I'm going to stay in server side for a bit.
Talk to me about shopping carts.
Shopping carts are a forensic analysist's best customer.
Right.
Really?
Yeah, especially some of the more popular open-source carts.
These are carts that are often free to use,
and some merchants that are starting off like to take
advantage of them because they're free, they work,
they do a good job, they have large followings,
and you can set up a lot of them with the click of a button.
The problem is, is with that open-source code,
the attackers have intimate knowledge of every way that shopping cart works,
and there is no end to the amount of attacks that
they can go in and launch against.
It's the surface area that we talked about.
There's so many points that the attackers can hit that we're seeing
zero-day attacks against some of these bigger shopping carts.
And so, with those carts, they can be great to use,
but you have to have the IT necessary to know how to implement that cart
to know what its weaknesses are and monitor that cart.
And most importantly, you've got to stay up to date on the patches.
We see it all the time where merchants are six months or even
one year behind on their critical updates.
That means that the company maintaining that cart has put out a patch that says,
hey, this shopping cart is vulnerable to all these exploits,
which means all the attackers out there got the same notification.
They now know about it and you don't.
When I was, I was going to say, when I was at the brands,
there was one shopping cart, still a very popular commercial shopping cart,
loads of people use it, therefore, the attacks went after it.
It had vulnerabilities, like all software's got vulnerabilities,
but because it was so popular, it was really heavily hit,
you know the one I'm talking about, and merchants just would not update.
And I know lots of PFI companies that will scan your shopping cart
website and notify you when you're vulnerable.
I guess you do the same stuff for --- Yeah,
I am --- When we have an e-commerce investigation that
involves one of these common shopping carts,
one of the first things we do is just go run a little script
against it that any merchant could do themselves.
It just tells us what patches have been applied.
And there's all these plug-in modules, aren't there,
that also don't get patched.
I think the big e-comm learning thing, which any PFI would say,
I'm sure you'll back me on this,
is if you run one of these commercial shopping carts,
especially the one that's been hit by the bad guys because it's so popular,
not because it's badly written, it's just out there.
It's like Windows, so that they go where they get the most bang for their attack.
Patch.
Scan every day.
There are free services out there that will tell
you that you're behind the patch.
Because the bad guy's doing it to you today.
He's scanning you.
He, or she, knows what version you're at.
As soon as the vulnerability, they've got you.
Merchants really should be patching just as soon as that patch comes out,
but certainly no less than 24 hours.
That's a whole day the attacker has.
That's not tenable anymore is it?
No.
I mean, the attackers don't wait 30 days.
They don't give you a 30-day head start.
The moment an exploit is out there and it's known,
they're trying to find as many carts as they can that have
that vulnerability that they can get into.
So our recommendation is always patch it,
I mean,
almost to the point of have somebody that you can call and get out of
bed to get that patch applied the moment it comes out,
but certainly no less than 24 hours.
Those bots are going to be running, looking for those vulnerabilities.
And as a PFI,
you've seen attacks within the first 24 hours of
these vulnerabilities coming out?
Absolutely.
Wow.
So, merchants need to be scanning and patching really quickly.