Retail​​ 

The Web Applications pattern is composed of two main action varieties: the use of stolen credentials and the exploitation of vulnerable web app infrastructure. Figure 100 shows that Exploit vuln and Use of stolen creds are close competitors for first place in the Hacking varieties category and there is not a great deal to distinguish between them from a percentage point of view. In a perfect world, someone else’s data breach would not raise the risk to your own. However, that is increasingly not the case, with the adversaries amassing datastores of credentials from other people’s misfortune and trying them out against new victims.​​ 

You hold the key to my heart​​ 

Our non-incident data tells us that in this vertical (Figure 101) credential stuffing is a significant problem. While it is slightly below the most common value for all industries this year, it is not likely that people who have so many keys (credentials) will stop trying them on whatever locks they can find.​​ 

When the bad actors are not using other people’s keys against your infrastructure, they are using unpatched vulnerabilities in your web apps to gain access. Based on the vulnerability data in Figure 102, only about half of all vulnerabilities are getting patched within the first quarter after discovery. It is best not to put those patches on layaway but go ahead and handle them as soon as possible. We know from past research that those unpatched vulnerabilities tend to linger for quite a while if they aren’t patched in a timely manner—people just never get around to addressing them. Our analysis found that SQL, PHP and local file injection are the most common attacks that are attempted in this industry (Figure 103).​​ 

Data types​​ 

If we were to create a ranking of the most easily monetizable data types, surely Payment card data would be at the top. After all, who doesn’t have the urge to try out that brand new credit card and “break it in” when it first arrives? Figure 104 shows us that the attackers feel the same way, and likely want to build upon their sweet gaming rig with someone else’s money. However, Personal data is tied with Payment data as the reigning champion. It’s easy to forget that as web apps increasingly become the target of choice, the victims’ Personal data is sometimes boxed up and shipped off right along with the Payment data as a lagniappe.​​ 

Figure 105 lists the top terms in hacking data from criminal forum and marketplace posts. It stands to reason that they would (like any good SEO effort) tailor their terms to what is most in demand. Clearly banking and payment card data is high on everybody’s wish list, although those who are doing this type of trade do not need to go to the lengths of finding a dusty lamp to have those wishes granted.​​