WooCommcerce Targeted by Sophisticated Credit Card Skimmers 

Posted in Commentary with tags on March 24, 2023 by itnerd

As reported by Sucuri, a new stealthy, credit card skimming campaign is evading security scan detections by hiding their malicious code inside WooCommcerce’s Authorize.net payment gateway module making it particularly hard to find and uproot, leading to extended periods of data exfiltration. WooCommerce is used by roughly 40% of all online stores.

The previous strategy of injecting malicious JavaScript into the HTML of the checkout pages became too easy to detect by security software. Innovative threat actors are now injecting malicious scripts directly into the site’s Authorize.net payment gateway modules used to process the credit card payments. When successful, the code generates a random password, encrypts the victim’s payment details, and stores it in an image file for attackers to retrieve.

This innovative extension is harder to detect than traditional skimming methods for a few reasons:

  • Malicious scripts are called after a user submits their credit card details and checks out 
  • Regular inspections that scan a website wouldn’t yield any results as code was injected in legitimate payment gateway files
  • Threat actors manipulate WordPress’s Heartbeat API to mimic regular traffic and blend it with the victims’ payment data during exfiltration
  • Instead of plaintext to transfer details, image files have stronger encryption

Baber Amin, COO, Veridium:

   “Security measures offered by EMV and contactless cards are compromised when a user enters their credit card information during an online checkout. Additionally, this process exposes a user’s identity information, e.g. email addresses, shipping addresses, and possibly passwords.

To ensure a safe online shopping experience, it is crucial for website administrators to regularly update their content management systems and plugins. 

For merchants and consumer both, Consider the following measures for increased security.

  • Use of virtual cards for online shopping
  • Use of services like PayPal, and amazon pay for online shopping and checkout for an additional layer of payment protection.
  • Adoption of payment services like Apple Pay or Google Pay, which employ tokenization to safeguard sensitive information. These services offer a more secure and convenient experience, both in-person and online. Tokens, which are generated for each transaction, cannot be reused if stolen. This approach overcomes the limitations of EMV cards, which lack chip readers for online payments.
  • And lastly look for embedded finance vendors that can combine biometrics with tokenized payments to eliminate both credit card and identity data from ever getting to the payment gateway.”

This is all good advice that we all need to follow when we shop online as the threats related to online shopping are increasing every single day.

UPDATE: Rui Ribeiro, CEO and Cofounder, Jscrambler added this comment:

     “This attack highlights an often-overlooked security issue: companies must protect the client-side experience from the moment the visitor is on the site to the moment they leave. In this case, the hacker injected malicious code directly into the payment module, collecting sensitive data. This incident underscores how important it is for security teams to know about all the third-party JavaScript running on their website, what data it is accessing, and when. Not only is the customer experience tainted, but the compromised websites can face issues around data privacy, loss of revenue and reputation. New regulations under PCI DSS v4 will require companies to monitor this type of activity on payment pages. To do that, they will need visibility and control over the JavaScript that’s loaded into their web pages, whatever the source, every time. Whether it’s a hijacking attack, data skimming or a simple configuration error, we must protect each visitor interaction.”

Guest Post: What the Fall of Silicon Valley Bank Means for the Future of Venture Capital

Posted in Commentary with tags on March 24, 2023 by itnerd

By Wendy Jarchow, Chief Investment Officer, River SaaS Capital

Last Friday Silicon Valley Bank (SVB) collapsed, causing the second largest bank failure in U.S. history. On Sunday, New York Signature Bank’s customers began withdrawing their cash, causing the regulators to take control and shut down the bank. Fortunately, due to the rapid response from regulators, the deposit outflows from small and midsized lenders have slowed, and it looks like any other major collapse has been avoided. 

How did this happen?

According to Pitchbook, venture capital deal activity sank over 30% last year and a slowdown in initial public offerings and continuing drawdown in valuations signaled trouble for 2023. However, startup spending hadn’t slowed, even with the expected decline in funding. 

Silicon Valley Bank had been seeing an influx in deposit accounts and a declining need for loans with total client funds having fallen for the last five quarters. With the declining need for loans, SVB needed to offset its assets with a new revenue stream and turned to government securities while the interest rates were at zero. This left the bank open to vulnerabilities, given that the government started to raise interest rates since SVB invested. 

Last Thursday, the CEO of SVB announced his intention to sell those government securities at a loss to offset its current assets. This spurred venture capitalists to turn to social media and other online platforms and recommend that their portfolio companies and borrowers immediately withdraw their money. 

These social media conversations induced panic and fear while providing a sense of uncertainty for all organizations that trusted the institution with their assets. The alarm of organizations withdrawing funds publicly sparked a run on the bank that SVB could not handle. Late Friday, SVB was closed by regulators due to being insolvent. 

Luckily, the U.S. government took action on Sunday night and announced that depositors will be made whole. 

Over the weekend, companies who banked with SVB had to scramble to open new bank accounts and communicate with their customers and employees about the changes and potential impact. Had the regulators not acted quickly, many startups could have had to shut their doors overnight, not being able to make payroll or other recurring expenses. 

In hindsight, had venture capitalists and startup founders stayed calm, this immediate collapse could have been avoided.

However, that doesn’t mean that the venture and startup community is out of the woods yet. 

Where do we go from here? 

Venture capital exists in order to help startup companies that a traditional bank won’t invest in grow and scale. They prioritize tech innovation and growth along with growing the bottom line. There are higher risks, but much bigger rewards. 

Silicon Valley Bank was arguably the epicenter of the financial system for the startup ecosystem because it was not only the bank for these startups, but also provided loans to venture capital and private equity firms. With that said, the future is uncertain, but here are a few things to keep in mind. 

Cyber startups will continue to flourish

In 2022, cybersecurity companies raised a total of $18.5 billion in venture capital funding and cyber security valuations didn’t fall as radically as other industry valuations fell indicating that the area is ripe for innovation and growth. 

Cyber startups should be whole even with the fall of SVB. The government did the right thing when SVB and Signature Bank failed and that was to use the FDIC insurance fund, called the Deposit Insurance Fund, that banks pay into to pay customers at each bank back in full. Although the cap on insured deposits is $250K, to stop panic from spreading, regulators successfully made the exception to make customers whole.

However, access to capital will continue to shrink 

With a projected recession on the horizon, venture capitalists were already pulling back on new investments and concentrating on solidifying their existing portfolio. With the fall of SVB, their appetite for risk will continue to dwindle. Plus, one of their main sources of loans for venture capital is now gone. 

The venture market is not going away because of what happened in the banking industry recently; however, it will be more difficult to get access to capital, at least initially as investments are less available, and likely more expensive.  

We will see a bounce back in venture investing and likely new resources to fill the gap that SVB leaves, but the timing is uncertain. Startups need to preserve cash and closely manage their burn in an effort to extend their runway. Bridging to a larger equity raise by borrowing money from an independent debt provider could be a good resource for some strong growth companies.

The future of SVB and what it means for venture capital is still up in the air

If SVB gets absorbed by a larger bank like, it’s hard to say if they will be funding startups at the same rate. Some large banks will make loans to startups if those startups meet the loan criteria, usually with strong collateral. 

As we have seen in the past, most software and tech companies don’t possess the collateral needed to secure traditional bank financing. Venture banks, like SVB, tend to be more nimble than the big banks. That being said, some of the largest banks such as JPMorgan Chase, Bank of America, Citi have groups/bankers focused on small business so perhaps we could see a shift in mindset where the large banks expand their appetite for risk to support emerging companies.

What should startup founders do now? 

As startups try to navigate when VC investing will return to pre-2022 levels, there are things they can do to ensure their companies keep moving forward. Entrepreneurs and existing investors will need to focus on a few things to maximize their “dry powder.” 

Here are the 3 areas startups should concentrate on in the foreseeable future. 

  1. Focus your time and resources outside of VC

Understand that venture firms will be focused on the most promising companies within their existing portfolios so now is not the time to focus on raising capital from these investors. 

  1. Make the most of resources within your control. 

Here are three main areas that you can control over this next period: 

  1. Focus on customer acquisition costs. Marketing spend can be mitigated by focusing on existing customers v acquiring new. 
  2. Be diligent with cash. Focus on bootstrapping, which can extend the runway.
  3. Streamline operations, including remote working to avoid office expenses where appropriate. 
  4. Leverage existing investors / relationships or focus on independent resources

Not many banks have the startup resources or mindset to support early stage companies. With that in mind, look for financing from your current investors, your cap table or bootstrapping from friends and family. 

You can also identify independent resources, such as stand-alone venture debt providers who understand the inherent risks associated with early stage companies and who can partner with you to help you achieve your goals.

  1. Hang on

We know it’s easy to let panic set in, but strong leaders shine in a time of turmoil.  Lean on your network, overcommunicate to your teams and know that this situation inevitably will shift.  

The US Will Try And Ban TikTok…. Here’s Why That Will Happen, And What Might Stop It From Happening

Posted in Commentary with tags on March 24, 2023 by itnerd

Yesterday, the CEO of TikTok Shou Zi Chew took a visit to Washington to try and head off a ban of the Chinese owned social media app. And from all reports such as this one from Platformer, it didn’t go all that well for TikTok. And it now looks more likely than ever that TikTok will be banned. Here’s why that’s all but certain:

  • Everyone on both sides of the aisle want TikTok Banned: There’s rare agreement from Democrats and Republicans on wanting to ban TikTok. Which means any legislation that relates to a ban will likely go through the House and Senate very quickly and get signed off by The White House almost instantly.
  • Nobody wants to buy TikTok: The only way TikTok avoids a ban is if ByteDance who are the Chinese owners of TikTok sell it to an American company. But the thing is, I don’t know who would want to go down that road to buy TikTok. Forbes estimates that TikTok is worth $50 Billion which isn’t an insignificant amount of money. Then whoever buys TikTok would have to hop through so many hoops to avoid having the US government lower the boom on them. And that won’t be cheap. Thus this is a scenario that simply won’t happen.
  • China: The Chinese government created rules that gives it veto power of any sale of Chinese tech to foreign interests. Thus there is zero chance that China would sign off on any sale of TikTok to the US. Which means that a ban would be the only option for the US.

That’s all great. But here’s two reasons why a TikTok ban won’t happen:

  • Young people use TikTok, and they vote. Thus you have to wonder if politicians will really want to ban an app and anger a bunch of people who have the ability to sway an election that’s coming next year.
  • The courts are likely to weigh in and it is possible that they would stop any ban from happening.

So is a ban of TikTok inbound? I think that lawmakers will try and ban it. But it’s far from a sure thing as far as I can see.

KAYAK and OpenTable integrate ChatGPT

Posted in Commentary with tags , on March 23, 2023 by itnerd

Sister brands KAYAK and OpenTable have launched plugins with OpenAI’s ChatGPT to power personalized recommendations for travel and dining. The union is a first-of-its-kind integration, with KAYAK among ChatGPT’s first travel collaborators to enable flight, hotel and rental car recommendations while OpenTable is ChatGPT’s only restaurant tech collaborator at launch, giving ChatGPT users restaurant recommendations and a direct link to book.

Here’s an example of how this works:

[User] “What’s the cheapest flight from New York to London this summer?”

Flight results from KAYAK will populate in a matter of seconds

[User] “I’d love to experience Afternoon Tea while I’m there, where can I get a reservation for 2 people”

Restaurant results from OpenTable will populate in a matter of seconds

The integration brings a fun, engaging and conversational element to the travel, dining and planning experience, so that finding that perfect destination or restaurant is as easy as texting your best friend.

For more information on KAYAK’s integration, see KAYAK’s blog here.

Rogers Email Users Who Are Stuck With The Telco’s Ongoing Email Issues Don’t Have The Ability To Forward Their Rogers Email To Another Provider…. WTF?

Posted in Commentary on March 23, 2023 by itnerd

For the last three weeks or more, I’ve been working with clients of mine who had had issues with Rogers email. If you’re coming to this a bit late, here’s how we got here. It started as a general outage, but what has dragged on for weeks is an issue with email. Specifically, anyone who uses Rogers email service (in other words they have a @Rogers.com address) cannot get their email. This is in part due to the fact that Rogers requires users to create  App Specific Passwords via Rogers Member Center on each program or device that an email address is used on. The creation of new app specific passwords doesn’t work and existing app specific passwords appear to have been deleted in many cases. That pretty much breaks your applications that rely on them.

Now there is a  workaround for this that I describe here:

The workaround for this is to open a web browser and go to https://mail.yahoo.com and enter your Rogers email account details there. The password that you should use is the one for Rogers Member Center. This will at least allow you to view and reply to email on the web. And while this is a sub optimal workaround for many, it’s the only workaround that exists right now. 

A secondary issue is that you might have tried to reset your email password under the belief that you were using the wrong password. If that’s you, I have some bad news for you. The only way to truly reset your email password is to dial into Rogers to do that. The good news is that once you hit a human, it doesn’t take long to do that. The bad news is that I am hearing wait times of three hours or more to actually get to a human. And I am also hearing that people are getting disconnected while waiting for a human to come onto the line. Which punts you to the back of the line. 

The problem with this workaround is that it is sub optimal as you’re reliant on a web browser to get your email. Besides not scaling well to devices like tablets and smart phones, seniors for example may have issues adjusting to this workflow. Never mind not being to use the application of their choice such as Outlook or Thunderbird.

This has led a lot of my customers to ask me to help them abandon the Rogers email platform with the goals being:

  • They can get their Rogers email on any device or using the application of their choice.
  • They can tell their contacts that they have moved to a new email provider, which by extension will reduce the amount of email coming in from their Rogers email account.
  • When the level of email coming in from their Rogers email account reaches a point where it’s minimal, they can kill the Rogers email account if they so desire.

So to make a move, you’d have to forward your Rogers Email to your new provider so that you can not only get it on any program or device, but you don’t have to constantly check two email accounts. That sound reasonable does it not? Except that you can’t forward your email from a Rogers email account to another email account.

No seriously, you can’t do that.

Yahoo, who is the provider of Rogers email service apparently makes forwarding an email to another account a paid feature. You can find out all the details about this here:

Upgrade to Yahoo Mail Plus or subscribe to Access + Forwarding to use the email forwarding feature in your Settings. Automatic forwarding sends a copy of incoming messages from your Yahoo Mail account to another email address. 

This move by Yahoo happened in 2021 and this thread from 2022 in the Rogers Community Forums highlights the fact that Rogers was caught up in this move by Yahoo. What that means for the average Rogers user is that they are stuck with having very limited options in terms of how to get and interact with their email. And any sort of move off of the Rogers/Yahoo email platform is going to be painful until Rogers fixes their email issues. And who knows when that might happen as Rogers hasn’t said anything about this issue in public. From a PR perspective, never mind just having any sort of respect for their customers, the fact that Rogers hasn’t bothered to communicate with their customers on this is an #EpicFail.

And to add insult to injury, I can’t seem to find a way for a Rogers customer to pay for this feature. If you can find a way to pay for this feature, please leave a comment as many of my customers are so desperate to dump Rogers/Yahoo as their email provider that they’d hand over their credit cards to do it.

Honestly, Rogers and Yahoo should have forwarding email to another provider as a standard feature. The fact that this is a paid one is mind blowing. It’s almost as if Rogers and Yahoo wants to make it as painful as possible to exit their email service should you choose to. While it highlights the fact that you should never use your ISP’s email service, that means nothing to any Rogers user who is currently trapped in Rogers inability to fix their email platform.

Shame on you Rogers.

68% Of Canadian Media & Entertainment Organizations Added New Revenue Streams Last Year: Salesforce

Posted in Commentary with tags on March 23, 2023 by itnerd

Salesforce today released its Media & Entertainment Industry Insights Report that shares key trends from industry decision-makers across seven counties, on how organizations in the streaming/studio, brand advertiser, advertising agency, gaming, and other media and entertainment sectors are evolving amid digital-first customer expectations and economic headwinds. 

Key Canadian insights of this year’s Media & Entertainment Industry Insights Report include:

Despite Economic Headwinds, Customer Experience Remains Paramount. Today’s media and entertainment market is saturated, and many customers are re-evaluating their subscriptions, upping the ante for media and entertainment companies to prove their value. But hurdles make this an onerous task. The top two industry priorities in Canada are ‘improving operational efficiency’ and ‘experience innovations’, while ‘increased costs’ are the top industry challenge.

New Realities Spark Revenue Diversification. Diversified revenue streams are key for media and entertainment companies moving forward as they seek to increase average revenue per user. Sixty-four per cent of media and industry companies in Canada partner with influencers, and 52% have a fully defined Web3 strategy.

A Pursuit of Efficiency Hinges on Automation, Data, and Budgets. With advertising spend forecasted to decrease in the near term, efficiency is paramount to media and entertainment company strategies. Automation, AI, and data integration are seen as key to this pursuit. Employee productivity, closely followed by employee experience, are the top reported automation benefits among media and entertainment companies in Canada.

Methodology

Data in this report is from a double-anonymous survey of industry decision-makers conducted from December 14–29, 2022. The survey generated 350 responses from a range of media and entertainment professionals with a title of director or higher across Australia, Canada, France, Germany, India, the United Kingdom, and the United States. Cultural bias impacts survey results.

For more information:

Cleartext credentials can be extracted from Veeam Backup & Data Recovery: Horizon3.ai

Posted in Commentary with tags on March 23, 2023 by itnerd

Horizon3.ai has just published Veeam Backup and Replication CVE-2023-27532 Deep Dive and a new proof of concept (POC) allowing an unauthenticated user with access to the Veeam backup service (TCP 9401 by default) to extract cleartext user names and passwords.

The Veeam platform provides data recovery in the event of ransomware attacks on multi‑cloud infrastructure. Which means that this POC is a huge problem.

Horizon3.ai Exploit Developer James Horseman said:

“CVE-2023-27532 allows an unauthenticated user with access to the Veeam backup service to request cleartext credentials. We have examined the vulnerable port, reverse engineered the Veeam Backup Service, and constructed a WCF client using .NET core. We have also shown how to extract credentials from the Veeam database by invoking the CredentialsDbScopeGetAllCreds and CredentialsDbScopeFindCredentials endpoints.  Finally, we have released our POC on Github, which is built on .NET core and capable of running on Linux, making it accessible to a wider audience. It is important to note that this vulnerability should be taken seriously and patches should be applied as soon as possible to ensure the security of your organization.”

He also notes that others, including Huntress, Y4er, and CODE WHITE, have provided insight into this vulnerability. Horizon3.ai published its post and POC to offer additional insights.

You can read the deep dive here.

Google Cloud unveils new AI integration with Shopify

Posted in Commentary with tags , on March 23, 2023 by itnerd

Today, Google Cloud and Shopify announced a first of its kind integration, bringing Google’s leading search, browse and AI capabilities to Shopify retailers using Commerce Components, Shopify’s enterprise retail solution. 

This integration will help create a more seamless, intuitive online shopping experience, increasing customer retention for retailers and keeping Canadians engaged through the purchase journey. New data from Google Cloud found that over 50 per cent of Canadian shoppers are not completing their online purchase journeys because they cannot find what they are looking foramounting to losses of more than $106B each year for online retailers in Canada.

Google Cloud surveyed Canadians on their shopping experiences, finding: 

  • Despite the rise of online shopping, Canadians are not having a seamless experience. 9 in 10 Canadian consumers (89%) say they are more likely to make repeat visits to retail websites that are easy to navigate and browse, and a majority of Canadian shoppers (80%) report hurdles in their product discovery experience when searching online. 
  • Canadians are abandoning their online cart if they can’t find an item. After an unsuccessful search experience using the search function or search box on a retail website, more than half of consumers in Canada (51%) say they typically abandon their entire cart and go elsewhere if there’s at least one item they can’t find on a website.
  • With so much choice, a bad experience online can put brand loyalty in flux. More than 3 in 4 consumers (76%) say they are less loyal to a brand when it’s hard to find what they want on their website. 

This new integration will help to address these challenges, with AI-powered functionalities that deliver better and more personalized results. 

You can read the full press release as well as this blog post for more information. 

Hackers Impersonate Microsoft in Latest Phishing Campaign

Posted in Commentary with tags on March 23, 2023 by itnerd

Researchers at Avanan, a Check Point Software Company, have released its newest research discussing how hackers are creating realistic messages to report unusual activity to Microsoft. Instead of sending the message to a legitimate source, the hacker has created a “Mail-to” link that will automatically open up a new email, with the recipient being the hacker. 

In this email, hackers are sending what looks like an “Unusual sign in activity” alert, a common notification that Microsoft sends out when an account has an unusual sign-in. The email encourages the end-user to “report” this activity. Clicking on “Report the User” will open up a new email with the sender address, subject and body already populated. The hacker will reply to the sent message, asking the end-user for log-in information.

You can read the research here.

Not That This Is A Surprise, But Here’s Proof That Ransomware Is The New Cool Thing For Threat Actors

Posted in Commentary with tags on March 23, 2023 by itnerd

According to report by ENISA, ransom attacks more than doubled in the EU transportation sector in 2022 v. 2021.  This new report analyzes the cyber security landscape in the EU in relation to aviation, maritime, railway and road transport covering the period of January 2021 to October 2022.

                                                    2021                 2022

        Ransomware Incidents        13%                 25%

        Data breaches/leaks              21%                  9%

        Malware Reports                   11%                   6%

55% of incidents were financially motivated while hacktivists accounted for 23%. DDoS attacks increased from 2% to 13%.

15% of the attacks targeted State-backed entities and were largely aimed at the maritime sector and government transport authorities. European airports, railways and transport authorities were among other victims of those attacks, ENISA said.

ENISA acknowledges that its analysis likely under-represents the reality as the non-disclosed incidents may outweigh those made public. despite mandatory reporting.

Jan Lovmand, CTO, BullWall had this to say:

   “People in the transportation industry and governments should take the recent report by ENISA seriously and make immediate efforts to improve their cybersecurity measures. Attacks are increasing in frequency, and it is important for organizations to take proactive measures to mitigate the risk of a successful attack.

   “Organizations should review their existing cybersecurity programs and assess the effectiveness of their current defenses against ransomware attacks. They should also ensure that all employees are aware of the threat and trained in basic cybersecurity practices, such as keeping software up-to-date and using strong passwords.

   “Cybersecurity measures, such as multi-factor authentication, intrusion detection systems, and advanced threat intelligence and containment systems for detecting and responding to potential threats are table stakes in this threat environment.

   “In addition, governments should collaborate with industry organizations to develop and implement best practices for cybersecurity in the transportation sector. This includes providing guidance on cybersecurity risk assessments, establishing industry standards, and promoting information sharing to help organizations better understand the evolving threat landscape.”

What is clear from these numbers is that ransomware is what all the cool threat actors are doing. No shock there. That means that you have to make sure that you’re not a target of the cool threat actors. That will make these threat actors less cool and the world a safer place.