4

I've noticed that my /var/session/ folder has been filling up really quickly lately so I decided to open a few of the files up to see where they were being generated from. Most of them were bots such as SEMRush or Bing generating files such as the below:

sess_v82855nfidfk780quho1fpkto7:

_secure_cookie_check|s:32:"9f01d3ce7854010140a04e28e8ea1ff2";core|a:4:{s:23:"_session_validator_data";a:5:{s:11:"remote_addr";s:12:"207.46.13.75";s:8:"http_via";s:0:"";s:20:"http_x_forwarded_for";s:0:"";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:24:"session_expire_timestamp";i:1532950280;}s:8:"messages";O:34:"Mage_Core_Model_Message_Collection":2:{s:12:" * _messages";a:0:{}s:20:" * _lastAddedMessage";N;}s:12:"visitor_data";a:15:{s:0:"";N;s:11:"server_addr";s:4:"mËsš";s:11:"remote_addr";s:4:"Ï. K";s:11:"http_secure";b:1;s:9:"http_host";s:23:"www.removedforsecuritypurposes.com";s:15:"http_user_agent";s:71:"Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)";s:20:"http_accept_language";s:0:"";s:19:"http_accept_charset";s:0:"";s:11:"request_uri";s:29:"/catalog/category/view/id/421";s:10:"session_id";s:26:"temfgjqqf4o0miijgedvcf7nq6";s:12:"http_referer";s:0:"";s:14:"first_visit_at";s:19:"2018-07-30

But I've noticed there are loads of Chinese looking files being generated such as below.

sess_vo5835i0cr06lm7loi27ins2a5:

獟捥牵彥潣歯敩损敨正獼㌺㨲㌢挲慢戳攸㕥㙦づ㡢㠷敦㘰ㄳ㙢攸挶∴挻牯籥㩡㨳獻㈺㨳弢敳獳潩彮慶楬慤潴彲慤慴㬢㩡㨵獻ㄺ㨱爢浥瑯彥摡牤㬢㩳㌱∺㘶㈮㤴㜮⸶ㄱ∲猻㠺∺瑨灴癟慩㬢㩳㨰∢猻㈺㨰栢瑴彰彸潦睲牡敤彤潦≲猻〺∺㬢㩳㔱∺瑨灴畟敳彲条湥≴猻㜺㨲䴢穯汩慬㔯〮⠠潣灭瑡扩敬※潇杯敬潢⽴⸲㬱⬠瑨灴⼺眯睷朮潯汧⹥潣⽭潢⹴瑨汭∩猻㈺㨴猢獥楳湯敟灸物彥楴敭瑳浡≰椻ㄺ㌵㤲〵㠱㬷獽㠺∺敭獳条獥㬢㩏㐳∺慍敧䍟牯彥潍敤彬敍獳条彥潃汬捥楴湯㨢㨲獻ㄺ㨲"*浟獥慳敧≳愻〺笺獽㈺㨰"*江獡䅴摤摥敍獳条≥主紻㩳㨸氢獡彴牵≬猻㔺㨷栢瑴獰⼺眯睷攮敤⵮潭楢楬祴挮⹯歵猯潴敲潬慣潴⽲湩敤⽸湩敤⽸㬢捽獵潴敭彲慢敳慼ㄺ笺㩳㌲∺獟獥楳湯癟污摩瑡牯摟瑡≡愻㔺笺㩳ㄱ∺敲潭整慟摤≲猻ㄺ㨳㘢⸶㐲⸹㘷ㄮ㈱㬢㩳㨸栢瑴彰楶≡猻〺∺㬢㩳〲∺瑨灴硟晟牯慷摲摥晟牯㬢㩳㨰∢猻ㄺ㨵栢瑴彰獵牥慟敧瑮㬢㩳㈷∺潍楺汬⽡⸵‰挨浯慰楴汢㭥䜠潯汧扥瑯㈯ㄮ※栫瑴㩰⼯睷⹷潧杯敬挮浯戯瑯栮浴⥬㬢㩳㐲∺敳獳潩彮硥楰敲瑟浩獥慴灭㬢㩩㔱㈳㔹㄰㜸紻捽敨正畯籴㩡㨱獻㈺㨳弢敳獳潩彮慶楬慤潴彲慤慴㬢㩡㨵獻ㄺ㨱爢浥瑯彥摡牤㬢㩳㌱∺㘶㈮㤴㜮⸶ㄱ∲猻㠺∺瑨灴癟慩㬢㩳㨰∢猻㈺㨰栢瑴彰彸潦睲牡敤彤潦≲猻〺∺㬢㩳㔱∺瑨灴畟敳彲条湥≴猻㜺㨲䴢穯汩慬㔯〮⠠潣灭瑡扩敬※潇杯敬潢⽴⸲㬱⬠瑨灴⼺眯睷朮潯汧⹥潣⽭潢⹴瑨汭∩猻㈺㨴猢獥楳湯敟灸物彥楴敭瑳浡≰椻ㄺ㌵㤲〵㠱㬷絽

Is it possible the session folder is somehow being hacked, or could something else be generating these files? Would Chinese/Japanese browsers generate their own language into these files? We have a very secure server and always make sure our website is using the latest patches so it's all a little strange!

7
  • The translation of the Chinese text, nor the Chinese version itself looks like a valid session file. Are the file permissions for your /car folder set up correctly? Jul 30, 2018 at 19:45
  • Yes, all my permissions are as per a default Magento installation. Jul 31, 2018 at 8:19
  • Did you ever solve this as I am havint the same issue with a Magento 2.3.1 upgrade and it is causing issues along the the lines of: Failed to decode session object session destroyed etc etc Be great to know where you got to with this? Thanks Matt
    – Matt
    Jun 6, 2019 at 9:22
  • If you have a new question, please ask it by clicking the Ask Question button. Include a link to this question if it helps provide context. - From Review Jun 6, 2019 at 10:04
  • This does not really answer the question. If you have a different question, you can ask it by clicking Ask Question. You can also add a bounty to draw more attention to this question once you have enough reputation. - From Review
    – sv3n
    Jun 6, 2019 at 10:18

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.