1

First of all, this is my first question so excuse me if I'm a bit clunky. I'm currently using magento 1.8.0.0. On our production site, today we received 3 unathorized messages on our admin notification inbox. The content of the messages are not relevant, it's just gibberish. They aren't being pulled from any RSS feed i'm subscribed to. Someone is using this functionality to spam my site. What troubles me is the possibility that someone found a security hole and is trying to gain access to the server and/or database.

I'm no security expert and I don't really know how to approach the situation. First thing I did was a complete backup of the database and file system. Then I've checked the system and exception logs, but haven't found anything relevant.

Any ideas?

Improve this question
5
  • you can disable admin notifications frm System>Configuration>Advanced>Disable module output ,Mage_AdminhtmlNotifications
    – huzefam
    Jul 1, 2014 at 15:43
  • Sorry I guess I didn't explain myself very well. Disabling the comments won't solve anything, the problem is: how did those messages arrive there in the first place? Those messages aren't real, as I said earlier they are gibberish, random text.
    – Tidesson
    Jul 2, 2014 at 7:58
  • this is a module in magento, once u disable it will not listen for any messages.
    – huzefam
    Jul 2, 2014 at 8:14
  • I know it can be disabled, but why would I want to do that? That doesn't fix nor explain this ocurrence. I'm asking for help to identify the issue, not how to ignore it.
    – Tidesson
    Jul 2, 2014 at 13:18
  • What kind of gibberish? Can you give an example of the content? Perhaps it's an encoding problem.
    – xyphoid
    Oct 2, 2014 at 3:29

2 Answers 2

Reset to default
1

Notifications can cause alarm from time to time. Plugins often include this functionality to tell you about new functionality, or upgrades etc. You should be able to view them at System | Notifications. The "read details" link should hopefully show you more information.

Improve this answer
3
  • There is no "read details", as I said the comments are gibberish. They are not being pulled from any RSS feed, not from the official feed at notifications.magentocommerce.com/community/notifications.rss or any other. I already checked the installed plugins and they are not pulling messages either. Someone, somehow, is spamming my site through the admin notification messages functionality and I got no clue how.
    – Tidesson
    Jul 2, 2014 at 8:03
  • As you suggest, there are no logs that track what is adding data into the database table. Created isn't even a timestamp unfortunately. If you can isolate a time/date that the message appeared, you could check the access logs?
    – Douglas Radburn
    Jul 2, 2014 at 12:27
  • The "date added" field which appears in the adminnotification_inbox table for all the records that are being inserted doesn't match the time of the insertion - it's being set by the offender manually and it's the same date in all cases. My attempts at checking the access logs also failed.
    – Tidesson
    Jul 2, 2014 at 13:36
0

Look for strings Mage::getModel('adminnotification/inbox') or adminnotification_inbox in app/code/community and app/code/local

It will help you locate third party extension which are creating these notifications.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.