Newegg customers may have had their credit card information stolen

[Brink]

There's no shortage of stories about the many ways companies can accidentally leave their customers' private data exposed on the internet, and that can be a scary thought. But it can be even worse than that when third-party entities go out of their way to infiltrate the websites of such companies to actually steal sensitive information, which has apparently happened to online retailer Newegg over the past month.

A report by security researchers from RiskIQ, who worked together with cybersecurity firm Volexity, says that a hacking group known as Magecart recently targeted the company's customers with a cleverly designed attack. The group registered the neweggstats.com domain, which looks fairly legitimate at first sight, especially being that the domain had a certificate issued by COMODO. The attackers then set the domain up to skim the credit card information of customers and placed the skimmer on the payment page of the checkout process, which affected both mobile and desktop devices...

Read more: Newegg customers may have had their credit card information stolen - Neowin

 

[Lady Fitzgerald]

I made a purchase during that time but I paid with PayPal so I should be safe. Still, being the coward I am, I've changed my passwords for PayPal and Newegg.

 

[ian50]

> "A report by security researchers from RiskIQ, who worked together with cybersecurity firm Volexity, says that a hacking group known as Magecart recently targeted the company's customers ..."


When is "recently", please ? Anyone know the exact date period ?


The linked report does not specify this either, yet it's critical to make a decision on safety.

 

[Lady Fitzgerald]

> "a report by security researchers from riskiq, who worked together with cybersecurity firm volexity, says that a hacking group known as magecart recently targeted the company's customers ..."


when is "recently", please ? Anyone know the exact date period ?


The linked report does not specify this either, yet it's critical to make a decision on safety.

08/14/2018 - 09/18/2018

 

[ian50]

Thank you Lady F.


My only interaction (so far) was 6 months ago, so based on your very helpful reply, I see no need to organise a new credit card.

 

[townsbg]

If I'm reading this right the skimming part was actually the fake site. Can anyone confirm? Regardless I haven't bought anything from Newegg in 7 years and my credit card isn't on file. Plus I just logged in and enabled 2 factor authentication.

 

[file3456]

+1 for PayPal. I also 2FA the account. Better than nothing.

Too bad eBay will use a new escrow some time in the near future. And worst of all it's based in Denmark or some damn place near there.

 

[spc3rd]

FWIW, I've made several attempts to sign-in to my account on the Newegg site, but their "Captcha" does not seem to be working properly. After clicking the box beside, "I am not a robot"...the small icon just sits there spinning around for about 6 seconds, stops, but no images are displayed). So, there's no way to log-in.
(Last purchase was made about 5 months ago).

 

[Lady Fitzgerald]

FWIW, I've made several attempts to sign-in to my account on the Newegg site, but their "Captcha" does not seem to be working properly. After clicking the box beside, "I am not a robot"...the small icon just sits there spinning around for about 6 seconds, stops, but no images are displayed). So, there's no way to log-in.
(Last purchase was made about 5 months ago).

Curious. I've never encountered a CAPTCHA on Newegg (darned good thing, too, since I detest those abominations!) and I've logged into there two or three times since the hack was announced, including to change account password).

 

[spc3rd]

Much obliged for the info, Jeannie.

I just re-tried logging-in to my Newegg account, and this time had no problem as there was no "Captcha" shown like before. Guess there was some sort of website glitch that got corrected since my previous post.

Cheers!

 

[Brds7t7]

I phone up my banks once a year and tell them I've either lost or damaged my cards - so I get issued a new number regularly. I've never actually lost or damaged one though, but my banks must think I'm the clumsiest pillock on the planet! :roflmao:

A little over excessive perhaps, but I don't like to keep the same card numbers for too long.

 

[Lady Fitzgerald]

I've never received an email from Newegg about this so I'm taking that, an something else I read somewhere, as a sign that people who used PayPal to pay for purchases are safe (I had changed my passwords anyway still feel it's a good idea to do so, just in case). I had an email from PayPal a short while back about checking or updating my security but I get those every so often anyway.

 

[Lady Fitzgerald]

I phone up my banks once a year and tell them I've either lost or damaged my cards - so I get issued a new number regularly. I've never actually lost or damaged one though, but my banks must think I'm the clumsiest pillock on the planet! :roflmao:

A little over excessive perhaps, but I don't like to keep the same card numbers for too long.

Nothing wrong with being extra cautious. I use a separate account and card for my internet transactions and pnly put in only enough to cover purchases plus maintaining a small "cushion". That minimizes how much a hacker can ever get from me.

 

[Brds7t7]

I've never received an email from Newegg about this so I'm taking that, an something else I read somewhere, as a sign that people who used PayPal to pay for purchases are safe (I had changed my passwords anyway still feel it's a good idea to do so, just in case). I had an email from PayPal a short while back about checking or updating my security but I get those every so often anyway.

Your PayPal should be fine LF. I bought a phone from Oneplus last year and paid with PP.
They were hacked around the time I bought it. I was told that people had fraudulent activity on their cards, but PayPal wasn't affected in any way.

Not 100% sure how it works, but I don't think the payment/bank details are actually stored on the vendors website, only on PayPal.

 

[Lady Fitzgerald]

Your PayPal should be fine LF. I bought a phone from Oneplus last year and paid with PP.
They were hacked around the time I bought it. I was told that people had fraudulent activity on their cards, but PayPal wasn't affected in any way.

Not 100% sure how it works, but I don't think the payment/bank details are actually stored on the vendors website, only on PayPal.

I know my PayPal is fine. I'm just extra cautious, just like you.

 

[dg1261]

I got an email two days ago. Supposedly, they are "alerting those accounts at risk", so if you didn't get an email that should mean your account isn't at risk.

More info is supposedly due "by Friday", but it's now Friday afternoon and I haven't received a follow-up email yet.

I made a recent purchase, but I'm not worried because newegg doesn't have any actual credit card info on me. I always use Paypal or a virtual credit card for anything online. I never use any of my real credit card numbers anywhere online (except the credit card provider's own site).

In the recent transaction I happened to use a Citibank VCC, so perhaps if I had used Paypal my account wouldn't have been flagged "at risk"?

With a VCC the merchant does not get my real credit card number and the virtual number cannot be used with any other vendor, so the risk of fraudulent use is almost zero. Even so, it was an easy matter to login to Citibank and close that particular virtual number so it cannot be used again.

 

[townsbg]

I never got a warning email from Newegg. They may not have gotten to my about it either that or my account isn't at risk. The paypal update thing was them restricting the website to 7 systems or higher and assuming that everyone needed to upgrade. It was pushing 10 though. I've never gotten a captche when logging into Newegg. It despises me to have to do one of those to sign in. I can understand using that for registration.

 

[file3456]

I, too had the Recaptcha, but I was using Pale Moon my browser of choice, and even though I forge my useragent and have an add-on that suppose to correct the UA via JS as well, NewEgg presented me with the Recaptcha. I was able to solve it, but when I clicked on my account all I saw was my name in a white screen in the upper left. Pissed off I downloaded Firefox portable and signed into NewEgg again. This time no Recaptcha and I was able to see my account.


So with that, a Recaptcha could be triggered by either your browser or IP address. Especially if you're using a VPN or your IP that you now have was used prior by some bot or spammer, etc. It can happen. Best course of action would be to either try another browser and/or reset the modem/router and see if that give you another IP. If that doesn't work the MAC address clone feature will. I know that works with Comcast, not sure about other ISPs or even DSL. A simple modem power cycle might just do it though. But it's not guaranteed. Go here and note your before and after IP. What Is My IP Address - Everything You Need to Know

Edit-

Other factors that could trigger a Recaptcha might be their WAF (Web Application Firewall) like your add-ons and what not and how they interact with web requests.

 

[file3456]

Not 100% sure how it works, but I don't think the payment/bank details are actually stored on the vendors website, only on PayPal.

PayPal is just an escrow, a middle man so to speak. The merchant doesn't have your bank Info., etc on file. The merchant uses PayPal's API to conduct the transaction and PayPal takes over from there sending the payment to the merchant's account on file. So that's why it's great to use. Not saying PayPal themselves can't get hacked though. I'm sure one day it will happen. As it stands now you constantly here about massive databases being breached all the time. I can only hope PayPal encrypts the data they have on you.

Forums like this one more than likely use what is called a Bcrypt hash and in the future will most likely use Argon2. That hash is made so that it takes a hell of a long time to crack the hash. In fact, at DEFCON they tried cracking a bunch of Bcrypt hashes and only a few of them were successfully cracked. But depending on how complex your password is, it's still a good idea to change it. For me it won't matter. It's well above 15 characters comprising of upper, lower case letters, numbers and symbols. No way that's getting cracked. Even with four Titan GPUs. I can guarantee it. LOL

One thing I'd like to stress is that if you ever conduct a PayPal transaction from a computer forum where you buy a GPU or something from somebody, that you do use the pay for goods option I think it's called. Even though you have to pay a fee, you have protection in case the seller rips you off. And PayPal gives you a virtual six month warranty which many eBayers complained about. Especially those who deal with antiques. And here I thought 45 days prior was excessive.

 

[file3456]

Something that might scare you. I've signed up for their email alerts. Have I Been Pwned: Check if your email has been compromised in a data breach

That is a safe website to use. I've read about it on countless websites and such and I think Firefox was working with them. I think it was Firefox. If I could only remember half the crap I read I'd be a genius. LOL