CybersecAsia readers are always pulsing along with cyber-threat trends. Here is a cyber-stethoscope to help you along this e-shopping season!

Starting with 11/11 all the way until early 2021, hackers will be in overdrive, preying on holiday shoppers, lax e-commerce cybersecurity, and countless breached databases already in circulation to aid in phishing and other scams.

CybersecAsia managed to converse with Adam Kujawa, Head of Malware Intelligence at Malwarebytes, to get an overview of cyber threats we should all be on the lookout for. Perhaps his reminders will be our virtual stethoscope to track the pulse of this unprecedented year’s extraordinary e-commerce spectacle…

Adam Kujawa, Head of Malware Intelligence, Malwarebytes shared about cyber threats awareness
Adam Kujawa, Head of Malware Intelligence, Malwarebytes

CybersecAsia: What are the most common threats that emerge during the pandemic? Which are the most dangerous in the festive e-commerce season?

Adam Kujawa (AK): One of the common threats that emerged during the pandemic is web skimming. In March, we saw an increase in payment site compromises, which led to scripts being deployed and information getting stolen from the online shops of multiple vendors.

One such notable attack was against Tupperware, whereby cybercriminals made use of a hidden malicious code to activate a fraudulent payment form during the checkout process.

A lot of COVID-19-themed phishing e-mails in the first half of the year were meant to steal personal data including login information and credit card numbers. Cybercriminals wanted to map out the new landscape they will be targeting—for instance, organizations whose employees are working from home, and users who are likely shopping or checking their personal accounts while using work devices.

Because of the pandemic, a lot of fake guidance will be put out to provide folks with ‘tips’ on doing things safely, considering the pandemic. This theme of ‘tips for holiday fun during a pandemic’ is a perfect mask for cybercriminal operations looking at infecting home users.

CybersecAsia: How has the COVID-19 pandemic influenced the way cybercriminals hijack e-commerce?

AK: Honestly, the pandemic has made it easier for cybercriminals to launch attacks. Not only are there fewer employees monitoring things in the office, there is more chaos due to employees moving to remote-working as well as taking steps to keep the business profitable and/or safe for employees. All these create a landscape where it is likely a little easier to get away with stuff right now, considering all the changes from the year.

Combining this shift in employee movement with an increase in e-commerce activities due to various safety measures implemented to curb the spread of the pandemic, there is an influx of online shopping, with a decline in available staff and a distracted IT team.

Under such circumstances a lot of things can go wrong for the victims, often at the benefit of the cybercriminals.

CybersecAsia: Please share some tips and best practices for online retailers to secure themselves and their customers.

AK: For website owners, firstly, ensure that sites are hosted securely, using services that keep plugins, hardware and server software updated and secure. If there are any credentials used to log in to e-commerce sites, make sure that they are unique and difficult to crack. As a cybersecurity compromise may modify a page or add new code, regularly backing up important site files will help to reduce worries of having to remove unwanted code as backup files can be restored.

The payment processor should also have top of the line web security available to them. In any case, the onus of creating a secure financial transaction is on the organization: for instance, some businesses host their own check-out platforms, which are secured specifically from the types of attacks that we commonly see against amateur-deployed e-commerce security.

As customers, keeping security software systems updated while shopping online is a great idea. In order to ensure a safe shopping experience, do keep these questions in mind before entering any financial information into an e-commerce site:

  • Do you trust this site, have you used it before without issue? Does it have good reviews or is it brand new?
  • Is this site using a third-party payment processor or trying to do it themselves?
  • Before entering the credit card number, open the developer tools in the browser (often Ctrl+shift+I)—this has historically revealed or disabled any kind of malicious code running on top of the payment form. However, as cybercriminals are coming up with increasingly-sophisticated methods to conduct malicious activities, they will likely find ways to bypass this hack in future.

We thank Adam for his insights and wish every CybersecAsia reader great shopping ahead!