1

My Magento 1.9.3.3 installation had malicious redirects injected into the header. I could easily erase the redirects from System/Configuration/Design/HTML Header/Other Header Content field.

However I would like to know how to prevent it from happening again.

I am not well-versed when it comes to locking down Magento, but I took the following steps:

  1. Via SSH I ran
    • find . -type f -exec chmod 644 {} \;
    • find . -type d -exec chmod 755 {} \;
    • chmod 550 mage to make sure permissions were set correctly.
  2. I changed the admin password.

I did find that the admins user group had 20+ accounts I had never created. I erased those.

Are there additional steps I should/could take at this point?

4
  • Check your site with Magereport.com, do you have any missing patches ?
    – Icon
    Commented Jul 11, 2017 at 17:55
  • Have you found a solution?
    – sv3n
    Commented Jul 13, 2017 at 22:17
  • After removing the fake admin accounts and changing admin path and database password, the issue has not returned. Commented Jul 21, 2017 at 11:50
  • Sounds good ... is changing admin path too worth an accepted answer? ;)
    – sv3n
    Commented Jul 21, 2017 at 18:18

2 Answers 2

0

Not sure if it's same problem as descriebed here:

I don't know how they got access, so first things (as posted in related questions) could be

  • changing DB password (and all others too)
  • maybe change admin path
  • apply all patches (just to mention ... you're already up2date)
  • check admin accounts (as you did)
  • check server for malicious scripts

Wait for possible fix ... :(

3
  • Thank you for your suggestions. I've applied them all and asked my host to scan for known infections. Also thanks for editing the formatting of my post, I should've paid more attention. I wonder if finally upgrading to 2.x would make my site more secure or not really... Commented Jul 11, 2017 at 15:22
  • As written in another question it seems that only 1.9.x is affected. So updating to 2.x could help. After several users reported this i think its Not related to an extension. I hope changing credentials prevents you from further damage - at least for the next days. (maybe another patch is released - if its related to core code). Btw, formating was okay, just changed for better readablity :)
    – sv3n
    Commented Jul 11, 2017 at 17:16
  • 1
    These steps were very helpful in resolving the problem, thank you. Commented Jul 21, 2017 at 18:38
0

I'm not sure how these attacks are happening but you could change the frontName in local.xml

<admin>
 <routers>
  <adminhtml>
    <args>
      <frontName><![CDATA[something_not_easily_guessed]]></frontName>
    </args>
  </adminhtml>
 </routers>
</admin>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.