8

Someone continuously inserts Credit Card Hijack malicious javascript into to my site under

system->configuration->General->Design->HTML Head->Miscellaneous Scripts.

Note: I changed every thing like admin password, FTP, MAGMI everything.

But Still, insert Credit Card Hijack malicious javascript code.

How can I prevent my site from any other attack?

Is any Security extensions available?

Improve this question
4
  • i hope this link will useful for you please check magentocommerce.com/magento-connect/catalogsearch/result/…
    – Nagaraju Kasa
    Commented Aug 5, 2017 at 5:12
  • hello everyone, may I know what is the loop someone inserts script to my site.
    – zus
    Commented Aug 5, 2017 at 5:52
  • please check the index.php of your site and file modified date.
    – Nagaraju Kasa
    Commented Aug 5, 2017 at 6:01
  • @NAGARAJUKASA : No changes in index.php
    – zus
    Commented Aug 5, 2017 at 8:50

4 Answers 4

Reset to default
5
  1. Scan with Magereport.com
  2. Scan with Magescan.com
  3. Do a full virus (eval) scan on the server, or ask your hosting company to do so.

  4. Go to app/etc/applied-patched and make sure that EVERY SINGLE CRITICAL PATCH IS installed. Basically all the grey checks you see in Magereport.com, double-check and make sure that respetive patches are installed.

    1. As precaution, make sure /admin, /downloader, and /rss, is hidden or disabled in .htaccess. They can be used for bruteforcing.

We need to find the cause, since it looks the code is being injected via bypassing all the admin passwords. I highly suspect 2 reasons: 1. Missing patch. 2. 3rd party Extension is being compromised. First one is more likely.

Improve this answer
8
  • When i try to install Security patch 5344 (Shoplift) i get error like,,, see my error : pasted.co/97e53a7f password : kiy258
    – zus
    Commented Aug 5, 2017 at 5:28
  • How can i solve this error
    – zus
    Commented Aug 5, 2017 at 5:28
  • It looks like 5344 is installed that's why its giving you Hunk errors. Check again in app/etc/applied-patches, it could have slightly different number like 5345.
    – Icon
    Commented Aug 5, 2017 at 5:35
  • Here you can check 5344 installation using official magento scan magento.com/security-patch
    – Icon
    Commented Aug 5, 2017 at 5:36
  • what are the values i enter here, website url then?
    – zus
    Commented Aug 5, 2017 at 5:44
1

We've been seeing more and more Magento stores being targeted by hackers. We've noticed that hackers are usually targeting Magento 1.9.X and modifying the following files:

app/code/core/Mage/XmlConnect/Block/Checkout/Payment/Method/Ccsave.php app/code/core/Mage/Customer/controllers/AccountController.php app/code/core/Mage/Payment/Model/Method/Cc.php app/code/core/Mage/Checkout/Model/Type/Onepage.php

Here's a detailed post, I believe it'll be a great add-on for your readers to follow post your article: https://www.getastra.com/blog/911/how-to-remove-fix-magento-opencart-credit-card-malware-hack/

Improve this answer
0

Scan your website here: https://www.magereport.com/ or https://magento.com/security-patch and install required patch and take required action as suggest by scan report.

Improve this answer
0

When you do all suggested then check this extension https://www.extensionsmall.com/mage-fence-security.html

Magefence scan your Magento from backend and search trought php files, which Magereport can't. It has also many other useful security featires.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.