0

For a few weeks, my admin and user password are stolen.

I followed all the rules against brute force, but after a few days, after I restore the website with the old backup, I found a new admin user and password.

What is strange is that today I found the previous admin user and a impossible to decrypt password: '39a5b5d9bb44e4d16227f7c71aa60af6:USi9sn2VLm3SssMLS8BS7QrJ2kQFRjvs'

I have 1.9.2.4 version, including captcha on the backend login.

Please help me with some advice,

  • What service are you using to serve your website? Like Apache Or Nginx, etc... Check your access_log to see if you can find some odd requests or something, check which pages they're visiting. It could be a malicious or poorly made module that is letting them gain access into your site, which modules do you have installed if any? – Iqbal Khan Dec 29 '16 at 17:47
  • Try magereport.com to see if you are missing a patch or two and report back with more info. – mbalparda Dec 29 '16 at 17:59
1

First, check your site in magereport. You will see if any patches are missed or your admin url is disclosed.

Basically, you should have custom admin url which can be accessed from your IP only. If you have followed the best practice of Magento security, these things are explained.

Like you said, you have followed all instruction for brute force, but still they are able to take control of your admin.

Most likely,

I suspect few things:

  1. Your backed up site is also infected.
  2. Some custom extensions have the vulnerability.
  3. Intruder have installed "Magpleasure/Filesystem" extension, which allows to control remotely.
  4. Your database is also infected

Most of the time these files are infected

  1. Mage_Cms_IndexController
  2. core/functions.php
  3. lib/Varien/Db/Adapter/Pdo/Mysql.php
  4. many more

Check these links for more help

  1. https://magentary.com/kb/magento-recovery-shoplift-vulnerability/
  2. https://blog.sucuri.net/2015/10/massive-magento-guruincsite-infection.html
  3. https://blog.sucuri.net/2015/04/magento-shoplift-supee-5344-exploits-in-the-wild.html
  4. https://magento.com/security
  • 1
    Good summary. Nice answer! – Anna Völkl Dec 31 '16 at 10:07
  • Thank you and Happy new year, For now, i installed the patch SUPEE-8788 for 1.9.2.4 and i set captcha on admin; for one week i don't have any issues, i hope to works well. – Silver Jan 9 '17 at 19:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.