Attackers are increasingly and actively exploiting an unknown flaw in Magento, to steal credit card information.

More than 200,000 online stores using Magento, the ebay owned web exommerce platform, are at high risk because attackers can gain access to sensitive data submitted by a customer to Magento.

This is the second attack on Magento in a period of three months, we had reported about the Shoplift bug here. It had posed a critical threat to unpatched sites and lead to complete compromise of affected sites.

How the attack works?

Web security firm Sucuri are still investigating the attack vectors and said, “It seems though that the attacker is exploiting a vulnerability in Magento core or some widely used module/extension. Using this vector, the attacker is able to inject malicious code into the Magento core file.”

Sucuri researcher Peter Gramantik, says further is his post, that once this code is injected, attacker can take sensitive customer information and keep an eye on the website silently.

Every POST request goes to the attacker, who identifies valuable credit card details only, based on some structured rules before storing it in an encrypted form.

Attackers store the billing information, processed by the infected site, in a fake image (JPEG or GIF) file. The image file might look like a broken image, if simply loaded via web browser. However, the attacker can download the entire file and decrypt the stolen data using Public Key in an attempt to collect all the billing information processed by the Magento e-commerce website.

Can you trace the attack?

To evade discovery, the malicious script includes a small purge function that wipes trails clean.

What’s also noteworthy is that the PUBLIC_KEY used to decrypt the stolen data, is the same in different instances of attack. It means that it could probably be a single person responsible for creating all the different versions of the script.

Attackers also alter the creation timestamp of fake image and add a header to escape detection.

When does ecommerce site end user know that they are at risk?
Unfortunately, the end user does not know that his credit card details have been compromised until they raise their ugly heads on your bank statements.

More Variants of the attack

Another variant discovered and investigated by Sucuri, is more direct than the previous one. It simply steals the payment details during the transaction processing and without being detected sends a mail to the hacker’s email.

This variant does not encrypt any information before sending it to the attacker. Rather it uses existing data variables lying unprotected, pointing out that they have complete knowledge of how the function and Magento works.

How to safeguard your store against attack?

Later in their post Sucuri said that, it’s very important for the merchants to realize that its their responsibility to protect their customers’ sensitive data and urged them to do so through PCI compliance.

Since such attacks are on the rise and can attack any ecommerce, not just Magento users in particular, its more important than ever to closely monitor your site and do everything possible to safeguard it.

The post Hackers Exploit Zero-Day Vulnerability in Ebay Magento Compromising Credit Card information appeared first on MageShield | Secure & simple magento maintenance.

Magento has recently uncovered some potential flaw and urged its users to immediately apply the patch SUPEE-6285. This is the third critical security patch released recently after SUPEE-5344, SUPEE-5994 and applies to all editions of the Magento Community and Enterprise software.

It is recommended that you either apply all the three patches or upgrade to the latest version of the application immediately to help protect your website from exposure to multiple security vulnerabilities.

What are the security issues that the releases safeguards against?

Even though there are no confirmed attacks reported, related to the following issues, Magento has raised critical warning to take the first step against attack, before it happens.

The patch takes care of the following vulnerabilities –
Attacker can exploit the vulnerability to impersonate as administrator, gaining access to the last orders feed and posing a serious threat by compromising sensitive data on the website.
Multiple security issues like cross-site scripting (XSS), cross-site request forgery (CSRF), and error path disclosure vulnerabilities have been addressed.

How do I download and apply these patches?

All site owners and administrators need to install immediately –
Enterprise Edition – Download a patch available for Enterprise Edition 1.9 and later releases
Community Edition – Download a patch available for Community Edition 1.4.1 to 1.9.1.1. Or you can install the latest release, Community Edition 1.9.2, that is now available for download.

Please Note –

To ensure correct working of the patch, you need to first implement SUPEE-5994 (issued in May)
Apply the right patch for your instance, as there are separate patches for each version of Magento.
The patches are not server wide, so if your store uses multiple Magento instances, you will need to apply a patch to each instance individually.

To read about more Magento Vulnerabilities, check our blog post:
Hackers Exploit Zero-Day Vulnerability in Ebay Magento Compromising Credit Card information
Major vulnerability discovered in Magento ecommerce. Apply Security Patch Immediately

The post Magento Releases Critical Security Patch to Secure Against Foreseen Security Vulnerabilities appeared first on MageShield | Secure & simple magento maintenance.

Many people asked us recently how to create wireframes or mockups for their mobile apps. That’s why we decided to write this post and to list 10 tools you might want to use to create your wireframes.

Here’s the list:

 1. Framer

Framer is a modern wireframing tool that allows you to build interactive and animated prototypes.

This tool allows you to:

• Code in their own open source prototyping framework
• Preview your work and get instant visual feedback
• Set up and use complex interactions
• Animate any object into 3D space with spring physics. Hardware accelerate for 60 FPS.

Framer is a great tool for designers looking to flesh out the interaction of an interface. The tool integrates well with Photoshop which makes it easy to export assets and begin prototyping them as objects in Javascript.

The main reason to use Frame is to create and communicate interactions. This shortens the development period and allows developers to easily understand the concept.

2. Indigo Studio

Indigo Studio allows you to create functional, animated UI prototypes all without writing a single line of code.

With this tool you can design storyboards in real-world context; quickly build application design interactions; and integrate them with your storyboards and annotate those designs.

You can then easily share your ready designs with your team members and go from idea to development faster than ever.

If you’re looking for something not as complex and easy to use at the same time, Indigo Studio would be your choice. The pricing is quite convenient considering the limited set of functionality.

3. Mockingbird

Mockingbird is an online tool that makes it easy to create, link together, preview, and share mockups of websites and applications.

The tool allows you to:

• Drag and drop UI elements on the page then rearrange and resize them to the create the best mockup
• Link multiple mockups together and preview them in order to review the flow of your application
• Share a link with others and let them edit and collaborate on the project

Mockingbird is fully web-based, which makes it easy to access your mockups from anywhere and from all devices. Files can be exported into PDFs and PNGs.

4. Simulify

Simulify is both a web and desktop-based application to build interactive prototypes, mockups and wireframes; and share them instantly with your team.

The tool allows you to:

• Design interactive prototypes, mockups and wireframes
• Drag and drop widgets and make your prototype interactive
• Share your prototypes and wireframes instantly via chat or email

This tool is created for SMEs and freelancers who can easily develop their projects and benefit from it. It is also great for beginners who are just starting out with building wireframes.

5. Solidify

Solidify lets you create clickable prototypes from sketches, wireframes, or mockups. It is one of the quickest ways to prototype interface screens for user testing feedback across devices.

The tool is great if you want to go beyond wireframing and visualize your ideas. With Solidify, you can easily create a clickable prototype and share it with others for feedback.

You can upload screens and use hotspots to link them together. You might choose to receive general feedback on individual pages or your entire prototype.

With the tool you can ask testers to complete specific tasks and track which ones managed to complete it.

6. Lovely Charts

Lovely Charts is a diagramming application that allows you to create professional looking diagrams of all kinds, such as flowcharts, sitemaps, business processes, organisation charts, wireframes, etc.

It’s a modern alternative to many of the more traditional applications that can be used for charting and diagrams.

One of its best features is the collaboration feature. This makes it possible for people to work together on the same diagram. Everything can be accessed from within the same application, which can be accessed on any computer and virtually any browser, including FireFox, Internet Explorer, and Google Chrome.

The tool has desktop, iPad and online editions and is pretty much available from anywhere.

7. ForeUI

ForeUI is an easy-to-use UI prototyping tool, designed to create mockups, wireframes, and prototypes for any application or website you have in mind.

There is no need to code. You can just use the drag and drop feature to create your wireframe or prototype.

You can easily change the style of your prototype by simply switching the UI theme. You can even design the behavior of prototypes by defining intuitive flow charts to handle specific events.

Your prototype can then be exported to wireframe images, PDF documents or HTML5 simulation.

8. Creately

Creately helps you create and collaborate on professional diagrams, flow charts, wireframes, process flows, mind maps, etc.

It currently supports more than 40 types of diagrams and comes with more than 1000 templates. That way you can easily use ready elements to speed up your process.

The tool is built for real-life collaboration and others can be added by email to contribute to the project. That way people can work together on the same document at the same time, whether you’re using the desktop or the web-based version.

You can also use Creately Desktop to work offline and keep your files safe on your computer. Changes that you make in the desktop version will be later synced with your documents in the Cloud.

9. JumpChart

JumpChart is a tool that allows you to plan and execute on websites and apps. It helps you create mockups, approve changes, send attachments, copy files, add notes to projects and design architecture.

It’s a great tool when you’re working with a big team and want everyone to be aware of what they need to do on the project. It also helps them work more efficiently.

It’s great for copywriters because they can fill the text per page basis and designers can work with real and ready content. Project managers, on other hand, can easily check and approve every change along the way.

10. Lumzy

Lumzy is a free web-based wireframing tool that includes real time collaboration and clickable prototyping.

Some of the most popular features you can use are:

• Drag and drop – simply select and place UI elements on the page
• Real time collaboration – get your team involved in the projects. Allows several people to edit and make changes at the same time
• Live chat – team members can chat and coordinate inside the platform
• Image editor – you can edit any image inside the platform.

The platform is relatively easy to use and learn.

In conclusion:

Not all tools are the same but they pretty much cover the same basics. When you’re choosing yours, think about if you want a web or desktop based version (or both). Also think about whether you want to be able to drag and drop ready UI elements or you want to write your own code (like in Framer).

Do you currently use any wireframing tools to create mockups and prototypes? Which ones? Let us know in the comments below.

The post 10 Great Wireframing Tools for Mobile appeared first on MageShield | Secure & simple magento maintenance.