1

My Magento 1.9.3.3 installation had malicious redirects injected into the header. I could easily erase the redirects from System/Configuration/Design/HTML Header/Other Header Content field.

However I would like to know how to prevent it from happening again.

I am not well-versed when it comes to locking down Magento, but I took the following steps:

  1. Via SSH I ran
    • find . -type f -exec chmod 644 {} \;
    • find . -type d -exec chmod 755 {} \;
    • chmod 550 mage to make sure permissions were set correctly.
  2. I changed the admin password.

I did find that the admins user group had 20+ accounts I had never created. I erased those.

Are there additional steps I should/could take at this point?

Improve this question
  • Check your site with Magereport.com, do you have any missing patches ? – Icon Jul 11 '17 at 17:55
  • Have you found a solution? – sv3n Jul 13 '17 at 22:17
  • After removing the fake admin accounts and changing admin path and database password, the issue has not returned. – Mika Salakka Jul 21 '17 at 11:50
  • Sounds good ... is changing admin path too worth an accepted answer? ;) – sv3n Jul 21 '17 at 18:18
0

Not sure if it's same problem as descriebed here:

I don't know how they got access, so first things (as posted in related questions) could be

  • changing DB password (and all others too)
  • maybe change admin path
  • apply all patches (just to mention ... you're already up2date)
  • check admin accounts (as you did)
  • check server for malicious scripts

Wait for possible fix ... :(

Improve this answer
  • Thank you for your suggestions. I've applied them all and asked my host to scan for known infections. Also thanks for editing the formatting of my post, I should've paid more attention. I wonder if finally upgrading to 2.x would make my site more secure or not really... – Mika Salakka Jul 11 '17 at 15:22
  • As written in another question it seems that only 1.9.x is affected. So updating to 2.x could help. After several users reported this i think its Not related to an extension. I hope changing credentials prevents you from further damage - at least for the next days. (maybe another patch is released - if its related to core code). Btw, formating was okay, just changed for better readablity :) – sv3n Jul 11 '17 at 17:16
  • 1
    These steps were very helpful in resolving the problem, thank you. – Mika Salakka Jul 21 '17 at 18:38
0

I'm not sure how these attacks are happening but you could change the frontName in local.xml

<admin>
 <routers>
  <adminhtml>
    <args>
      <frontName><![CDATA[something_not_easily_guessed]]></frontName>
    </args>
  </adminhtml>
 </routers>
</admin>
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.