Threat Advisory: E-commerce Bots Use Domain Registration Services for Mass Account Fraud

While researching a recent large-scale bot campaign with CQ Prime Threat Research team lead, Dean Lendrum, we found attackers using domain parking and monetization services to register multiple domains, creating a large number of fake eCommerce accounts per domain. TL; DR ------ Analysis of...

SUSE: Security Advisory (SUSE-SU-2021:4186-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:4154-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE: Security Advisory (SUSE-SU-2021:4136-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

New research reveals that one third of all log-in attempts on eCommerce sites are malicious

What do humans and bots have in common? A love for visiting online shopping sites: more than half 57% of all attacks on retail websites in 2021 were carried out by bots, compared to 33% for all other industries. It gets worse: a third of all log-in attempts on retail eCommerce websites are accoun...

Fueled by Pandemic Realities, Grinchbots Aggressively Surge in Activity

The festive season is moving into full swing, and so is holiday shopping – including special product launches and sales. But just as we collectively look forward to leisurely browsing for deals from the couch, perhaps with a mug of hot cocoa, “grinchbots” have emerged to burn it all down. Accordi...

Grinchbots strike again this holiday shopping season as bot traffic spikes 73%

The days are getting chilly, holiday drinks are back on the menu at your favorite café and family gatherings are planned. In an almost pavlovian response, Grinchbots have also returned in record levels to ruin your online holiday shopping experience. In the State of Security Within eCommerce in...

Scalpers, and their bot armies, swing in to net web-based Spiderman tickets

29 November 2021 was “Spider Monday” and tickets for Marvel’s film Spider-Man: No Way Home went on sale with the sort of marketing fervor for which Disney and the Marvel Cinematic Universe MCU are famous. As tickets to one of the most eagerly anticipated Christmas films featuring one of the most...

Cyber Monday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Cyber Monday was up 5% globally compared to Cyber Monday 2020 and 31% compared to average Monday traffic...

Cyber Monday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Cyber Monday was up 5% globally compared to Cyber Monday 2020 and 31% compared to average Monday traffic...

Hitachi Energy Retail Operations and CSB Software

1. EXECUTIVE SUMMARY CVSS v3 7.2 ATTENTION: High attack complexity Vendor: Hitachi Energy Equipment: Retail Operations and Counterparty Settlement and Billing CSB Product Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow...

Black Friday Web Traffic Up Over 2020

Online retail traffic that Akamai delivered during Black Friday was up 2% globally compared to Black Friday 2020 and 14% compared to average Friday retail traffic. The modest year-over-year increase can be attributed to the significant rise in 2020 traffic due to COVID-19–related lockdowns and...

Online Merchants: Prevent Fraudsters from Becoming Holiday Grinches

As the holiday shopping season gets into full swing, merchants aren’t the only ones expecting to have a prosperous year. Fraudsters, too, are out to grab their illicit share of the money changing hands or accounts in the weeks ahead. Especially susceptible to theft by fraud are millions of...

How to defend your website against card skimmers

Black Friday and the holiday season are approaching, and shoppers are forecast to spend record amounts again this year. Retail websites big and small can expect a lot of interest from shoppers looking for deals, and a lot of interest from cybercriminals looking to cash in on those shoppers, by...

Retail Data Needs Better Security in a Contextual World

Do you remember the first time you made an online purchase? Me neither. I’ve made so many online purchases over the years, and I’ve probably made more in the past 18 months than in the past 5 years combined...

By the Numbers: The State of Security in eCommerce

The ongoing global pandemic has accelerated eCommerce growth and pushed more consumers online. More consumers mean a larger threat landscape and ensure that cybersecurity issues remain a significant, ongoing challenge for the retail industry. Based on a 12-month analysis by Imperva Research Labs,...

CVE-2021-35528

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing CSB allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or...

CVE-2021-35528

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing CSB allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or...

CVE-2021-35528 Authentication Bypass Vulnerability Vulnerability in Retail Operations Product and Counterparty Settlement and Billing (CSB)

Improper Access Control vulnerability in the application authentication and authorization of Hitachi Energy Retail Operations, Counterparty Settlement and Billing CSB allows an attacker to execute a modified signed Java Applet JAR file. A successful exploitation may lead to data extraction or...

CVE-2021-35528

CVE-2021-35528 — Hitachi Energy Retail Operations/CSB is an improper access control vulnerability (CWE-284) in the application’s authentication/authorization that relies on local session validation, enabling an unauthorized, signed Java Applet JAR to be executed. Affected versions: Hitachi Energy...