I believe a site I've been working on has been hacked.

Here's what I know:

  1. PayPal seller address has changed to a random address
  2. This is not a PayPal bug
  3. Going through the logs - this wasn't changed through the Magento admin
  4. No one has access to the AWS EC2 instance besides me
  5. What is being changed is the row with path paypal/general/business_account under the core_config_data table
  6. Chances of MySQL injection seems fairly low. I've grepped through the nginx and Varnish logs for 'select' - should I be grepping for anything in particular?

I would appreciate advice on the next steps to take as an answer.

  • I hope your problem is meanwhile already solved? Jan 12 '15 at 17:22
  • @AnnaVölkl yes it was solved by re-generating the API key. Jan 12 '15 at 22:10

This seems to have been a very remote bug that's not easily reproducible. The fix was to re-generate the PayPal API key and set it into Magento.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.