4

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such as SEMRush or Bing generating files such as the below:

sess_v82855nfidfk780quho1fpkto7:

_secure_cookie_check|s:32:"9f01d3ce7854010140a04e28e8ea1ff2";core|a:4:{s:23:"_session_validator_data";a:5:{s:11:"remote_addr";s:12:"207.46.13.75";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:24:"session_expire_timestamp";i:1532950280;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:" * _messages";a:0:{}s:20:" * _lastAddedMessage";N;}s:12:"visitor_data";a:15:{s:0:"";N;s:11:"server_addr";s:4:"mËsš";s:11:"remote_addr";s:4:"Ï. K";s:11:"http_secure";b:1;s:9:"http_host";s:23:"www.removedforsecuritypurposes.com";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:20:"http_accept_language";s:0:"";s:19:"http_accept_charset";s:0:"";s:11:"request_uri";s:29:"/catalog/category/view/id/421";s:10:"session_id";s:26:"temfgjqqf4o0miijgedvcf7nq6";s:12:"http_referer";s:0:"";s:14:"first_visit_at";s:19:"2018-07-30

But I've noticed there are loads of Chinese looking files being generated such as below.

sess_vo5835i0cr06lm7loi27ins2a5:

獟捥牵彥潣歯敩损敨正獼㌺㨲㌢挲慢戳攸㕥㙦づ㡢㠷敦㘰ㄳ㙢攸挶∴挻牯籥㩡㨳獻㈺㨳弢敳獳潩彮慶楬慤潴彲慤慴㬢㩡㨵獻ㄺ㨱爢浥瑯彥摡牤㬢㩳㌱∺㘶㈮㤴㜮⸶ㄱ∲猻㠺∺瑨灴癟慩㬢㩳㨰∢猻㈺㨰栢瑴彰彸潦睲牡敤彤潦≲猻〺∺㬢㩳㔱∺瑨灴畟敳彲条湥≴猻㜺㨲䴢穯汩慬㔯〮⠠潣灭瑡扩敬※潇杯敬潢⽴⸲㬱⬠瑨灴⼺眯睷朮潯汧⹥潣⽭潢⹴瑨汭∩猻㈺㨴猢獥楳湯敟灸物彥楴敭瑳浡≰椻ㄺ㌵㤲〵㠱㬷獽㠺∺敭獳条獥㬢㩏㐳∺慍敧䍟牯彥潍敤彬敍獳条彥潃汬捥楴湯㨢㨲獻ㄺ㨲"*浟獥慳敧≳愻〺笺獽㈺㨰"*江獡䅴摤摥敍獳条≥主紻㩳㨸氢獡彴牵≬猻㔺㨷栢瑴獰⼺眯睷攮敤⵮潭楢楬祴挮⹯歵猯潴敲潬慣潴⽲湩敤⽸湩敤⽸㬢捽獵潴敭彲慢敳慼ㄺ笺㩳㌲∺獟獥楳湯癟污摩瑡牯摟瑡≡愻㔺笺㩳ㄱ∺敲潭整慟摤≲猻ㄺ㨳㘢⸶㐲⸹㘷ㄮ㈱㬢㩳㨸栢瑴彰楶≡猻〺∺㬢㩳〲∺瑨灴硟晟牯慷摲摥晟牯㬢㩳㨰∢猻ㄺ㨵栢瑴彰獵牥慟敧瑮㬢㩳㈷∺潍楺汬⽡⸵‰挨浯慰楴汢㭥䜠潯汧扥瑯㈯ㄮ※栫瑴㩰⼯睷⹷潧杯敬挮浯戯瑯栮浴⥬㬢㩳㐲∺敳獳潩彮硥楰敲瑟浩獥慴灭㬢㩩㔱㈳㔹㄰㜸紻捽敨正畯籴㩡㨱獻㈺㨳弢敳獳潩彮慶楬慤潴彲慤慴㬢㩡㨵獻ㄺ㨱爢浥瑯彥摡牤㬢㩳㌱∺㘶㈮㤴㜮⸶ㄱ∲猻㠺∺瑨灴癟慩㬢㩳㨰∢猻㈺㨰栢瑴彰彸潦睲牡敤彤潦≲猻〺∺㬢㩳㔱∺瑨灴畟敳彲条湥≴猻㜺㨲䴢穯汩慬㔯〮⠠潣灭瑡扩敬※潇杯敬潢⽴⸲㬱⬠瑨灴⼺眯睷朮潯汧⹥潣⽭潢⹴瑨汭∩猻㈺㨴猢獥楳湯敟灸物彥楴敭瑳浡≰椻ㄺ㌵㤲〵㠱㬷絽

Is it possible the session folder is somehow being hacked, or could something else be generating these files? Would Chinese/Japanese browsers generate their own language into these files? We have a very secure server and always make sure our website is using the latest patches so it's all a little strange!

  • The translation of the Chinese text, nor the Chinese version itself looks like a valid session file. Are the file permissions for your /car folder set up correctly? – Anna Völkl Jul 30 '18 at 19:45
  • Yes, all my permissions are as per a default Magento installation. – Liam McArthur Jul 31 '18 at 8:19
  • Did you ever solve this as I am havint the same issue with a Magento 2.3.1 upgrade and it is causing issues along the the lines of: Failed to decode session object session destroyed etc etc Be great to know where you got to with this? Thanks Matt – Matt Jun 6 at 9:22
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review – Manashvi Birla Jun 6 at 10:04
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review – sv3n Jun 6 at 10:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.