PrestaShop Security Alert: Digital Skimmer Targeting Payment Information

PrestaShop Stores Targeted by Digital Skimmer: What You Need to Know

A recent security alert has been circulating among PrestaShop users, warning of a "digital skimmer" targeting online stores. This malware replaces legitimate payment buttons on the checkout page with fraudulent ones, redirecting customers to fake payment forms designed to steal their payment information.

The original forum post highlights an email received by merchants, urging them to contact their PrestaShop expert or PrestaShop Support to perform a thorough security check. The email also included a link for further details.

Key Discussion Points and Concerns:

• Origin of the vulnerability: Users expressed concern about the lack of clarity regarding the source of the security breach. Many wondered if the issue stemmed from PrestaShop itself.
• Legitimacy of the email: Some users questioned the authenticity of the email, particularly the links provided.
• Impacted versions: There was uncertainty about which PrestaShop versions or themes were affected by the vulnerability.
• Prevention: Users sought guidance on how to prevent future attacks and secure their stores.

Solutions and Recommendations from the Community:

Several users offered helpful suggestions and resources:

• Checking for compromise: One user shared a link to a PrestaShop help article detailing how to verify if a store has been compromised: PrestaShop Help Center.
• Friends of Presta Security List: A user pointed to the Friends of Presta security website (security.friendsofpresta.org) as a valuable resource for identifying potential vulnerabilities.
• Module vulnerabilities: It was suggested that vulnerabilities in modules are a common entry point for attackers. Users were advised to check for known vulnerabilities in their installed modules using resources like CVE Details, CVE.org, and NIST NVD:
• CVE Details
• CVE.org
• NIST NVD
• Comprehensive security audit: A comprehensive security audit should include checking the PrestaShop core, modules, theme, overrides, server permissions, PHP configuration, and FTP/SSH access.
• Regular updates: Keeping PrestaShop core, modules, and themes up-to-date is crucial.
• Remove unused modules: Deactivate and remove any modules that are not actively used.
• Monitor logs: Regularly review server logs for suspicious activity.
• Secure hosting: Choose a reputable hosting provider with robust security measures.

Preventative Measures and Ongoing Security:

The discussion emphasized that security is not a one-time fix but an ongoing process. Regularly updating software, removing unused modules, monitoring logs, and maintaining correct permissions are essential steps. Users should also be wary of installing modules or themes from untrusted sources.

As one user stated, "Waiting for a hack to happen before worrying about it always costs more than prevention."