Ike.ninja

The current coronavirus pandemic has resulted in the closure of many pubs, restaurants, and brick-and-mortar retail stores. Many purchases that would previously have been made in person now take place online. In research commissioned by Visa
, 89% of Britons have shopped online since the UK’s lockdown restrictions began, with 31% buying items online for the first time during this period. This increase in online shopping activity benefits criminal groups in that: smaller businesses newly reliant on online transactions provide attackers with a stream of inadequately-defended shopping sites to exploit, and buyers are far more likely to be driven to these compromised shops or to fake shops compared to before the pandemic.

JavaScript skimmers run on compromised shopping sites. When shoppers enter their payment details, the skimmer secretly sends a copy to the attacker – potentially even if the customer does not complete the transaction. Even the most careful of users can be victims of these attacks, as they appear on compromised but otherwise well-intentioned shops with no visual indication of their presence.

Fake shops are another threat. Shoppers seeking bargains may unknowingly find themselves on a fake shop which claims to offers the products they want at a highly discounted price, but the victim will subsequently only receive counterfeit goods, no goods at all, or have the transaction aborted after entering credentials which is equivalent to a phishing attack.

Fake shops also take advantage of the pandemic by offering goods in high demand due to coronavirus, such as N95 masks. The FBI has released a Public Service Announcement about an increase in online shopping scams involving the sale of counterfeit healthcare products such as Personal Protective Equipment (PPE). To date, Netcraft has blocked over a thousand such coronavirus-themed fake shops, 80,000 other fake shops selling all sorts of counterfeit goods, and around 3,500 compromised shops hosting JavaScript skimmers.

The Netcraft browser extension and mobile apps provide protection against fake shops as well as legitimate shopping sites that have been compromised with JavaScript skimmers. When an extension or app user visits one of these dangerous shops, Netcraft will block access to the shop and alert them:

The “Error establishing a database connection” message strikes fear in a WordPress users heart, prompting many a panicked support request. You try to load a page, but all you see is a white box with a mysterious error message. WordPress is down and the “helpful” suggestions beneath the error are more confusing than useful. How can you fix a database error when you can’t even open the admin dashboard to see what’s wrong? Fortunately, “Error …

WordPress 5.5 Beta 1 is now available for testing! This software is still in development, so it’s not recommended to run this version on a production site. Consider setting up a test site to play with the new version. You can test the WordPress 5.5 beta in two ways: Try the WordPress Beta Tester plugin (choose the “bleeding […]

June was an exciting month for WordPress! Major changes are coming to the Gutenberg plugin, and WordCamp Europe brought the WordPress community closer together. Read on to learn more and to get all the latest updates.  WordPress 5.4.2 released We said hello to WordPress 5.4.2 on June 10. This security and maintenance release features 17 […]

Online shopping has surged since lockdown started in March. Many of us, looking to be healthier, have headed online for sports equipment and a number of sportswear retailers have reported booming online sales. John Lewis recorded a 72% increase in total sports shoe sales, while Adidas and Puma have both seen an increase in ecommerce revenue.

Shoppers browsing online for the best deals, however, need to take care, as many people would be surprised at the scale of fake shops. Each day we find new fake shops designed to entice shoppers away from bona fide outlets, as many brands have yet to find effective countermeasures.

Counterfeit shoes, clothing and other accessories are estimated to lose the industry more than €26 billion each year in the EU alone, while the loss due to all online counterfeiting is estimated at $323 billion a year. The OECD estimated that over 3% of all imports worldwide are counterfeit.

Traditionally fake shops claim to sell luxury consumer goods at highly discounted prices. We have seen fake shops using at least three different models:

1. Payment is accepted, but no goods are delivered.
2. At the end of the checkout process, an error message is displayed such as “Out of Stock” and no transaction occurs. This is equivalent to a phishing attack, as the fake shop has the consumer’s credentials.
3. Payment is accepted, and goods are delivered. The quality of goods varies between junk and identical to the bona fide item.

Trainers are the most counterfeited goods

We are currently block around 75,000 fake shops in our extension and apps. Of these, roughly half target a specific brand, such as Nike or Adidas. About 70% of the fake shops selling branded goods sell shoes, predominantly trainers.

Corroborating this, European customs authorities handle more cases of counterfeit sports shoes than any other type of product.

Although Apache and NGINX are both web servers, they approach the task of serving web pages differently. Each has advantages and trade-offs, which prompts the question: can I use NGINX with cPanel?  The short answer is yes, you can use NGINX with cPanel; however, its integration is a little tricky. Let’s explore the ways cPanel users can take advantage of NGINX’s strengths, and look at how we are working to make NGINX a viable alternative …

We have released cPanel & WHM® Version 88 and it’s packed with some exciting long-awaited updates. These include MySQL® 8 support, upgrading to Roundcube 1.4 webmail with responsive mobile themes and Calendar and Contacts Support (CCS) and the inclusion of free ImunifyAV protection for your server. We’re going to take a deeper dive into some of the other useful updates included in Version 88 in this article.  Here’s a list of other improvements in Version …

It’s happened to most of us, you just launched a marketing campaign and went to check your sales and your website is a blank white screen! If it hasn’t happened to you yet, read on. Hosting outages can send you into panic mode, especially if you run an e-commerce website. The loss of potential income can send you into a frenzy and keep you on hold with your hosting company for hours at a time – to quote …

Your privacy is important, and securing your data is part of our mission here at cPanel. Because of this, we regularly review our privacy policy and privacy practices to refine them and to make sure that they accurately reflect how we collect, process, use, and store information. Based on our most recent review, we’ve made changes to our privacy policy. To help you understand these changes, you can follow this link to see a redline of our new privacy …

The post Next Level Ops Podcast: Must Haves for Managed WordPress Hosting with Andrey Kugaevskiy appeared first on Plesk.

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Moderate
• Versions: 3.0.0-3.9.18
• Exploit type: XSS
• Reported Date: 2020-April-10
• Fixed Date: 2020-June-02
• CVE Number: CVE-2020-11022 and CVE-2020-11023

Description

The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog, both are “[…] security issues in jQuery’s DOM manipulation methods, as in .html(), .append(), and the others.”

The Drupal project has backported the relevant fixes back to jQuery 1.x and Joomla has adopted that patch.

Affected Installs

Joomla! CMS versions 3.0.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

• Project: Joomla!
• SubProject: CMS
• Impact: Low
• Severity: Low
• Versions: 2.5.0-3.9.18
• Exploit type: Insecure Permissions
• Reported Date: 2020-April-23
• Fixed Date: 2020-June-02
• CVE Number: CVE-2020-13763

Description

The default settings of the global “textfilter” configuration doesn’t block HTML inputs for ‘Guest’ users. With 3.9.19, the textfilter for new installations has been set to ‘No HTML’ for the groups ‘Public’, ‘Guest’ and ‘Registered’.

Affected Installs

Joomla! CMS versions 2.5.0 – 3.9.18

Solution

Upgrade to version 3.9.19

Contact

The JSST at the Joomla! Security Centre.

May was an action-packed month for WordPress! WordPress organizers are increasingly moving WordCamps online, and contributors are taking big steps towards Full Site Editing with Gutenberg. To learn more and get all the latest updates, read on.  Gutenberg 8.1 and 8.2 Gutenberg 8.1 was released on May 13, followed quickly by Gutenberg 8.2 on May […]

Everyone gets excited when their favorite software gets an update! The Drupal Community is currently abuzz about the release of Drupal 9. Wondering what the big deal is? Let’s talk about Drupal and the new improvements. The Drupal project was started 20 years ago by Dries Buytaert in his college dorm room as one of the world’s first Open-Source Content Management Systems. Online years before WordPress or Joomla, …

Softaculous makes installing popular software on your web server a breeze! Click to learn how to use it with your cPanel & WHM server in this article.