2

It appears that our website is infected with the Credit Card Hijack malware. We ran scans on magereport.com, webscan.foregenix.com, and quttera.com, and they all say that our /js/prototype/prototype.js file is infected.

Foregenix specifically says the malware definition is MW:JS:GEN2?malware.magento shoplift.002.02. The details mention the line of script:

if((new RegExp('onepage|checkout|onestep|payment|transaction','gi'))
.test(window.location))

Quttera mentions the following threat dump code:

[[var Prototype = {     
    Version: '1.7',
    Browser: (function(){
        var ua = navigator.userAgent;
        var isOpera = Object.prototype.toString.call(window.opera) == '[object Opera]';
        return {   IE: !!window.attachEvent %26%26 !isOpera,
           Opera: isOpera,
           WebKit: ua.indexOf('AppleWebKit/') > -1,
           Gecko: ua.indexOf('Gecko') > -1 %26%26 ua.indexOf('KHTML') === -1,
           MobileSafari: /Apple.*Mobile/.test(ua)   
        }   
    })(),
    BrowserFeatures: {
        XPath: !!document.evaluate,
        SelectorsAPI: !!document.querySelector,
        ElementExtensions: (function() {
            var constructor = window.Element || window.HTMLElement;
            return !!(constructor %26%26 constructor.prototype); 
        })(),
       SpecificElementExtensions: (function() {
          if (typeof window.HTMLDivElement !== 'undefined')
               return true;
          var div = document.createElement('div'),
          form = document.createElement('form'),
          isSupported = false; 
          if (div['__proto__'] %26%26 (div['__proto__'] !== form['__proto__'])) {
              isSupported = true;
          }
          div = form = null; 

We previously had this same malware detection and had our developer go in and remove the malware and any related files. Following his work, the website was showing as clean when scanned with the aforementioned scanners. He performed this last Wednesday, but upon scanning today, it looks like it is all back.

What steps do you suggest I take to remove and protect against this? We are looking at Sucuri or Customer Paradigm as options, yet would like to explore additional options as those two companies come with a steep price tag. Thank you for your help!

5

If you just cleaned up the code without upgrading to the lastest Magento version or applying the latest patches there is a good chance the same vulnerability to inject the malware was used again.

Update to the latest version CE 1.9.3.1 or apply all (missing) security patches.

You can check your site with http://magereport.com to find out what's missing.

Furthermore, you might be interested in the answers here: Website infected by virus and Magento hacked even after applied patch

0

Re-infections signal that the hacker has planted backdoors in your website. The line of script you mentioned is a regex expression checking for mentions of payment related terms. This is often seen as a part of credit card hacking malware. Consider giving a read as similar script was used to manipulate and add fake payments for magento site.

Like you said your developer cleaned the malware only last wednesday but the website was infected only the following week. This means that the hacker still has access to your website through backdoors & loopholes.

One case study that we encountered a few days ago:

Video thumbnail
Fix Credit Card Hack on YouTube

Or it may also happen that there are unpatched vulnerabilities in your Magento extensions. As such, the primary step would be to install all the magento security patches. Once installed, the payment flow must be carefully assessed to obtain further details on how the credit card details are being stolen.

To be completely sure that no re-infections occur, consider an in-depth security audit.

This infographic helped many hacked magento site, consider giving a read:

enter image description here

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.