Still 88,000 Shops Vulnerable Magento Leak

A critical vulnerability in the popular shopping cart software Magento allow an attacker to completely take over the shop is still in 88,000 merchants present, even though the update since early February. The vulnerability is now being used to attack shops.

In addition, security company Check Point has released details about the leak. Researchers from the company warned Magento on 14 January this year about the problem they had found. A few weeks later, a security Magento. Still, many merchants decided not to install it. The Dutch hosting company Byte warned a week ago that still 140,000 merchants risked because they were not patched. Meanwhile, a significant portion of the vulnerable Magento shops install the update, but are still vulnerable 88,000 shops, according to the last census of Byte.

That census took place last Friday, the same day that the Magento developers a warning afgaven for the leak. Security firm Sucuri reported Friday that it had now perceived attacks that made ​​abuse of the leak. In addition, the company claimed that merchants who had rolled the patch not yet been hacked or that would be only a matter of time. Below is a video demonstration of Check Point which shows how online stores can be robbed by setting the price of goods at zero through the leak.

140,000 Merchants Vulnerable Magento Leak

A serious vulnerability in the shopping cart software Magento enables merchants 140,000 at risk of being hacked, warns the Dutch hosting company Byte. The vulnerability was in February by the developers patched but examining Byte April 14 shows that 60% of merchants who still uses a vulnerable version running on Magento. That equates to 140,000 shops.

There are no observed attacks yet, but if there is an exploit appears Byte expects all vulnerable web shops will be hacked within 48 hours. To help, there is a merchants website appeared online that reports whether the shop is vulnerable or not. In addition, administrators are advised to install the update. According to an employee of security firm Check Point on Reddit , the company will next week more details about the vulnerability publicly, but no exploit code. Or the employee states that it is a very serious leak.

Google Removes Malware From Google Play Store

Google has removed a malicious app from Google Play that occurred as a backup service, but in reality, text messages, call information, and device information was trying to steal. The app was called "Save Me" and claimed that users through the service could save their contact information. In order for the service to notify users had to specify information such as name, email address, phone number, country and there had to be a personal photo will be uploaded.

Once activated the malware did however connect to a server and send contact information, text messages, call information, such as numbers, date and time and device information back. Also removed the malware own icon. The attackers behind the malware used a spam campaign by Bit.ly shortened links to spread the app. Analysis of Bit.ly -Left show that was nearly 6,000 times clicked, mainly in Africa. It is unknown how many people actually have the app installed.

Security firm Lookout discovered the malware and then warned Google that the malicious app removed. To prevent infection by this type of malware, users advised to only download the official market place and then only apps from known developers.Users therefore have first read the reviews and research the developer so that they are sure that it is a reliable product."Especially if it is a tool that promises to protect sensitive information," says Jeremy Linden Lookout.