Magento PayPal redirect hacked

Question

I'm a pretty strong developer, but a total newbie to Magento and a friend has asked me to look into his Magento website being hacked.

We are using Magento 1.4.0.1.

Essentially, when the user finally clicked "Pay" at the end of filling out all their details, the browser would go, as normal, to:

[website]/paypal/standard/redirect/

But then this would ultimately redirect to a completely unknown PayPal account but with the right amount prepopulated to pay.

Looking at the PayPal configuration I was unable to reveal the configuration of the business email in the Website Payments Standard section of System -> Configuration -> PayPal as it was asterisked out, and the Website Payments Pro section was unpopulated.

I tried putting in the correct PayPal email address in the Standard section, but then the process would just error. So instead I got the API credentials and filled out the Pro section and then:

• On the first attempt to make a payment the browser was redirected to an entirely new, incorrect and malicious PayPal email address
• On all subsequent attempts, it appears to be going to the correct PayPal account

This worries me that perhaps some other malicious code is being run, and perhaps not on every transaction - although it may well have been some caching issue.

Other than changing all the site passwords, is there anywhere special I should look to check for PayPal hacks? I have inspected \app\code\core\Mage\Paypal\Model\Standard.php and found nothing suspect, but perhaps I am too new to Magento etc. to know where to really look.

Many thanks!

Answer 1

Have you checked the site on MageReport.com? That might give you some insights. Also, when a value in asterisked out in the config, the plain value is probably in the database table core_config_data. You should be able to see the actual value there.

Did you install any of the patches? Magento 1.4.x is pretty old (your version is released in February 2010). If you haven't patches anything (which can be found on MageReport), your site is probably really vulnerable for hacks, so that's a serious issue.

I think it would be wise to review the above first. If they are all checked and everything is secure, you could probably find your answer to setup PayPal properly in the Magento DevDocs.

If your site does show vulnerabilities on MageReport, I'd suggest to either install all patches or upgrade and then check your codebase and database to see if there is anything that looks like a hack. In the database for example, it's pretty common that a piece of malicious script is added to the footer miscellaneous scripts block. And also on the CMS blocks and CMS pages. For your codebase, if you use Git, I'd do a git status for starters and check your Magento installation with a fresh Magento 1.4.0.1 installation.