Search results containing Chinese pages?

Question

I'm struggling with a, once hacked, Magento 1.9 webshop that somehow keeps generating malicious pages that are crawled by Google.

The client came to us as he thought the shop could be hacked. We discovered that the webshop was indeed hacked and that pretty much all necessary security patches were missing.

We first cleaned the site, installed all the patches and rechecked the webshop several times only to find out that everything was back to normal. However, starting a couple of weeks ago many "Chinese" results are appearing in the search engines.

The URL's look like - http://www.mywebsite.com/5iadl2930d9e3d.html both titles and descriptions are filled with Chinese text.

What would be the place to start and where are these URL generated from?

Answer 1

Magento itself may not be the culprit. User account could be compromised. Some server software could be compromised as well. Did you e.g. check crontab when you secured the site last time? Otherwise, you may have left the backdoor open.

Besides that, where would I have started?

Two quick checks: Review the plugin / modules. Are any of these old or have known security issues? Use available Magento tools to check for security issues (but... a skilled hacker, I assume, would have patched your server, to keep others out).

Then, review the server.

• Look on available users. Any suspicious?
• Look on each users incl. roots history (command history).
• Look on log files in var/logs, also look for missing log files.
• Look on file permission, change and size. Suspicious files may be large, have strange access (rwxrwxrwx), be large or recently changed.
• Look in cron tab for strange cron jobs.

==> I would have done a complete reinstall of the server. Then also heavily restricting the access of the client.