E-commerce Cyber Attacks Surge in 2023: Honda’s Breach and Strategies for Safeguarding Online Platforms

The landscape of cyber threats targeting e-commerce applications has witnessed a consistent surge in 2023. This trend is propelled by the expanding omnichannel nature of e-commerce businesses, which are increasingly deploying API interfaces. Concurrently, threat actors are tirelessly exploring avenues to exploit vulnerabilities. Consequently, the imperative of routine testing and continual vigilance has emerged as a cornerstone for shielding web applications. Through regular assessment and vigilant monitoring, businesses can identify and swiftly rectify vulnerabilities.

The 2023 Honda E-commerce Platform Attack

The e-commerce landscape recently experienced a major breach as the vulnerabilities of Honda’s power equipment, lawn, garden, and marine products commerce platform were exposed. This breach materialized through a flaw within the platform’s API, enabling anyone to initiate a password reset for any account.

The vulnerability was unmasked by researcher Eaton Zveare, who earlier unearthed a critical security loophole in Toyota’s supplier portal. The flaw in Honda’s system allowed for password resets on higher-level accounts, granting threat actors unrestricted admin-level access to the company’s network. Had this exploitation fallen into the hands of cybercriminals, it could have led to an extensive data breach with far-reaching consequences.

Zveare explained, “Broken/missing access controls made it possible to access all data on the platform, even when logged in as a test account.”

The breach compromised sensitive information, including:

• Nearly 24,000 customer orders across Honda dealerships from August 2016 to March 2023, encompassing customer names, addresses, and contact numbers.
• Access to modify 1,091 active dealer websites.
• Exposure of personal details tied to 3,588 dealer users/accounts.
• Acquisition of 11,034 customer emails, complete with first and last names.
• Discovery of 1,090 dealer emails.
• Unauthorized access to Honda’s internal financial reports.

This level of information exposure empowered cybercriminals to execute various malicious activities, from phishing campaigns and social engineering attacks to illicit sale of data on the dark web. Furthermore, the extensive access could facilitate the installation of malware on dealer websites, opening avenues for credit card skimming attempts.

The Path to Vulnerability Discovery

Zveare’s findings revealed a multi-step process through which the vulnerabilities were exploited:

1. Password Reset Flaw: The e-commerce subdomains of Honda’s registered dealers were found on “powerdealer.honda.com.” An API flaw on one of these subdomains, Power Equipment Tech Express (PETE), allowed password reset requests sans the need for the existing password.
2. Initial Data Access: A valid email address was ascertained from a YouTube video showcasing the dealer dashboard via a test account. Utilizing this information, login credentials were reset and employed on any Honda e-commerce subdomain, unlocking access to internal dealership data.
3. Accessing Real Dealer Accounts: Zveare leveraged a JavaScript vulnerability that stemmed from the sequential assignment of user IDs and inadequate access security. This approach facilitated access to real dealer accounts without setting off alarms.
4. Admin-Level Access: By manipulating an HTTP response, Zveare succeeded in accessing the platform’s admin panel by masquerading as an admin-level account.

Honda reported rectifying the vulnerabilities on April 3, 2023, after Zveare’s findings were conveyed on March 16, 2023. The researcher did not receive a financial reward, as the company lacks a bug bounty program.

The Significance of E-commerce Application Security Testing

The paramount importance of e-commerce application security testing lies in safeguarding the personal and financial data of all stakeholders linked to the platform. This encompasses customers, dealers, and vendors. With the escalating frequency of cyberattacks targeting e-commerce applications, comprehensive protection is imperative to forestall data breaches capable of inflicting severe damage on a business’s reputation and financial standing.

Moreover, stringent regulatory compliance mandates in the e-commerce sector underscore the business-critical nature of data protection. Comprehensive application security mandates an approach beyond merely adopting the latest security features. Rigorous testing of every component and adherence to best practices are necessary to fortify a robust cybersecurity strategy.

Emerging Cyber Threats for E-commerce Applications

1. Phishing: Phishing remains a prominent social engineering attack aiming to dupe victims into accessing malicious websites or applications. Cybercriminals send emails or texts impersonating trusted sources like banks or colleagues to entice users into sharing sensitive data.
2. Malware/Ransomware: Malware infestations lead to various activities, such as locking users out of their accounts. Ransomware then demands payment to restore access. Multiple malware variants cater to distinct functionalities.
3. E-Skimming: E-skimming targets credit card data and personal information on e-commerce websites’ payment processing pages. Cybercriminals employ phishing, brute force attacks, XSS, or compromise third-party sites for this purpose.
4. Cross-Site Scripting (XSS): XSS injects malicious code into web pages, usually JavaScript, to monitor user input or page activities for sensitive data collection.
5. SQL Injection: For e-commerce apps reliant on SQL databases, SQL injection attacks manipulate input queries to gain unauthorized database access. This could encompass viewing or manipulating data.

Understanding Vulnerability Testing Areas and Methodology

Areas of Vulnerability Testing (8):

1. Web Application-Based Vulnerability Assessment
2. API-Based Vulnerability Assessment
3. Network-Based Vulnerability Assessment
4. Host-Based Vulnerability Assessment
5. Physical Vulnerability Assessment
6. Wireless Network Vulnerability Assessment
7. Cloud-Based Vulnerability Assessment
8. Social Engineering Vulnerability Assessment

Phases of Vulnerability Assessment Methodology (6):

1. Identify critical and high-risk assets.
2. Execute vulnerability assessment.
3. Perform vulnerability analysis and risk assessment.
4. Remediate vulnerabilities (e.g., applying patches).
5. Optimize system security.
6. Present assessment results and actions taken.

Pentesting As A Service (PTaaS)

Penetration Testing as a Service (PTaaS) revolutionizes cybersecurity testing through regular, cost-effective assessments and enhanced collaboration between testing providers and clients. PTaaS enables businesses to detect vulnerabilities at shorter intervals.

PTaaS vs. Traditional Pen Testing

PTaaS advances beyond traditional contractual penetration testing, which often necessitates considerable time intervals. Unlike annual tests, PTaaS facilitates real-time, ongoing assessments through a blend of automated scanning tools and manual techniques. This approach ensures continual security assessment and addresses gaps inherent in periodic testing.

Conclusion: Safeguarding E-commerce’s Digital Frontier

The prevalence of cyberattacks targeting e-commerce platforms, even those deployed by global conglomerates like Honda, underscores the urgency of comprehensive security measures. Security testing emerges as the primary means of assessing the entirety of an application’s attack surface, safeguarding both the business and its user base from threats such as phishing and e-skimming.

Pioneering Penetration Testing as a Service emerges as a potent strategy, enabling regular scans to deliver a continuous evaluation of vulnerabilities, subsequently fostering timely mitigation.

In a realm where the digital and physical intersect, the efficacy of e-commerce hinges on a fortified cybersecurity posture. As e-commerce evolves, so does the complexity of threats. The evolution of security strategies is essential to ensuring businesses navigate this dynamic landscape with resilience and vigilance.