1 
Magento 1.9.1
Porto theme

Our Magento got hacked. The hacker deleted our user accounts and created one for themselves with the user ID of shopmanager1. I had to connect to the database, delete his user account and recreate our user accounts. I had trouble actually re-gaining access to all the Admin features in the Admin panel but I managed to do that. This is the second time this happened in the last 2 weeks so I think I need to figure how they are able to do this?

One of the possible causes I guess is - I didn't install any security patches on top of the 1.9.1 version. I think I should do that. Is there a way to install all the necessary patches without using the Magento Connect tool? The reason I don't want to use the Magento Connect tool is - I disabled it because someone was attacking it few months ago. Also, everytime I used it for anything at all - it just ended up crashing the entire system.

Any suggestions on how I can beef up security will be much appreciated! I already reset all passwords - my Email account, server, account and Admin.

Improve this question

1 Answer 1

Reset to default
2

You can install the patches in Magento 1.x using SSH, by running patch script or by uploading the pre-patched files directly.

Before installing the patches, follow the steps mentioned below:

  1. Back Up Your Magento Installation
  2. Download the Patch (You can find the patches for your Magento version from here)
  3. If your store is compiled, make sure to disable compilation before installing a patch. After installing a patch, test the store thoroughly. Then, run the compiler again. Your store must be recompiled for the patch to take effect.

After following the above steps, you can proceed to install the patches.

I have mentioned the process through SSH below. If you want any other way, you can take a look at this URL.

Install Patches through SSH:

  1. Upload the patch files to the document root of your installation.
  2. In the SSH console, run the following commands according to the patch extension:

.sh extension

sh patch_file_name.sh

.patch extension

patch --p0

  1. Verify the installed patch in app/etc/applied.patches.list.

You can also verify here for the required patches you need to install.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.