4

Among the six installations I have access to there's one that was apparently compromised by Shoplift. This is the only one that has a standard /admin backend url.

After patching all of them and reading many resources I guess that a site isn't vulnerable to Shoplift if the attacker doesn't know the admin URL - which corresponds just fine to the observation.

Still not fully convinced - especially after reading the full story by CheckPoint -, though, so: is it?

The - at least at first sight - uncompromised sites are on shared hosting without shell access so any deeper investigation will be pretty expensive. Hence knowing that the attack has no impact without knowledge of the admin URL would be a huge life(/time) saver.

PS: $this->question is ! about (security by obscurity || the possibility of brute forcing the admin URL).

Improve this question

3 Answers 3

Reset to default
5

The shoplifter tester was written before I discovered that there is a relatively easy way to fetch the admin name.

However, I haven't seen any indications of black hats actively scanning for non-standard admin names so far, based on the logs of several thousand Magento shops. So if you patch now, I wouldn't bother with extensive forensics (apart from checking for rogue users).

Clearly, this advice expires once Magento publishes a fix for the admin leak and the knowledge how to use it becomes widespread.

Improve this answer
2
  • 1
    Good to know, thank you! Upvoted all answers but will choose this one as it fits the question. PS: Maybe you should update the shoplift tester note to reflect the newer findings - or even better: update the tester itself to check installations with hidden panels as well :)
    – pong
    Commented May 5, 2015 at 10:38
  • 1
    That would be neat! Otoh, I don't want to make it too easy to test the vulnerability of other people's shops ;)
    – Willem
    Commented May 5, 2015 at 11:32
7

I would always patch your sites even if you have a different admin url. There is some good discussion on this matter over at MageHero but you really should not trust simply obscuring your admin url as it is possible to get the url or to simply guess it. Sure it could take some time to guess it but it would be worth it for a hacker if it is an unpatched site.

Plain and simple patch all your sites, also change the admin url it wont harm to have this also and then maybe consider limiting your admin via ip but this could cause issues for people accessing the admin from outside of the office.

Improve this answer
1
  • 1
    Hi @David, thanks! I had immediately patched all the sites and didn't find any other manipulations other than some extra admins at the compromised one. What I eventually want to know by this question is if I have to further investigate the - at first sight - unexploited sites with hidden admin panels. They are on shared hosting w/out shell access so this would be some pretty expensive operations. Knowing that Shoplift has no impact on any shop without knowledge of the admin URL thus makes a big difference to me.
    – pong
    Commented May 5, 2015 at 7:40
6

What you are referring to is known as "Security by Obscurity" in the IT-Security world. Protecting your shop from further vulnerabilities by hiding some information (the admin path) is not considered as good practise. Even though it makes sense to hide some information, information gathering will be one of the first steps attackers will do.

As shown in the CheckPoint Magento Vulnerability Analysis, they are sending a request to 

GET /index.php/downloadable/Adminhtml_Downloadable_File/ HTTP/1.1

which does not contain the standard or any other custom admin path. Due to this I would assume it's also vulnerable (though I did not test it).

Improve this answer
1
  • 1
    Yep, that is the exact piece of information I stumbled upon :) Since the byte.nl-test cannot evaluate patch status if it doesn't know the admin URL I'm still puzzled. Furthermore, the byte.nl test states that an attacker could guess the URL which implies that a shop is not vulnerable as long as the attacker does not know it. As for 'security by obscurity': thought that my question and its PS would indicate that this is not what I rely on or wanted to know about (no offense ;)
    – pong
    Commented May 5, 2015 at 8:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.