0

Our shop get repeatedly infected with a "crypto-miner" malware. Its a javascript code that mines cryptocurrency on the client's CPU.

Everytime this happens I can find and remove the code in the Backend under:

System->General->Design->HTML Head->Miscellaneous Scripts

We use Magento 1.9.3.7 with the latest security patches. I also changed the admin password but it doesn't help.

I would like to know how to prevent these attacks to happen again.

4
  • 1
    Look in the php files, i remember i read a post about a hack which saves malicious code in config. But to really fix it you should diff your core with a vanilla magento. Also there are some nice shell scripts out there to find hacks in source files.
    – roman204
    Feb 11, 2018 at 6:28
  • What tool do you recommend to compare diff with vanilla or to find hacks in source files? Feb 11, 2018 at 11:37
  • 1
    Even if you use Magento with all latest patches, it's possible you are using some outdated/exploitable 3rd party extensions. It's important to find out when and where things go wrong, so maybe try to look through webserver access/error logs, change passwords etc. I've seen a similar case with a fully patched Magento shop which had code injected in HTML header/footer via Magmi because the DB credentials where accessible via browser. good luck! Feb 12, 2018 at 10:44
  • 2
    i suggest github.com/gwillem/magento-malware-scanner
    – roman204
    Feb 14, 2018 at 12:23

1 Answer 1

3

Even if you use Magento with all latest patches, it's possible you are using some outdated/exploitable 3rd party extensions.

It's important to find out when and where things go wrong, so maybe try to look through webserver access/error logs, change passwords etc.

I've seen a similar case with a fully patched Magento shop which had code injected in HTML header/footer via Magmi because the DB credentials where accessible via browser.

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.