PrestaShop Security: How to Fight Against Module Vulnerabilities?
For several months now, reports of cyberattacks have been multiplying. In the world of e-commerce, as elsewhere.
Based on this observation, drawing on our dual expertise in hosting (7724) and PrestaShop maintenance (Profileo), our teams decided to select a test group of clients and thoroughly audit the logs and code of the modules installed on their PrestaShop stores.
Our objective: improve our e-commerce site security solutions. To do this, we drew inspiration from the methods used by cybercriminals in order to search for security flaws still unknown to date.
On the first site audited, more than 160 modules were scrutinized. The result of the test? 12 new critical vulnerabilities revealed. Repeating this same operation for another client, we again found unknown vulnerabilities.
Of course, each of these vulnerabilities was reported to the publishers of the modules concerned. And our affected clients were immediately informed of the fix to apply.
It’s clear that PrestaShop sites – like those built with other solutions – are no longer safe from attacks today. This is due to the large ecosystem of modules and the variety of attack methods, among other things. Current knowledge of vulnerable modules seems incomplete, if not underestimated. And this is exactly what makes security a major issue for e-merchants – an issue that all players in the digital ecosystem never stop highlighting.
In this article, we take stock of the risks, the trends and, above all, the solutions to put in place to secure your e-commerce business.
|
Summary: Cyberattacks, a growing threat to online stores |
Cyberattacks, a growing threat to online stores
For several years now, and especially since the COVID-19 pandemic, the number of cyberattacks has been steadily increasing. This finding is noted by all players in the industry (let’s cite for example Fevad) and we confirm it at our own level as well. Indeed, more and more merchants are turning to Profileo’s services to fix issues following an infection on their site.
A study conducted by Splunk in 2022 on an international scale thus reveals that 65% of companies are facing a rise in cyberattacks. Their response is immediate, since 93% of them decided to increase their security budget. This awareness is positive and essential for dealing with the risks of cybercrime. Especially since, until now, small and medium-sized businesses often waited to become victims of a cyberattack to realize just how catastrophic the damage could be for their business…
As for what motivates cybercriminals, the answer is simple. It’s about the lure of profit. The more well-known an ecosystem is, the more it attracts cybercriminals. And what better than a widely used solution like PrestaShop? The volume of data to retrieve, steal and exploit is such that it becomes extremely attractive. Especially since, among the large number of existing modules and systems, those that are not always kept up to date by merchants play right into the hands of hackers looking for vulnerabilities to exploit…
Hackers vs. E-commerce Sites: A Race Against Time
In this game of cat and mouse, cybercriminals always try to stay one step ahead.
Attacks are often opportunistic. Malicious actors don’t necessarily need to carry out sophisticated attacks (and indeed, they often lack the skills to do so). All it takes is a single black hat (editor’s note: the name given to malicious hackers, often organized in criminal networks) to discover and share – or even resell, as is sometimes the case on the dark web – a vulnerability for it to be immediately exploited.
Once the vulnerability has been shared, cybercriminals engage in a race against time. Their goal: to update their detection tools as quickly as possible to scan the Web in search of vulnerable sites. And this, before module developers and publishers have time to widely distribute their fix. Among the thousands of sites scanned automatically, there will inevitably be a few unlucky ones that haven’t yet had time to fix the vulnerability and will then fall victim to this attack.
The stages of the infection are then generally always the same:
- Exploit the vulnerability by injecting “backdoors” to gain full control of the store.
- Extend the attack by infecting several other files and multiplying the entry points.
At the end of these steps, the cybercriminal has access to the site, without the merchant being alerted. The infected code often remains hidden and unused, in order to make the attack harder to analyze and slow down its detection. Then, it’s usually only after a few weeks that the hackers spring into action to finalize their attacks. Most often, the goal is to divert payment methods. Customers’ card numbers as well as their names, first names, emails, phone numbers…, are valuable data that hackers can monetize.
At this point in the attack, the merchant is forced to suspend their business while they disinfect their store. Beyond the financial losses and legal risks they are exposed to (the obligation to inform users of the attack in accordance with the GDPR) with a definite impact on their reputation, there is also the risk that malicious code remains hidden in an unsuspected location.
Simple steps to reduce cyber risks
If we had only one piece of advice to give you: update your modules!
As mentioned above, an outdated module can be an ideal entry point for hackers. Also get rid of those you no longer use: simply deactivating or uninstalling them doesn’t fully protect you… Make sure there are no traces of the module left by removing it from the server.
Essential precaution to take when updating your modules: run tests in a staging environment and back up your site beforehand, to make sure the updates won’t affect the operation of your site or other modules.
Updating your modules – as important as it is – must absolutely be complemented by a few best practices.
Best practice #1: choose a dedicated PrestaShop hosting service
It’s crucial to use a hosting provider specialized in your solution. In this case, a hosting provider that is an expert in PrestaShop. In this respect, managed services, monitoring, and dedicated system optimizations are essential selection criteria to ensure optimal security. A more comprehensive article on this topic is available here: Choosing the best hosting for your PrestaShop e-commerce site.
Did you know? The Profileo team works daily with the hosting service 7724. This close collaboration makes it possible to respond more quickly to alerts and fix new vulnerabilities detected on hosting environments. At the same time, 7724‘s monitoring probe systems make it possible to intervene proactively, as part of a risk-prevention approach.
Best practice #2: set up an alert and module-verification system
In addition to your hosting provider, entrust your PrestaShop developer or web agency with the management and maintenance of installed modules on your PrestaShop. Reach out to your technical contact to ask for a review of the modules present on your store and to list those to be removed.
Furthermore, a module scan – whether they are configured or simply installed on your store – proves to be an essential action when it comes to searching for potential flaws. A check to be carried out regularly!
Are you a Profileo client? We offer you the PrestaShop Security Pack, specially designed to check the integrity of modules and clean up any infected files. Once this initial check has been carried out, a module scan can be performed, once a quarter and/or occasionally, depending on the discovery of new vulnerabilities. Contact us for more information.
Best practice #3: keep your PrestaShop version up to date
An outdated version exposes you to potential flaws that are known and fixed in an updated version. If you don’t have the ability to update your PrestaShop version frequently and quickly, it will then be necessary to urgently apply temporary fixes. The goal: to mitigate threats.
Best practice #4: protect access to your back office and secure your passwords
This best practice may seem obvious, but we think it’s essential to mention. The first thing to do is to avoid predictable back-office links, such as yoursite.com/admin/ or /backoffice/. This will considerably reduce the risk of certain types of attacks.
Furthermore, it’s essential to act with the utmost caution when granting a third party access to your back office. Never share your own access; create an additional access for each person involved, ideally someone you trust. Then remove permissions once they are no longer needed.
Of course, you should never use the same password for all your online tools and services. And also encourage your employees to change their passwords regularly.
Best practice #5: favor trusted module publishers
Ideally, choose your modules from the Addons platform – dedicated to modules developed by publishers or agencies approved by PrestaShop. This guarantees, at the very least, a module kept up to date by its publisher and actively monitored by the PrestaShop community.
Also remember to always check the reputation of the module’s developer. To do this, there is an expertise scale that evolves based on the age of the account, the quality of its products, and the support provided to merchants.
Be careful, however: vulnerabilities are increasingly being sought out by hackers, including in well-known modules available on Addons. It therefore remains essential, regardless of where your modules come from, to stay vigilant and apply these security guidelines:
- Precaution: choose a module with a recent latest version, or, failing that, a high number of downloads (if a module is 4 years old with no updates and few downloads, that’s a sign of potential weakness);
- Prevention: regularly review your modules. Do an initial sort and then completely remove those that are no longer used and those that are outdated.
- Vigilance: set up monitoring systems to anticipate the presence of a vulnerability as much as possible.
Module publishers and developers: what responsibility do they have?We already discussed this topic in a previous article dedicated to resolving module security vulnerabilities. It’s important to keep in mind that no module is immune to vulnerabilities. When a publisher (or developer) is informed of a flaw in their module, they act quickly to release a new, fixed version. Unfortunately, there is currently no alert system on module purchasing platforms to notify you in the event of a security alert. For this reason, it’s important to make an effort to keep these modules up to date. For lesser-known modules that are updated less often, their stability is also the publisher’s responsibility. Unfortunately, the publisher (or developer) doesn’t always follow through. In that case, it’s best to avoid keeping modules that seem outdated and look for more recent alternatives. |
In addition to these best practices dedicated to your e-commerce business, we invite you to check out the ANSSI website (French National Cybersecurity Agency). Its mission is to promote the implementation of security best practices among French and European companies.
As you can see, the security of your site is a key issue for ensuring the long-term success of your e-commerce business.
Not sure about your store? Want to make sure your modules are up to date?
Our team of PrestaShop developers audits your site, carries out fixes if a flaw is detected, and takes the essential preventive actions to guard against future vulnerabilities. Choose the PrestaShop Security Pack or contact us directly for more information.