Malware in Miscellaneous Scripts section in General/ Design tab

Question

OK so google informed me that my website had been compromised and had Malware so they were showing a warning to people coming to my website through Chrome.

I have found the Malware it looked something like this

<script>
var _0x7539=["\x6C\x6F\x63\x61\x74\x69\x6F...

It was in Miscellaneous Scripts section in General/ Design tab.

I have removed it but how do I prevent it from happening again, do the hackers have a back door? What do I do.

I thought I was doing everything right.

I have a CDN, blocked access to downloader, installed the patches and have strong passwords.

Can anyone else give me some more information?

Answer 1

For that Magento introduced patch call SUPPEE-6788 and SUPPEE-7405. So please patch it with your magento.

Or else please upgrade the Magento to 1.9.2.4(latest version), so it will automatically install these patches.

And remember you need to competeble all the extension with this patch.

Hope this will help you. Thanks

Answer 2

I have removed it but how do I prevent it from happening again, do the hackers have a back door? What do I do.

At least they did have one, but you should assume the worst case that they still do.

I have a CDN, blocked access to downloader, installed the patches and have strong passwords.

That's good but there are many possible attack vectors, such as:

• used exploits before there was a patch for them
• insecure extensions
• insecure server software
• other PHP applications running under the same user

You should take this as a serious threat. At least:

• change all passwords (SSH, MySQL, Magento admin)
• make sure everything on the server is getting security updates
• search for other malicious scripts and backdoors

Better: Do a clean reinstallation.

See also: Probably security issue