Latest / Tech Talks With Kinsoft / BigCommerce - One Stolen App Key, Hundreds of Stores, and the Plugin You Forgot You Installed

Transcript

BigCommerce - One Stolen App Key, Hundreds of Stores, and the Plugin You Forgot You Installed · Tech Talks With Kinsoft

• 0:00
  Welcome to the Deep Dive. You know, today we
• 0:02
  have a really fascinating and honestly a pretty
• 0:05
  terrifying reality of online shopping to explore
• 0:08
  with you. Yeah, terrifying is definitely the
• 0:11
  right word for this one. Right. Because we're
• 0:13
  looking at how a single stolen digital key from
• 0:16
  like this completely obscure third -party app
• 0:18
  ended up compromising hundreds of online stores.
• 0:22
  Hundreds. Hundreds. And it really changes how
• 0:26
  you look at the websites you buy from every day.
• 0:28
  Totally. So our core mission today is to break
• 0:31
  down this massive supply chain cyber attack.
• 0:34
  We are pulling all our info from a really detailed
• 0:37
  tech talk that Kinsoft gave recently back on
• 0:39
  October 2nd, 2026. Yeah, the Kinsoft breakdown
• 0:43
  was incredibly thorough. They really laid bare
• 0:46
  how these attacks actually happen in the wild.
• 0:49
  Okay, let's unpack this. Think of this situation
• 0:52
  like installing a state -of -the -art bank vault
• 0:55
  security system on your house, but then giving
• 0:57
  a master key to the guy who waters your plants
• 0:59
  once a year. Oh, that is a perfect way to look
• 1:02
  at it. Right. And then when his pocket gets picked,
• 1:04
  your vault is suddenly, you know, wide open.
• 1:07
  Exactly. I mean, we so often think of cyber attacks
• 1:09
  as these brute force hacks against giant tech
• 1:13
  companies, right? Like hackers hammering down
• 1:16
  the front door of some massive corporation. Like
• 1:19
  in the movies. Yeah. Exactly, like the movies.
• 1:21
  But the reality is just much stealthier. It relies
• 1:25
  entirely on these trusted vendors that we, frankly,
• 1:28
  forget we even hired. Which brings us to the
• 1:30
  scene of the crime. To really understand how
• 1:32
  this happened, we first have to grasp just the
• 1:35
  massive scale of the platform that was targeted.
• 1:38
  Right, because scale is everything here. Yeah,
• 1:40
  and the specific side door that the hackers actually
• 1:43
  used. So the platform at the center of this is
• 1:46
  BigCommerce. BigCommerce, yeah. And for those
• 1:48
  who don't know, it's a massive SaaS e -commerce
• 1:51
  platform. We are talking tens of thousands of
• 1:54
  businesses across, I think, 150 countries. Yeah,
• 1:57
  it's huge. Started in Sydney back in 2009, and
• 2:00
  now it's U .S. headquartered under the NASDAQ
• 2:03
  -listed Commerce .com. It's an absolute giant.
• 2:05
  Right. So it's not some rinky -dink operation.
• 2:08
  It's enterprise -grade. But the thing about BigCommerce
• 2:11
  is its ecosystem. It has over 1 ,200 third -party
• 2:14
  apps that merchants use for, you know, reviews,
• 2:17
  shipping, pop -ups. Because the main platform
• 2:19
  can't do absolutely everything for everyone.
• 2:22
  They have to allow these plugins. Exactly. And
• 2:24
  that leads us to the specific vulnerable apps
• 2:26
  in this Kinsoft report. They were called Ribbon
• 2:28
  and Ribbon 1 .5. Right. Ribbon. Yeah. They're
• 2:31
  these storefront optimization tools run by a
• 2:34
  company called Be A Part Of, which is a faster
• 2:37
  company. And this is where the mechanism of the
• 2:39
  attack gets really interesting. Because the attackers
• 2:42
  didn't breach the stores themselves. No. And
• 2:45
  they didn't breach BigCommerce either. Right.
• 2:47
  Wait. So the main platform was completely secure.
• 2:50
  Completely secure. The attacker has essentially
• 2:53
  just found an authorized VIP pass lying on a
• 2:55
  third party's driveway and walked right through
• 2:57
  the front door? Well, what's fascinating here
• 2:59
  is how the architecture of the modern web basically
• 3:01
  requires this exact vulnerability to exist. Wait,
• 3:05
  requires it? Yeah, I mean, these apps like Ribbon,
• 3:08
  they absolutely must have access to store data
• 3:11
  to function. You can't optimize a storefront
• 3:13
  if you can't see the customers or the inventory.
• 3:15
  Right. OK. Yeah, that makes sense. But that required
• 3:18
  access transforms every single minor developer,
• 3:22
  every small widget maker into a high value target
• 3:24
  for hackers. They stole an API credential, a
• 3:27
  key directly from the app developer. And that
• 3:30
  key let the app talk to the store on the merchant's
• 3:33
  behalf. Wow. So they just bypassed the giant
• 3:36
  vault doors completely. Entirely bypassed. OK.
• 3:39
  So now that we know how they got the keys, let's
• 3:42
  look at the timeline. because the Kinsoft talk
• 3:44
  laid out exactly how long they roamed the halls
• 3:47
  completely undetected. And this is the part that
• 3:50
  really shocks people. It's wild. They used a
• 3:53
  UK retailer, Master of Malt, as the main case
• 3:55
  study here. So Sunday, September 13th, at exactly
• 3:59
  5 .21 p .m. UK time, that is when the unauthorized
• 4:03
  use of the ribbon key begins. Sunday evening.
• 4:06
  Classic time to launch an attack because security
• 4:08
  teams are often understaffed or, you know, just
• 4:10
  offline for the weekend. Right. They're at home
• 4:12
  watching TV. So the hackers are in. But the ribbon
• 4:16
  developers, the guys who actually own the key,
• 4:18
  they don't even notice the misuse until Wednesday,
• 4:21
  September 16th. Three full days later. Yeah.
• 4:25
  And then it takes until Thursday, September 17th
• 4:28
  for BigCommerce to officially confirm the compromise,
• 4:31
  uninstall the apps and revoke the key. So from
• 4:33
  Sunday to Thursday, the attackers just had free
• 4:36
  reign. Free reign. By September 18th, BigCommerce
• 4:39
  notifies the merchants. Master of Malt immediately
• 4:41
  emails their customers. September 19th, the UK
• 4:45
  Information Commissioner's Office opens a case.
• 4:47
  And by the 21st, you know, the tech press, bleeping
• 4:50
  computer, security week, they're all over it.
• 4:53
  But during those four days, the damage was already
• 4:55
  done. Yeah, let's talk about the damage because
• 4:57
  they didn't just look around. The hackers used
• 4:59
  that VIP key to inject malicious scripts, right?
• 5:03
  Yes, exactly. And they started pulling customer
• 5:05
  records essentially page by page. Right. They
• 5:08
  automated it. And they got names, emails, phone
• 5:11
  numbers, shipping addresses. I mean, pretty much
• 5:13
  everything except, thankfully, passwords and
• 5:16
  payment cards. Yeah, that's a crucial point.
• 5:18
  The passwords and payment info are stored in
• 5:20
  a separate, completely uncompromised system.
• 5:23
  So the hackers couldn't touch that. Okay, but
• 5:25
  still, four entire days feels like an eternity
• 5:28
  in digital time. I mean, if someone was manually
• 5:30
  pulling files from a physical filing cabinet
• 5:32
  for four days straight, someone would tackle
• 5:35
  them. You'd hope so, yeah. Why is this so invisible
• 5:38
  in the digital space? Well, it comes down to
• 5:41
  how API calls work. Automated API calls can very
• 5:45
  easily mimic legitimate app behavior. How so?
• 5:48
  So an e -commerce platform processes billions
• 5:51
  of requests a day, right? It's just a constant
• 5:54
  stream of background noise on the internet. Right,
• 5:56
  just massive traffic. Yeah. So when the attackers
• 5:59
  use an authorized key to ask for data, the system
• 6:02
  just says, oh, it's ribbon asking for data, like
• 6:05
  always. The extraction was paginated. They just
• 6:09
  blended right into that background noise, which
• 6:12
  makes bulk data extraction incredibly hard to
• 6:15
  spot until it's just way too late. That is deeply
• 6:19
  unsettling. And there are still so many unknowns,
• 6:22
  right? Like the Kinsoff talk pointed out, we
• 6:25
  don't even have a total victim count. No, we
• 6:27
  don't. We don't know exactly how Faster was compromised
• 6:30
  in the first place or what all the injected scripts
• 6:33
  actually did. Or who's even responsible. And,
• 6:37
  you know, Faster hasn't really commented on the
• 6:39
  specifics yet. Right. So this Master of Malt
• 6:43
  timeline is terrifying, but it's really just
• 6:45
  one symptom of a much wider disease. We need
• 6:48
  to zoom out. Absolutely. This isn't just a big
• 6:51
  commerce problem. No, exactly. This affects the
• 6:54
  entire internet economy. This same vulnerability
• 6:56
  applies universally to any hosted platform. Shopify,
• 7:00
  WooCommerce, Wix, Squarespace, they all use these
• 7:03
  third -party apps. Yeah, they all rely on that
• 7:05
  exact same plug -in architecture. And there's
• 7:08
  precedent for this. The Kinsoft talk highlighted
• 7:10
  that this happened back in 2024 with a totally
• 7:13
  different big commerce app that targeted Zag
• 7:15
  customers for payment skimming. Yep. The methodology
• 7:18
  is already out there and proven to work. And
• 7:20
  this brings up a huge legal reality, which is
• 7:22
  just brutal for the merchants. For example, looking
• 7:25
  at the Australian Notifiable Data Breaches Scheme
• 7:28
  under the Privacy Act. This part is so frustrating
• 7:31
  for business owners. It is. Because if you are
• 7:33
  a merchant, the fact that a third -party app
• 7:35
  caused the breach literally does not matter.
• 7:38
  It is your obligation to assess the damage and
• 7:40
  notify your customers. You hold the relationship
• 7:42
  with the customer, so you hold the liability.
• 7:45
  So what does this all mean? I mean, it places
• 7:48
  just a monstrously heavy burden on small business
• 7:51
  owners. You pay for a massive platform like BigCommerce
• 7:54
  or Shopify specifically so you don't have to
• 7:57
  be a cybersecurity expert, right? Right. You're
• 7:59
  outsourcing your security. Yeah. But then you
• 8:02
  are still legally left holding the bag when some
• 8:04
  random third -party plug -in fails. If we connect
• 8:07
  this to the bigger picture, it really highlights
• 8:10
  the ultimate paradox of software as a service.
• 8:13
  The paradox. Yeah. You buy into these platforms
• 8:17
  for the security and the ease of use. But the
• 8:21
  very minute you start customizing it with plugins
• 8:23
  and widgets to make it work for your specific
• 8:26
  business. Which you have to do. Which you have
• 8:28
  to do. You actively dilute that security. You
• 8:31
  are handing out copies of your house keys to
• 8:34
  every contractor who walks by. Man, that is bleak.
• 8:38
  Okay, so knowing this terrifying ecosystem exists,
• 8:40
  how can a merchant possibly defend themselves?
• 8:43
  And, you know, what should consumers do if they
• 8:45
  get caught in the crossfire? Well, the Kinsoft
• 8:47
  source actually laid out a pretty solid defense
• 8:50
  playbook for the future. Four actionable steps
• 8:53
  for merchants. Okay, let's go through them. What's
• 8:55
  step one? Step one is to relentlessly audit your
• 8:58
  installed apps. If you aren't using an app anymore,
• 9:01
  delete it immediately. That removes the unused
• 9:04
  digital keys from circulation. Makes sense. Don't
• 9:07
  leave spare keys under the mat if you don't need
• 9:09
  them. What's step two? Step two is enforcing
• 9:11
  least privilege. When you install an app, you
• 9:14
  need to give it the absolute minimum permissions
• 9:16
  required to do its job. Here's where it gets
• 9:19
  really interesting because I love this analogy.
• 9:21
  It's exactly like downloading a simple flashlight
• 9:24
  app on your phone and it suddenly asks for access
• 9:26
  to your GPS location and your photo gallery.
• 9:29
  Exactly. Why does a flashlight need your photos?
• 9:31
  It doesn't. Right. And we need to start saying
• 9:34
  no to greedy e -commerce apps the exact same
• 9:36
  way. If a pop -up widget wants access to my entire
• 9:39
  customer database, that's a red flag. Huge red
• 9:42
  flag. But a lot of merchants just click accept
• 9:44
  all to get the install over with. Yeah, guilty
• 9:47
  as charged sometimes. Okay, step three. Step
• 9:49
  three is you have to actively watch for bulk
• 9:52
  access. Don't rely on the vendor to tell you
• 9:54
  something is wrong. Merchants need to check their
• 9:56
  platform logs for apps that are suddenly, you
• 9:59
  know, reading thousands of records out of nowhere.
• 10:01
  Looking for that spike in the background noise.
• 10:03
  Precisely. And the final step, step four, is
• 10:06
  asking your vendors awkward questions in writing.
• 10:10
  Awkward questions. Like what? Ask them straight
• 10:13
  up how they store their API credentials. Ask
• 10:16
  them what their guaranteed timeline is for breach
• 10:18
  notification. If they can't answer, maybe don't
• 10:21
  use their app. That's really good advice. Get
• 10:24
  it in writing. But what about the consumers,
• 10:26
  the people whose data was actually stolen in
• 10:28
  this ribbon breach? For consumers, it's all about
• 10:31
  hypervigilance regarding phishing. The attackers
• 10:34
  have your name, your phone number, and your physical
• 10:37
  shipping address. But not the credit card. Not
• 10:40
  the credit card. But they can use that physical
• 10:43
  address data to send highly convincing targeted
• 10:46
  phishing messages, like a text saying, hey, your
• 10:49
  package to 123 Main Street has been delayed.
• 10:52
  Click here to pay a $1 redelivery fee. Oh, wow.
• 10:56
  And because it has my real address, I'd probably
• 10:59
  click it. Exactly. They use the stolen data to
• 11:02
  build trust, and then they steal your credit
• 11:05
  card on the fake landing page. That is so sneaky.
• 11:08
  But I will say that Kinsoft Talk did have some
• 11:11
  praise in all this darkness. They highlighted
• 11:13
  Master of Malt as essentially the gold standard
• 11:16
  for how to respond to something like this. Yeah,
• 11:18
  Master of Malt handled it beautifully. They notified
• 11:21
  their customers the exact same day they found
• 11:23
  out, right? Same day. They reported it to the
• 11:25
  regulator immediately, and they published incredibly
• 11:28
  detailed technical follow -ups so other companies
• 11:31
  could learn from it. That level of transparency
• 11:33
  is rare. It is. And this raises an important
• 11:36
  question about how we view security. Because
• 11:39
  Master of Malt wasn't careless. They didn't do
• 11:41
  anything wrong. They were just a victim of modern
• 11:44
  web architecture. Right. They just used a tool
• 11:47
  that everyone uses. Exactly. So the ultimate
• 11:49
  lesson here is that perfect prevention is basically
• 11:52
  impossible now. You can't perfectly secure a
• 11:55
  system that relies on 100 external vendors. You
• 11:58
  just can't. No. So making sure you have perfect
• 12:02
  response and absolute transparency like Master
• 12:05
  of Malt did, that is really the only true defense
• 12:08
  we have left. Wow. Okay. So for you listening,
• 12:11
  I think the big takeaway here is that the next
• 12:13
  time you click install on some quick, easy widget
• 12:16
  for your online business, or honestly, even if
• 12:19
  you just buy a bottle of spirits from an indie
• 12:20
  retailer online, there is a massive, totally
• 12:23
  invisible web of third -party vendors holding
• 12:26
  your data. A massive web. Security truly is only
• 12:29
  as strong as the weakest link in that chain.
• 12:31
  It really makes you wonder about where this is
• 12:33
  all heading. I mean, if our entire digital economy
• 12:36
  relies on thousands of small, potentially vulnerable
• 12:40
  plugins having these master keys to massive platforms,
• 12:44
  are we inevitably moving toward a future where
• 12:47
  major platforms just ban third -party developers
• 12:50
  entirely? Oh, wow. Just shut them out. Yeah,
• 12:53
  like effectively destroying the open plug -in
• 12:56
  culture we currently rely on just to build these
• 12:58
  secure monolithic walled gardens where data never
• 13:02
  leaves the main platform. Because at a certain
• 13:05
  point, the liability might just be too high.
• 13:07
  That is a wild thought to end on. It would completely
• 13:11
  change the Internet. Well, definitely something
• 13:13
  to chew on. Thanks for joining us on this deep
• 13:16
  dive. Stay vigilant out there and we will catch
• 13:18
  you next time.