Our site has been repeatedly hacked over the past week. This is our first Magento site and it has only been up a couple months. The hacker or bot, etc. will go in and disable the other forms of payment besides paypal and switch the account to a paypal account of their own. Obviously I change this back and reenable the other payment methods (which is just check/money order and is actually how we do most of our business). I also check for new users and eliminate those. Then they will do it all again a couple days later. I've changed my passwords. What do I need to do now? There is obviously some vulnerabilities I've not fixed. Perhaps some code that has been inserted somewhere (i read one post about new files in js and media folders but was unable to find any recent modifications by looking at the dates). Maybe I just need to update my Magento version to 1.9.3.2? If that is all I need to do, should I still backup all my data in the manner explained in the different magento upgrade roadmaps or should I just start from scratch since it can be assumed that my original data has been corrupted? Any and all help is greatly appreciated. Thank you.
1 Answer
First Your first responsibility should be to your customers. If someone was able to change your PP credentials then they could be able to inject code to steal their credit card numbers as well, unless your only payment method is PayPal. Even then they could be redirecting customers to a fake PayPal site and stealing their login credentials there as well. You should close your website until you are able to find out the exact nature of the exploit.
Second Report the PayPal credentials to PayPal: https://www.paypal.com/us/webapps/mpp/security/unauthorized-transactions
Third You can use this tool to scan for known vulnerabilities: https://magereport.com/
As with any security breach you should assume that all of your data has been compromised unless you have proof otherwise. Also, you may have some PCI liability here, so you should be careful if you choose to keep your website open until you are able to confirm that the exploit has been removed. If someone can change your PayPal credentials, then they may have also injected code to steal your customer's credit card numbers.
You should talk to your hosting company and have them investigate how you have been compromised. This may involve hiring a third-party company.
In general here are Magento best practices: https://magento.com/security/best-practices/security-best-practices
There are multiple ways someone can access your environment and those are not limited to the Admin Panel users so these methods may not help if you are already compromised. you should be able to look at your access logs to see if you are seeing traffic which is changing
- Set a custom Admin Panel URL: http://docs.magento.com/m1/ce/user_guide/configuration/url-admin-custom.html?Highlight=custom%20admin%20url
- Whitelist IP addresses allowed to access your Admin Panel: https://www.sonassi.com/blog/magento-kb/secure-your-magento-admin
- Enable captcha for admin login: http://docs.magento.com/m1/ce/user_guide/store-operations/security-captcha.html?Highlight=captcha
Please read the Magento article I linked to above and hire someone who has dealt with this before to assist you.
-
Thank you very much for your very informative and clear answer. This gives us a lot of stuff to work on instead of being confused in the dark. The good news is that Paypal Express was our only method of payment besides check/money order, because we do nearly all of our business by the latter at this time. Paypal has also confirmed that the fraudulent transaction took place in their system. They have not, as of yet, been much help besides that. I thought that they held payments for 3 days before making the money available and we contacted them within that window.– JohnCommented Mar 14, 2017 at 17:24
-
Now we are weighing the options: either paying Sitelock monthly for cleanings, firewall, etc., paying them once for cleaning, or simply scrapping everything on the site and starting over. The third option is appealing as the site is brand new without much traffic yet and this is also a learning experience, so starting over and doing things correctly with best practices will be a more educational experience,. not to mention the money saved. Sitelock says that now our domain is marked and we need to pay for security or we will be continually compromised, even with best practices. Is that true?– JohnCommented Mar 14, 2017 at 17:38
-
As mentioned above: Check your shop with magereport.com. And make sure you have all patches applied or update to the latest Magento version. Commented Mar 14, 2017 at 19:29