their findings on vulnerabilities in the Lovesense Hush, an internet-of-things buttplug that has already been shown to have critical privacy vulnerabilities.
Few states have voting machines that are simultaneously more obviously defective and more ardently defended by the state government than Georgia, where 16-year-old touchscreen systems are prone to reporting ballots cast by 243% of the eligible voters and where gross irregularities in election administration sends voters to the wrong polling places or sends co-habitating husbands […]
Apple's Faceid -- a facial recognition tool that unlocks mobile devices -- has a countermeasure that is designed to prevent attackers from scanning an sleeping/unconscious (or dead) person's face to unlock their phone, by scanning the face for signs of consciousness.
Want to make a hit? The right software is out there for anyone, but any music producer will tell you that finding the right sound can still take time and talent. Still, the right tools are a great shortcut, which makes this Synth & Sound Pack Bundle absolutely priceless. And now that it’s on sale […]
Let’s face it: People at the gym aren’t bragging about their headphones. If they were that great, they’d be listening to them instead of talking about them. So while we’re sure those new PowerBeats Pro earbuds are something special, why would you shell out $250 for a tiny pair of speakers when comparable ones are […]
Big companies take on big projects. When they do that, they need a project manager to lay out a roadmap for the entire team – and they’re typically willing to pay a big paycheck to the person who can fill those shoes. So what does it take to become a project manager? If you don’t […]