5

I get a warning for one of our sites on magereport.com about the famous Credit Cart Hijack:

Credit Card Hijack detected?

Credit Card Hijack detected?

But there is nothing added to "Miscellaneous HTML" or "Miscellaneous Scripts" configurations, and when I check the HTML source code, I don't find any additional scripts that should not be there. Searching in the minified JS for remarkable parts of the example also yields nothing. Patches were always applied immediately.

I watched the Firebug netwok tab while going through the checkout, entering credit card details and going to the next step. No requests were made except to Magento and to the payment provider.


Since the message from Magereport has a question mark, I am wondering:

Does anybody know of false positives, where harmless scripts were identified as malicious? Or am I looking in the wrong places?

3
  • Never seen a false positive before, would you mind sharing the address in private ? Jun 8, 2016 at 14:16
  • 5
    Hi Fabian & Raphael! MageReport scans for runtime Javascript detection of checkout pages, which turns out to be malicious in 99.998% of the cases ;) But perhaps you have legitimate code in place. Feel free to share the site with me in a PM or code@magereport.com
    – Willem
    Jun 8, 2016 at 14:48
  • 3
    I'm the 0.002% - as we found out it was indeed a false positive from the MageReport heuristic, which should find new variations of the malware, but was triggered by custom code Jun 8, 2016 at 15:04

2 Answers 2

2

The part of the hack that is easily identifiable (whether as JS or in the PHP files) is the use of SESSIID as a cookie.

The cookie can be set via a JS or via PHP.

Thus, the first thing I would check in your case is your browser cookies while doing a purchase.

Go through the checkout process and check your cookies.

If you see a cookie named SESSIID then you're probably affected by the hack.

To check the files you could probably run:

grep -ri "SESSIID" .

On your Magento folder and see what comes up.

Regarding the database, I reckon you need to look in the following tables for the SESSIID string:

  • core_config_data
  • cms_block
  • cms_page
8
  • 1
    Thanks! Good news is, there is no SESSIID cookie. Only one that I don't recognize, frontend_cid, but it's probably related to some third-party service. I'm checking it out now. Jun 8, 2016 at 14:30
  • 1
    @fschmengler great definitely a good news I'm pretty sure you're safe in that case Jun 8, 2016 at 14:31
  • 1
    www/app/code/core/Mage/Core/Model/Session/Abstract/Varien.php: $secureCookieName = $sessionName . '_cid'; - OK, that's core Magento :) Jun 8, 2016 at 14:34
  • @fschmengler yeah I remember working on something related a while back, can't recall what is was though Jun 8, 2016 at 14:35
  • Thanks again, that helped a lot. I'll leave the question open for a while in case somebody knows more about the "why" Jun 8, 2016 at 14:36
0

It is a false positive from TinyMCE.
My fix: https://github.com/etripbikes/m1/commit/2a3d35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.