0

My site was hacked having magento version 1.9.1.1, now I have upgraded it to 1.9.3.3 and scanned it with maldet.Removed all the infected files also. Checked site with link, report saying

  • Security patch 5344 (Shoplift)is unknown
  • Security patch 8788 not patched
  • Brute force attacks? unprotected

Is there any way to check, remove and prevent malware completely.

Thanks in advance:)

Improve this question
5
  • Is possible to get META tags....
    – user51361
    Commented Jun 13, 2017 at 6:20
  • Yes sure, what will we do with these?
    – user00247
    Commented Jun 13, 2017 at 6:26
  • Actually, 2 weeks before one of my friend site under ransomware attack, he developed the site by core PHP... How can i get my meta tags.
    – user51361
    Commented Jun 13, 2017 at 6:38
  • You can compare 1.9.3.3 Magento code and your code any change in core file file.
    – Rama Chandran M
    Commented Jun 13, 2017 at 11:18
  • But comparing code may take a lot time :(
    – user00247
    Commented Jun 13, 2017 at 11:49

1 Answer 1

Reset to default
1

I wouldnt say completely securing is possible but you can make it a lot more difficult and far less likely if you follow some simple steps. Usually i do the following steps:

  1. Move downloader out of root into protected directory like var. (If it's needed you can move it back but best to not allow access to this)

  2. Move and lock down /admin and lock down /rss / as per magento recommendations: add the following rule in the root .htaccess file (inside ):

    RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx RewriteRule ^(index.php/)?admin/ - [L,R=403] RewriteCond %{REMOTE_ADDR} !^xx.xx.xx.xx RewriteRule ^(index.php/?)?rss/ - [L,R=403]

  3. Keep track of new patches & Install as soon as possible.

  4. Set correct permissions and make sure all .htaccess as present these protect some directories like var from being viewed etc.
  5. Do not use usernames like admin as a login and use strong passwords. This makes brute force a lot more difficult.
  6. Keep modules installed to a minimum i know there have been vulnerabilities in modules like Web Forms Pro.
  7. Your Servers sftp/ssh accounts need securing also, i use two factor authentication however strong passwords and regularly changing passwords also will help significantly.
  8. Monitor access, if there are any issues monitoring is often the best defense and you can instantly see suspicious behavior like someone trying to brute force an account.
  9. Launch entire site using https

Many other things can be done to create a secure environment including keeping servers up to date ect. There are lots of articles across the web regarding this see here for a document from Magento http://docs.magento.com/m1/ce/user_guide/magento/magento-security-best-practices.html

Improve this answer
5
  • Thanks for reply:) but let me know how to remove malware that is already present.
    – user00247
    Commented Jun 13, 2017 at 11:12
  • Oh sorry i thought this was done, maldet is a start but once someone is in there is a chance there can be random files that aren't detected. I just reinstall a fresh Magneto using the same database, skin, and images. However there can be Malware even here i manually just look through to check any strange php files in these folders that shouldn't be but not sure this is the quickest way and someone may suggest something better for this like some software.
    – harri
    Commented Jun 13, 2017 at 11:17
  • Also as suggested by Rama comparing against core can be done ive done this before with software that can quickly compare 2 folders if you download both your filesystem and the original Magento version. However this can take a lot of time also. This is why i often reinstall on a fresh Magento but as i said these files will often be elsewhere other than core.
    – harri
    Commented Jun 13, 2017 at 11:36
  • But comparing code may take a lot time, do you know any tool for removal?
    – user00247
    Commented Jun 13, 2017 at 11:48
  • Yeah it does take a long time you can use winmerge and programs like this to make comparison easier however for scanning it's hard for me to recommend as i have normally done it like you with maldet however then copied a new core and manually checked my theme or restored theme from an earlier backup as this is all that's left of the comprimised site. I have googled however and found some examples here for Linux servers: howtoforge.com/tutorial/…
    – harri
    Commented Jun 13, 2017 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.