Tools to Scan Magento Code for Malicious Content

Question

We have a client who is very concerned with Malicious code being introduced in third party modules, especially modules that are coming from Magento Connect (Or any free module) They would like to use one of these modules but want to be assured that the module does not contain code that would allow a hacker to get access to different parts of their Magento site.

My question is this: Is there a tool that we could use to scan code for content? Something like this but maybe more in depth.

function check($contents,$file) {
        $this->scanned_files[] = $file;
        if(preg_match('/eval\((base64|eval|\$_|\$\$|\$[A-Za-z_0-9\{]*(\(|\{|\[))/i',$contents)) {
            $this->infected_files[] = $file;
        }
}

Even a service that can be run on the web server.

Ideally if there was a service that would scan each commit before code got into the repo would be ideal.

Answer 1

Had you thought about running clamav? - https://www.clamav.net/index.html - I ran this recently on a clients Ubuntu server running magento and it came back with two infected files - speed of the scan was impressive and is easily run if you have SSH access - you could also run regularly via a Cron job.

To run clam AV on Ubuntu

To install ClamAV run the following command

apt-get update
apt-get install clamav

Manually update virus databases

freshclam

You will see ClamAV update process started To manually scan files/folders for viruses

clamscan -r --bell -i /

For those not on Ubuntu full instructions can be found here https://www.clamav.net/doc/install.html

Answer 2

There are many ways to obfuscate code so such a simple solution is not a solution at all IMO. If you really want to lock down your system and prevent malicious code I would recommend:

1. Do not allow installation of modules via Connect. Use a git repo and install first on a staging server and only update production via git after thorough testing and inspection.

2. Never ever allow use of modules with obfuscated code, no matter who the developer is. Ask for an unobfuscated copy or just look elsewhere. I sympathize with extension developers wanting to prevent piracy, but if you are concerned about security it is a deal-breaker.

3. If possible restrict outbound traffic via iptables. This is hard since there are so many third-party APIs to integrate with and they can change their IPs at any time, but it is the most sure way to prevent malicious code (Magento or otherwise) from reaching out.

4. Install a tool which monitors your web root for file changes. For example, ConfigServer Firewall and OSSEC have components which do this well, after proper configuration, of course.

If you happen to know of a system that will refresh iptables entries or AWS Security Groups when DNS records update please let me know since I haven't found or built one myself yet..

Answer 3

Try the Magento Malware Scanner, which contains the largest collection of malware signatures that is publicly available. It downloads the latest signatures, handles whitelists and keeps state.

It is recommended by Magento, used by Magento Marketplace, Homeland Security, VISA and many others.

Answer 4

I created a module called MB_Callinghome to do exactly that. The extension is quite simple, it observes the admin login event and search for a configurable string with find and grep. The extension uses exec() which makes it only usable in a staging environment since it might expose the site to an attack if used in prod.

Answer 5

You could perhaps look into using PHP_CodeSniffer or a similar coding standard tool. You would of course need to have a strong understanding of inner workings of what should be considered safe, but you can set it up such that code sniffer would then flag problematic files.

I recall there was a question on here in regards to why the standards used by the module here https://github.com/magento-ecg/coding-standard is so sensitive about thigs like fopen and other file i/o operations.

Using it, you could at least identify what you might wish to consider dangerous code. It would however ultimately still require a review of the code base. Anything which gets flagged up there might be a legitimate code for the purposes of the modules operation. So you cannot rely purely on automatic testing for something of this nature unfortunately.

Answer 6

There are free online tools you can use to scan your Magento installation remotely. These can help you identify credit card swipers, malicious payloads, intermediary domains, and other security issues.

https://sitecheck.sucuri.net/

https://www.magereport.com/

http://www.unmaskparasites.com/

http://webscan.foregenix.com/

https://github.com/gwillem/magento-malware-scanner/

https://magescan.com/

https://www.virustotal.com/